Building an Automated Token Allowance Scanner with Python

Every time you swap tokens on Uniswap or deposit into a DeFi protocol, you grant ERC-20 token allowances — permissions that let smart contracts spend your tokens. Most users accumulate dozens of these approvals over time, many with unlimited amounts, creating a silent attack surface. A compromised contract with an active allowance can drain your wallet without needing your private key.

In this article, we build an automated allowance scanner with Python and Web3.py that audits every approval across your address, identifies risky ones, and generates revocation transactions. To get started, run pip install web3 requests eth-account, and begin by querying the Etherscan API for Approval events across all ERC-20 tokens.

Stock photo for illustration only, not from the actual event

The core logic involves classifying each allowance using a custom function. It checks if the amount equals MAX_UINT256, flagging it as high risk with an Unlimited approval reason. Furthermore, it checks if the spender is a verified contract by retrieving its code; if the spender code is empty indicating an EOA rather than a contract, the risk level escalates to critical. The function then fetches the token symbol and converts the amount from wei into a readable format or an infinity symbol for unlimited allowances.

Once we identify risky allowances, we can proceed to build the revocation function to generate transactions that revoke those permissions. The full source code is available on GitHub by Byaigo — clone it, run the scanner against your own addresses, and audit what you have approved over the years. You might be surprised by the results.

Source: Dev.to