Set Custom Token Allowances in MetaMask: Step-by-Step

DeFi Intel Research · Updated 2026-07-02 · intermediate

Every time you connect your wallet to a decentralized app (dApp) and approve a token, you’re granting permission for that smart contract to spend a certain amount of your tokens. By default, many dApps request an unlimited allowance—effectively giving them the keys to your entire balance of that token, forever. While convenient, this practice introduces a major security vulnerability: if the dApp’s contract is compromised or malicious, an attacker can drain every token you hold.

In this guide, you’ll learn how to set custom token allowances in MetaMask, specifying only the exact amount needed for your transaction. We’ll walk through the manual process step by step, cover how to verify and revoke existing allowances, and explain the underlying mechanics of ERC-20 approvals. By the end, you’ll be able to interact confidently with any dApp while keeping your assets safe from over‑permission risks.

Why Default Unlimited Approvals Are Dangerous

When you approve a token for a dApp, you’re executing an approve() function on the token’s smart contract. This sets an allowance—the maximum amount the dApp’s contract can spend on your behalf. Most dApps request the maximum possible value (2^256 - 1) to avoid repeated approval prompts for small transactions. However, this creates a persistent risk: the allowance remains until you explicitly revoke it, and if the dApp’s contract ever gets exploited, the attacker inherits that spending power.

High‑profile hacks have drained millions because users left unlimited approvals active on compromised protocols. By setting a custom allowance—for example, exactly 100 USDC for a single trade—you limit the potential damage to that precise amount. Even if the contract is later compromised, the attacker can only take what you allowed, not your entire balance.

⚠️ Important: An unlimited allowance never expires. It stays valid until you manually revoke it, making you vulnerable long after you’ve stopped using the dApp.

Understanding ERC-20 Allowances

The ERC-20 token standard defines a two‑step approval process: first you call approve(spender, amount) to set the allowance, then the dApp’s contract calls transferFrom(yourAddress, recipient, amount) to move tokens. The allowance is stored on the token contract, not in MetaMask. You can check it at any time via Etherscan or any block explorer.

Allowances are specific to a token–spender pair. Approving 100 DAI for Uniswap V2 doesn’t affect any other DAI allowances you might have for other dApps. When you set a custom allowance, you’re simply lowering the approval to the exact amount needed—often the number of tokens you want to trade plus a small buffer for network fees (if applicable, though gas is paid in ETH, not the token).

In MetaMask, when you click “Approve,” the wallet displays a confirmation screen showing the requested allowance. If the dApp asks for an unlimited amount, MetaMask shows a warning: “This can leave your balance at risk.” By manually editing the allowance field, you override the dApp’s request with your custom value.

Prerequisites for Setting a Custom Allowance

• MetaMask installed and unlocked – Ensure you are on the correct network (Ethereum mainnet, Polygon, Arbitrum, etc.) where the token exists.
• The token you want to approve – Have the token contract address handy, or simply interact with the dApp that requires the allowance.
• A dApp that triggers an approval – The custom allowance workflow begins when you perform an action that needs token spending, like swapping, depositing, or staking.
• Etherscan (or a block explorer) – Useful for verifying and revoking allowances after the fact.
• Understanding of the required amount – Know exactly how many tokens you want to permit. For a one‑time swap, that’s the swap amount plus a tiny buffer (e.g., 0.1% more) to cover rounding. For recurring interactions (like a savings protocol that auto‑compounds), you may need a higher allowance to cover multiple future transactions.

If you see an approval prompt but cannot edit the amount in MetaMask, try using the “Use custom” toggle (if present) or switch to the advanced interface. As of late 2023, MetaMask’s default approval screen allows you to set a custom value by clicking the “Edit” button next to the amount.

Step-by-Step: Setting a Custom Allowance in MetaMask

1. Initiate an action on a dApp – For example, go to a DEX and click “Swap” with a token pair. The dApp will ask you to approve the token first.
2. Open MetaMask’s approval notification – A pop‑up window appears showing the token, the dApp’s address, and an “Allow [dApp] to spend your [token]?” message.
3. Click “Edit” (or “Custom”) next to the allowance amount – By default, MetaMask shows a high allowance (often unlimited). Click the pencil icon or the “Edit” button.
4. Enter your custom allowance – Type the exact number of tokens you want to authorize. For a trade of 50 USDC, enter 50. For safety, add a tiny margin (e.g., 50.05 USDC) to account for price fluctuations or slippage. Do not leave commas or decimals unless the token uses them. MetaMask will automatically adjust for decimals (e.g., USDC has 6 decimals, so 50 becomes 50,000,000 in base units).
5. Confirm the transaction – Review the new allowance in the confirmation screen (it will show “Custom” instead of “Unlimited”). Sign the transaction and pay the gas fee. Once confirmed, the dApp can spend up to exactly that amount.
6. Complete your original action – The dApp will now call transferFrom to pull the tokens. You have successfully avoided an infinite approval.

