Every other guide on this site is about evaluating a token. This one is about the layer underneath: the wallet doing the buying. A token can pass every safety check and still cost you everything if the wallet holding it was compromised elsewhere — and on Solana that compromise works differently than most people assume, because most people are carrying an Ethereum mental model.
Solana Approvals Are Not Ethereum Approvals
On Ethereum, approving a contract writes an entry into an allowance table, and infinite approvals are common. Solana works through a different mechanism entirely: you approve a delegate on one specific token account, up to a specific amount.
The practical difference matters. A delegate does not hold your private key, does not become the wallet owner, and gains no authority over other tokens in your wallet — its power is scoped to that single token account. That is genuinely narrower than Ethereum's model, but it also means the risk hides where almost nobody looks, because there is no single approvals dashboard the way Ethereum users expect one.
Disconnecting a dApp Revokes Nothing
This is the most expensive misconception in Solana wallet security. Hitting disconnect removes a site's ability to request new signatures from you. It does not touch any delegate that site already holds on your token accounts — that authority lives on-chain and persists until you send a separate Revoke transaction.
So the sequence people believe protects them — connect, feel uneasy, disconnect — leaves the actual on-chain permission fully intact. Months later, when a wallet drains, the connection everyone remembers ending was never the thing that mattered.
Token-2022 and Permanent Delegates
Tokens issued under the Token Extensions program can carry capabilities standard SPL tokens don't have — including a permanent delegate, an authority baked into the token itself that can move tokens from any holder's account. Freeze authority extensions work similarly.
These extensions aren't inherently malicious; they exist for legitimate compliance and recovery use cases. But on a meme coin, a permanent delegate is a risk you accept at purchase rather than one you can revoke afterward, because the authority belongs to the token, not to a permission you granted. It's a close cousin of the sell-restriction problem in our honeypot guide.
Auditing Your Wallet Without Connecting It
You can inspect delegates read-only, with zero exposure: open a block explorer such as Solscan or Solana Explorer, paste your wallet address, and look through your token accounts for any showing a delegate address. No connection, no signature, no risk. Do this before touching any tool that asks you to connect.
Removing a delegate requires an on-chain Revoke instruction and costs a small SOL fee. Many wallets now expose this directly on a token's detail screen, and that is the safest path — a feature built into your wallet cannot be impersonated by a lookalike domain.
When Revoking Isn't Enough
A revoke removes delegate authority. It does nothing if the seed phrase or private key itself was exposed — because then the attacker isn't operating through a permission you granted; as far as the network is concerned, they are you. In that case revoking is wasted time: move every remaining asset to a brand-new wallet immediately and abandon the old one permanently.
Worth stating plainly: no legitimate service ever needs your seed phrase. Not a support agent, not a wallet recovery page, not an airdrop claim, not a bot. Any request for it is an attack, without exception.
Bots are worth understanding as their own category here, because what one needs from you varies enormously by type — our guide on Telegram crypto bot safety breaks down which need custody and which need nothing at all.
This is also why DexsAlertBot never asks you to connect a wallet or sign anything. It's an alert system: it reads public on-chain data and sends messages. There is no wallet permission to grant, so there is no wallet permission to compromise. If you prefer to verify tokens the same way, the verification workflow is entirely read-only too, and the rug pull checks require nothing but an explorer.
Wallet hygiene worth repeating monthly
- Check token accounts for active delegates on an explorer — read-only, zero risk
- Revoke through your wallet's built-in feature, never a searched-for site
- Treat disconnecting as unrelated to revoking — because it is
- Keep a separate wallet for new and untrusted tokens
- If a seed phrase was ever exposed, migrate — don't revoke
Frequently Asked Questions
Does disconnecting a dApp revoke its access?
No. Disconnecting only stops that site from requesting new signatures. Any on-chain delegate it already holds on your token accounts stays active until you send a separate Revoke transaction.
How is a Solana approval different from an Ethereum approval?
Ethereum uses an allowance table where a contract is approved to spend a token balance. Solana approves a delegate on a specific token account, up to a set amount. The delegate never receives your private key and doesn't control other tokens in your wallet.
How do I check whether my wallet has active delegates?
Open a block explorer such as Solscan or Solana Explorer, enter your wallet address, and review the token accounts list for any entry showing a delegate address. This is read-only and requires no wallet connection.
If my seed phrase was exposed, is revoking enough?
No. A revoke only removes delegate authority. If the seed phrase or private key itself is compromised, the attacker controls the wallet entirely, and the only safe action is moving remaining assets to a completely new wallet.
Alerts that never touch your wallet
DexsAlertBot reads public on-chain data and sends alerts on Telegram — no wallet connection, no signatures, nothing to revoke.
Open DexsAlertBot →⚠️ This article is educational and not financial or security advice. Wallet interfaces and token standards change — verify current details in your own wallet's documentation. Always do your own research (DYOR).