Revoking Solana token delegate approvals

The short answer

Each SPL token account can have at most one active delegate—an address given permission to transfer or burn tokens from that account up to a set amount, without taking custody or removing your ownership (Solana docs). Approving a new delegate automatically replaces any previous one, and only the account owner (or, on Token-2022, the delegate itself) can revoke it (Solana docs).

This is the Solana-specific equivalent of the ERC-20 "approval drainer" problem on EVM chains—narrower in scope, since a delegate is capped and singular per account, but still a standing permission that outlives the swap, mint, or dApp session that created it.

Finding your active delegates

Some wallets surface delegate approvals directly in their UI—Solflare, for example, includes an approvals view alongside its Solflare Guards risk flagging (Solflare). Where a wallet doesn't expose this, developers can query it directly with Solana RPC's getTokenAccountsByDelegate method, which returns every token account that has approved a given address as delegate (Helius RPC guide). A handful of community "revoker" tools wrap this into a connect-and-review interface—treat any third-party revoker tool with the same scrutiny as any other dApp: verify the domain, use a burner wallet if unsure, and read what you're signing.

Revoking a delegate

Revoking sends a Revoke instruction to the Token Program, which clears the delegate field on that token account and resets the delegated amount to zero—after which the previous delegate has no further transfer or burn authority (Solana docs). It requires a small SOL network fee and one signature from the account owner. Because each token account can only carry a single delegate, you revoke per token account, not globally across a wallet—if you hold ten tokens, check all ten.

Make it a routine, not a one-time fix

Every swap, mint, and dApp connection is a chance to approve a new delegate. Checking and clearing delegates on a monthly cadence—more often during active trading periods—closes standing exposure before it's ever exploited, the same way clearing ERC-20 approvals is standard practice on EVM chains.

Sources