If the dApp requires a higher allowance later, you will need to approve again. This is a small inconvenience for significantly better security.

Alternative Method: Using Etherscan’s Token Approval Tool

If you want to set a custom allowance without interacting with a dApp (for example, to pre‑approve a contract you intend to use later), you can use Etherscan’s “Token Approval” tool. This is also useful if MetaMask’s built‑in editing is not working as expected.

• Go to the token’s contract page on Etherscan (e.g., USDC on Ethereum).
• Under the “Contract” tab, select “Write Contract.”
• Click “Connect to Web3” and connect your MetaMask.
• Find the approve function. Fill in:
  • spender – The dApp’s contract address you want to allow.
  • amount – The custom amount in the token’s smallest unit (e.g., USDC has 6 decimals, so 50 USDC = 50,000,000). Use a token unit converter if unsure.
• Click “Write” and confirm in MetaMask.

This method gives you full control but requires understanding of token decimals. A safer alternative for revoking allowances is a dedicated tool like Revoke.cash—though editing via the contract write is doable.

For most users, the direct MetaMask approach is simpler and less error‑prone.

How to Verify and Revoke Existing Allowances

Even after you start setting custom allowances, you may have old unlimited approvals still active. To verify them:

• Go to Revoke.cash (supports multiple networks) or use Etherscan’s “Token Approval” checker.
• Connect your wallet. The tool will display each token and the approved spender with their allowance (e.g., “Unlimited” or a specific number).
• If you see an approval you no longer trust, you can revoke it by setting the allowance to 0.

To revoke via MetaMask directly:

1. Send a transaction to the token’s contract address with a data payload that calls approve(spender, 0). This is advanced.
2. Easier: Use Revoke.cash’s “Revoke” button. It will pop up a MetaMask transaction that sets the allowance to zero.

Always revoke allowances for dApps you no longer use, or those with questionable security. A best practice is to keep a minimal allowance only for active protocols and revoke all others.

You can also set custom allowances to a future‑proof amount—like slightly more than you think you’ll need—to avoid frequent re‑approvals. But revoke any that are truly infinite.

Security Best Practices for Allowance Management

• Always use custom allowances – Default unlimited approval should be an exception, not the norm. Take the extra 10 seconds to set a precise number.
• Revoke unused allowances regularly – Set a reminder to check old dApps every 3–6 months. Tools like Revoke.cash or Etherscan’s Token Approval Checker make this easy.
• Consider using a hardware wallet – A Ledger or Trezor can’t automatically approve malicious contracts without your physical button press, adding another layer of defense.
• Double‑check the spender address – A common attack vector is a dApp displaying a legitimate name but pointing to a malicious contract. Verify the spender address against the official dApp’s documentation or via reputable sources.
• Be cautious with “permit” signatures – Some dApps use off‑chain permit signatures (EIP‑2612). These give approval without a transaction, but the same custom‑allowance principle applies—you can limit the amount in the signed message.
• If you’re a power user, consider a dedicated “approval” wallet – Keep a small hot wallet for approvals and a cold wallet for savings. This limits exposure.

By adopting these habits, you significantly reduce the attack surface of your portfolio.

Troubleshooting Common Issues

Issue: MetaMask won’t let me edit the allowance.

Some dApps use a custom approval UI that bypasses MetaMask’s editable prompt. Try starting the approval from a different part of the dApp, or use a block explorer as described above. Also, ensure MetaMask is updated to the latest version.

Issue: I set a custom allowance but the transaction still failed.

Check that the amount you entered is in the token’s decimal format. For example, USDC uses 6 decimals—to approve 50 USDC, you should enter 50, not 50000000 (though MetaMask will usually convert for you). If the dApp expects a different unit, the approval might be too low. Try increasing the allowance by a small margin (e.g., 0.5%).

Issue: I accidentally set an unlimited allowance. How do I fix it?

Immediately revoke that approval using Revoke.cash or via the token contract method. Then set a fresh custom allowance.

Issue: The dApp requires frequent approvals.

If you interact with the same dApp often (e.g., a lending platform that auto‑harvests), consider setting a larger custom allowance (like 10–20× your usual order) to avoid repeated gas costs. This is still much safer than an unlimited one.

Frequently asked questions