X-Crypto-profit

Tag: DeFi Safety

  • P2P Crypto Trading Safety: The Complete 2026 Guide

    P2P Crypto Trading Safety: The Complete 2026 Guide

    Peer-to-peer (P2P) crypto trading is the lifeblood of retail trading and financial access in regions with restrictive banking policies. For users in Nigeria, the West African diaspora, and emerging markets, platforms like Binance P2P, Paxful, and local telegram escrows are essential channels for converting fiat currency to digital stablecoins like USDT. However, this direct interaction between buyers and sellers is highly targeted by financial criminals.

    If you trade peer-to-peer, you are exposed to risks beyond typical blockchain hacks: bank account freezes, fraudulent chargebacks, and identity theft. In this comprehensive guide, we will cover the most critical safety practices for p2p crypto trading safety in 2026, helping you vet counterparties and protect your funds.

    The Anatomy of P2P Fraud: How Traders Get Scammed

    P2P scams do not target smart contracts; they target human trust and traditional banking vulnerabilities. Here are the three most common exploits:

    1. The Chargeback Scam

    The buyer transfers fiat currency to your bank account using a stolen debit card, a hacked bank profile, or a payment system that allows reversals (like PayPal). Once you receive the bank alert, you release the crypto. Days later, the legitimate owner of the bank account reports the fraud, and the bank reverses the transfer or freezes your account, leaving you with no fiat and no crypto.

    2. Fake Proof-of-Payment (SMS/Email Spoofing)

    The buyer marks the trade as paid and sends a screenshot of a fake transfer receipt or triggers a spoofed SMS alert that looks like it came from your bank. If you release the crypto based solely on the screenshot without logging into your banking application to verify the settled balance, you will lose your assets.

    3. Third-Party Payment Fraud (Triangular Scams)

    The scammer creates a fake advertisement selling an item (like a laptop) on a local marketplace. When a real buyer contacts them, the scammer opens a buy order on a P2P crypto exchange for the equivalent amount. The scammer instructs the laptop buyer to send payment to the crypto seller’s bank account. Once the bank transfer is made, the crypto seller releases the crypto to the scammer. The laptop buyer receives nothing, reports fraud, and the crypto seller’s bank account is blocked as an accessory to fraud.

    The P2P Safety Protocol: How to Trade Securely

    To avoid P2P scams and protect your bank account from freezes, you must enforce a strict operating protocol:

    1. Verify settled bank balances directly: Never release crypto based on screenshots, SMS alerts, or emails. Always log into your official banking app and confirm that the funds have settled into your available balance.
    2. Match account names exactly: The name on the buyer’s bank account must match their verified name on the P2P platform exactly. If a buyer says: “I am paying from my wife’s bank account,” reject the trade immediately. Third-party payments are the primary cause of bank blocks.
    3. Keep all communications on-platform: Never agree to chat on WhatsApp, Telegram, or Discord. If a dispute occurs, the P2P platform’s moderators will only accept chat logs that occurred within the official platform interface.
    4. Use a dedicated bank account: Maintain a separate bank account solely for P2P transactions. Do not link this account to your main savings, utility bills, or primary salary accounts. If the account is temporarily frozen for investigation, your primary financial life will not be disrupted.

    Advanced Safeguards: Nigerian Naira Trade Shields with XTSG

    Standard P2P platform moderators are often slow and lack local context when handling disputes in specific corridors like the Nigerian Naira (NGN). This is why active P2P traders utilize the XTSG P2P Trading Hub.

    The XTSG P2P Trading Hub provides specialized tools for high-volume traders:

    • Naira Trade Shields: A registry of verified P2P merchants who have deposited security bonds with XTSG, providing a secondary layer of insurance against chargeback fraud.
    • Compliance Blueprints: Download legal frameworks and bank dispute response templates to resolve account freezes and clarify transaction legitimacy with local banks.
    • Scam Alert Feed: Stay updated on active P2P scam groups, blacklisted bank accounts, and spoofing techniques targeting local payment networks.

    Trading peer-to-peer is a powerful tool for financial freedom, but it requires strict compliance. Set up your safety gates, vet bank accounts on the XTSG registry, and trade securely.

  • What Is a Reentrancy Attack in DeFi? Full Guide

    What Is a Reentrancy Attack in DeFi? Full Guide

    In the history of blockchain exploits, one vulnerability stands out as the most historically significant and economically damaging: the reentrancy attack. It was the exact vector used in 2016 to drain 3.6 million Ether from The DAO, forcing the Ethereum network to execute a controversial hard fork that split the chain into Ethereum (ETH) and Ethereum Classic (ETC). Even in 2026, reentrancy remains a common vulnerability in new Solidity smart contracts.

    For DeFi users and Web3 developers, understanding this vector is crucial. In this guide, we will break down what a reentrancy attack defi vector is, explain its mechanics using a simple code-free analogy, review real-world hacks, and explain how you can protect your assets before interacting with protocols.

    The Code-Free Analogy: The Bank Teller Loop

    To understand reentrancy mechanically, imagine you walk into a traditional physical bank to withdraw $100 from your account, which has a balance of $100. The withdrawal protocol should look like this:

    1. You request the withdrawal.
    2. The teller checks your balance ($100).
    3. The teller gives you the cash ($100).
    4. The teller updates your balance ledger to $0.

