your seed phrase can be safe while old wallet permissions quietly stay live

Most wallet security checklists start with where the seed phrase is stored. That matters, but a clean backup does not show who or what can still move funds.

A useful permission audit should ask which token allowances remain unlimited, which WalletConnect sessions are active, which exchange API keys can trade or withdraw, which smart accounts still have delegates, which multisig signers remain valid, and which old devices can approve a transaction.

Permissions age silently. A protocol you trusted two years ago may have changed contracts, ownership or maintenance status. Nothing needs to happen today for that forgotten approval to become tomorrow’s attack surface.

Wallets should provide one revocation screen ordered by potential loss. An unlimited approval with no active deposit is more useful to see than a contract address and creation date.

Once or twice a year, I would rather spend twenty minutes revoking old access and reauthorizing the few apps I still use than assume inactivity means safety.

What is the oldest wallet permission you have found still active after you thought you were finished with the app?