---
title: Health & security
description: A security checkup for your wallets — a health score from six checks, what to fix first, every open spending approval with a link to revoke it, traps in the token contracts you hold, address poisoning, stablecoin pegs, whether you sent money to a flagged address, and spam tokens.
---

**Health & security** checks whether your wallet is safe to keep using. It looks for the things that actually cause losses in self-custody: apps that can still spend your tokens, tokens with traps in their code, fake addresses planted in your history, stablecoins losing their dollar, and payments to flagged addresses.

It does not look at market risk or how spread out you are — those are in [Risk & returns](/docs/wallet-risk) and [Diversification](/docs/wallet-diversification).

The checkup runs on its own. While parts of it are still being checked, the header says **Still checking · updates on its own**, and the page fills in without you reloading. When it is done it says when it was last checked.

## The five figures

| Figure | What it tells you |
| --- | --- |
| Health score | A mark from 0 to 100 with its assessment: **Good shape** (90+), **Minor issues** (70–89), **Needs attention** (50–69), **At risk** (under 50) |
| Exposed by approvals | How much apps you approved could take out of this wallet today without asking you again, and what share of your holdings that is |
| Open approvals | How many permissions are still active, how many of them are **unlimited**, and how many are on tokens you currently hold |
| Flagged tokens | How many tokens you hold have traps or dangerous owner powers in their code, and their value |
| Look-alike addresses | Addresses made to look like yours or ones you use, and how many fake or empty transfers they sent you |

**Exposed by approvals** is the most important number on the page. It is money that could leave your wallet without a new signature from you.

## Checkup

A ring with six checks, each marked **OK**, **Review** or **Fix**. Grey means the check does not apply to this wallet.

| Check | What it looks at | Weight in the score |
| --- | --- | --- |
| Spending approvals | Apps that can still move your tokens | 30 |
| Token contracts | Traps and owner powers in the tokens you hold | 25 |
| Who you sent to | Whether recent recipients are on phishing, theft, sanctions or mixer lists | 15 |
| Address poisoning | Fake look-alike addresses in your history | 10 |
| Stablecoin pegs | Whether your dollar stablecoins are worth a dollar | 10 |
| Spam & fake tokens | Tokens sent to you that you did not ask for | 10 |

OK counts in full, Review counts half, Fix counts nothing.

## What to fix first

A list of actions, most serious first. For example:

- *Revoke USDT approval to …* — an app that is risky or unknown can still spend a token you hold
- *Limit or revoke …* — an unlimited approval you probably do not need any more
- *You sent funds to a look-alike of …* — a payment that may have gone to a fake address
- *… is off its dollar* — a stablecoin you hold has lost its peg
- *…: can be bought but not sold* — a token you hold is a trap
- *Ignore N fake tokens* — spam in your wallet

Actions on approvals have a **Revoke** button. It opens Revoke.cash on the right network, where you review the approval and cancel it by signing with your own wallet. Siade Whales never asks for your keys; you cancel approvals yourself, with the wallet that granted them.

Revoking an approval costs a small network fee.

## Spending approvals

When you use an app — a swap, a marketplace, a staking site — you give it permission to move a token for you. That permission stays open until you cancel it, even years later and even if the app is abandoned or hacked. This table lists every one that is still open.

| Column | What it shows |
| --- | --- |
| Token | The token the app can move, and how much of it you hold. Marked **unlisted** if it has no market price |
| Network | Where the approval is |
| Who can spend | The app's name, or its address, with a rating: **Known**, **Unknown**, **Caution**, **Risky** or **Your wallet**. Hover over a warning to see why |
| Allowance | How much it can move: an amount, **Unlimited**, or **All** for an NFT collection |
| Exposed | What it could take today: your balance on that network, up to the allowance |
| Set | When you gave the permission |
| | **Revoke ↗** — opens Revoke.cash to cancel it |

Three types appear:

- **Token approvals** — the most common
- **Permit2** — approvals through Uniswap's Permit2 contract, with their expiry date
- **NFT collections** — permission to move every NFT you hold in a collection

**Unknown** means there is no name for that contract, not that it is malicious. **Risky** means it has been reported, is on a suspicious list, or is a plain wallet rather than an app — which is a common pattern in scams.

Filters above the table: **All**, **On tokens you hold**, **Unlimited**, and **Risky or unclear spender**.

**How to use it:** start with **Risky or unclear spender**, then **Unlimited** on tokens you hold. Revoke anything you do not use any more. An approval to an app you used once two years ago has no benefit and a real risk.

## Token contracts

What the code of each token you hold allows its owner to do.

**Serious** — you may lose money:

- *Can be bought but not sold* — a honeypot
- *Can't be sold all at once*
- *Flagged as an airdrop scam*
- *Imitates another token*
- *Sell tax* of 50% or more

**Caution** — the owner keeps power over your tokens:

- *Sell tax* or *Buy tax* of 10% or more
- *Owner can change balances*
- *Owner can change the tax*
- *Owner can mint more*
- *Has a hidden owner*
- *Ownership can be taken back*
- *Contract can self-destruct*
- *Code isn't public*
- *Top 10 wallets hold* a large share of the supply

**Note** — normal for large, regulated tokens:

- *Issuer can freeze addresses*, *Transfers can be paused*, *Code can be upgraded*, *Trading cooldown*

Tokens such as USDC can freeze addresses by design; that is how they are built, not a trap. They are listed under **Normal issuer powers** rather than flagged. Tokens with nothing found are listed under **No flags**. Each token also shows which exchanges list it and how many holders it has.

## Address poisoning

A common scam: someone creates an address with the same first and last characters as yours, or as an address you pay often, and sends you an empty or tiny transfer from it. The fake then appears in your history, and the next time you copy an address from there, you may copy theirs.

For each look-alike found, the page shows the **Real** address and the **Fake** one with the matching characters highlighted, whether it imitates your own wallet or one you pay, and how many times it has sent you something.

If you ever sent funds to one of them, a warning at the top says so, with the amount and date.

**How to protect yourself:** never copy an address from your transaction history. Check the whole address, not just the start and the end, or use a saved contact.

## Stablecoin pegs

For each dollar stablecoin you hold: its price now, how far that is from $1, and the furthest it went in the last 30 days. Stablecoins bridged from another network are marked **bridged**.

More than 0.5% off, or a 3% swing, deserves a look; 2% off is a warning. A stablecoin that loses its peg can keep falling.

## Who you sent to

The most recent addresses you sent money to, checked against phishing, theft, sanctions and mixer lists. Exchanges and well-known apps are skipped. Each recipient shows how many times you sent to it, when you last did, and whether it is **Clean** or **Flagged**.

If one is flagged, it appears at the top with the reason.

## Spam & fake tokens

Tokens that arrived without you asking and have no real market, counted by network, and the ones pretending to be real tokens — *not the real USDT*, for example.

They are kept out of your totals. **Do not sell, swap or approve them.** Receiving them is harmless; the trap is the website they lead you to, where you are asked to sign something.

## Networks checked

For each network your wallet has used: whether its approvals and its transfers were checked. A few networks do not offer approvals to check; they are marked **not available**.

## Notes about the data

Very busy wallets can have more approvals than are checked at once, and Bitcoin and Solana wallets have no token approvals at all. When anything like that applies, it is said in a **notes about this data** button.

## Related

The score and the main figures also appear in the **Security checkup** card of the [Overview](/docs/wallet-overview#security-checkup). For what an approval is and why it matters, see [Holding your own keys](/docs/self-custody).