Since 2019, Revoke has helped millions of users stay safe, preventing over $140M in losses from smart contract hacks.

We want to make sure we can continue to protect our users for the years to come. To be able to do that, we're introducing a small batch revoke fee.

🧵👇 For years, Revoke has been 100% free and open source, supported entirely by grants and donations.

As the crypto ecosystem changed and public goods funding declined, this model became unsustainable.

To keep building and protecting users, we need a sustainable model.

🤔 "If I revoke my staking approval - will I lose my staked tokens?"

One of the most common questions we get.

The good news?
This fear is based on a misunderstanding - not reality.

Here's the truth. 👇 2/ First: What is staking?

Staking means you're depositing tokens into a smart contract to earn rewards or participate in protocol activity.

Before doing that, you usually grant the contract permission (an approval) to move your tokens.

🐍 Ever heard of "address poisoning"?

It's one of crypto's sneakiest scams - and most users don't even know it exists.

No fake websites. No malware downloads.

It just waits for you to make a tiny mistake.

Let's break it down 👇 2/ Unlike other scams, address poisoning doesn't come through the front door. 🚪

You're not being phished. You're not running shady software.

Scammers simply send a small transaction using a wallet address that looks just like one you've interacted with before. 🪞

😨"Can I get hacked if I approve a token on a testnet?"
The short answer: No.

Testnet tokens are worthless, and testnet approvals won't affect your real assets.

Let's break it down 👇🧵 1/
We get it - approvals are scary.
But testnets are designed to be safe sandboxes.
Think of it like playing poker with monopoly money. 🃏
Even if you go all in, you're not losing real ETH.

Today we received a report of a sneaky trick that scammers use to steal your crypto assets. It revolves around "masking" a network's name to make it seem like you're sending some inconsequential token, while you're actually sending valuable assets 😱 We've all seen popups like these, when a website prompts us to switch our wallet to the required network. But in this case there's something weird going on: we're adding the network called "Totally Not A Scam" with symbol "SCAM", but it has the same chain ID as BNB Chain 🤔

The Revoke browser extension is fully open source and client-side.

But what does that mean? 🤔👇 Many extensions that provide transaction insights (like @wallet_guard or @PocketUniverseZ or @_joinfire) send transaction data to a server that simulates the transactions and returns the results.

E.g. "you will approve all your Bored Apes" or "you will swap 1 ETH for 1800 DAI".

Yesterday, we received reports of people seeing unknown approval transactions in their transaction history.

It turns out that this is a new scam where scammers use so-called gas tokens to steal money when victims revoke these "fake approvals". Fortunately, many of these approvals weren't showing up in Revoke, since they were filtered out based on heuristics, but a few always slip through the cracks.

So to combat this scam we've just added a check that disables revoking approvals if there's an excessive gas fee.

As we've seen with last month's SushiSwap exploit, even established projects can contain bugs that put approved funds at risk. In these situations it is important to check if you're affected quickly, which is why we're launching our Exploit Checker. We realise that it is hard to find out if you are affected by an exploit by just looking at your list of allowances, especially if you have many of them.

PSA: Not every allowance needs to be revoked, some of them are automatically revoked when you use them completely.

We've recently gotten incorrect reports of "missing" allowances because many people don't understand the difference between these two.

Let's dig in 👇 1/ For ERC20 tokens, there are two types of allowances that you can grant: Unlimited and Limited. For an Unlimited allowance you give access to your entire token balance for the specified token (e.g. USDC). This type of allowance will stay active until it is revoked.

Getting scammed is terrible. But it's even worse if you don't understand how it happened.

There are four main kinds of methods that phishing scammers use to steal your funds:

1. SEED PHRASE COMPROMISE
2. DIRECT ETH TRANSFERS
3. APPROVALS / PERMITS
4. NFT MARKETPLACE LISTINGS 1/ SEED PHRASE COMPROMISE.

In this case, scammers will trick you into entering your seed phrase into a popup that looks like it belongs to M*taM*sk.