    Now, imagine a flaw in the teller’s instructions: they give you the cash first, and only update the ledger afterwards.

    An attacker exploits this flaw by using a trick:

    • The attacker requests a withdrawal of $100.
    • The teller verifies the balance ($100) and hands the attacker the cash.
    • Before the teller can reach for the pen to update the ledger, the attacker immediately calls out: “Wait, I want to withdraw another $100!”
    • Because the teller has not updated the ledger yet, the book still says the attacker has $100. The teller checks the book, sees $100, hands over another $100 cash, and is interrupted again.
    • This loop repeats recursively until the bank’s vault is entirely empty.

    In smart contracts, this is called reentrancy. The external contract (the attacker) interrupts the execution flow of the victim contract (the bank) by recursively calling the withdraw function before the victim contract can update its internal state balance ledger.

    The Solidity Mechanics: Withdraw-Before-Update

    In Solidity (Ethereum’s primary programming language), this exploit is caused by violating the Checks-Effects-Interactions pattern. A vulnerable contract function looks like this:

    
// VULNERABLE CODE EXAMPLE
function withdraw() public {
    uint256 bal = userBalances[msg.sender];
    require(bal > 0);
    
    // Interaction: sending ether to msg.sender triggers fallback
    (bool success, ) = msg.sender.call{value: bal}("");
    require(success);
    
    // Effect: updating the balance occurs AFTER the interaction!
    userBalances[msg.sender] = 0;
}

    An attacking contract implements a fallback function. When the victim contract calls msg.sender.call, execution transfers to the attacker’s fallback function, which calls withdraw() again. Because userBalances[msg.sender] has not been set to 0 yet, the transaction checks pass, and more ether is sent. The loop only terminates when gas runs out or the victim contract is empty.

    How Users Can Audit and Protect Against Reentrancy Risk

    While reentrancy is a developer-level coding error, DeFi users bear 100% of the financial risk. You can protect your capital by checking these key details:

    1. Audit for Reentrancy Guards

    Secure protocols utilize OpenZeppelin’s standard ReentrancyGuard contract libraries. This adds a modifier called nonReentrant to functions. This modifier acts as a lock: it prevents a function from being entered recursively. Before depositing funds, verify if the protocol’s audit reports specifically state: “Reentrancy guards are correctly implemented on all public deposit/withdrawal interfaces.”

    2. Avoid Insecure Forks

    Many DeFi exploits happen to “forks”—new platforms that copy the code of established protocols like Uniswap or Compound but make minor changes or deploy on new chains. Developers copying code often forget to implement matching security modifiers, leaving the new protocol open to reentrancy exploits.

    Monitoring DeFi Threats with XTSG

    Because smart contract exploits happen in real-time, manual code auditing is not enough for active DeFi traders. You need live telemetry.

    The XTSG On-Chain Risk Dashboard is designed to provide this warning system:

    • Active Exploit Detection: The dashboard monitors public mempools (where transactions wait to be processed) for abnormal recursive function calls or flash loan patterns. If a reentrancy attack begins on a protocol you are using, the system alerts you immediately.
    • Contract Safety Scores: Search any protocol address on XTSG to get a comprehensive safety report, highlighting whether reentrancy guards are present and detailing their multi-signature threshold status.

    Before you deposit funds into any pool, verify the contract safety on XTSG. Keep your long-term capital isolated, audit audit reports, and stay ahead of on-chain exploits.

  • Smart Contract Exploit Prevention: A DeFi User’s Guide

    Smart Contract Exploit Prevention: A DeFi User’s Guide

    Decentralized Finance (DeFi) has unlocked unprecedented financial utility, allowing users to lend, borrow, and trade assets without middlemen. But this open, composable structure carries a massive threat surface. Unlike traditional banks where funds are secured by legal insurance and server firewalls, DeFi deposits are secured solely by code. If a protocol’s smart contract contains a logical bug, hackers can drain the entire liquidity pool in seconds.

    For DeFi participants, smart contract exploit prevention is a vital skill. In this guide, we will walk through the most common smart contract exploit vectors—including reentrancy, oracle manipulation, and flash loan attacks—and outline the practical steps you can take to protect your funds before interacting with any decentralized protocol.

    Under the Hood: The Most Common DeFi Exploit Vectors

    Smart contract exploits are not traditional database hacks. The hacker does not guess administrative passwords; they interact with the public functions of the contract in ways the developer did not anticipate. Here are the three primary methods:

    1. Reentrancy Attacks

    A reentrancy attack occurs when a smart contract sends funds to an untrusted external contract before updating its internal state balance. The external contract (controlled by the attacker) executes a fallback function that calls the withdraw function again, recursively draining the contract’s funds before the first transaction can update the balance ledger. The classic DAO hack of 2016 is the most famous example of this vector.

    2. Oracle Manipulation

    Many DeFi lending platforms rely on decentralized oracles to determine the real-time price of assets (such as collateral). If a platform reads the price from a single, low-liquidity pool, an attacker can borrow massive capital, artificially inflate the price of a token in that specific pool, use their inflated tokens as collateral to borrow other valuable assets, and then leave the protocol with bad debt.

    3. Flash Loan Attacks

    Flash loans allow anyone to borrow millions of dollars in crypto without collateral, provided the loan is repaid within the exact same blockchain transaction. Attackers combine flash loans with oracle manipulation or contract balance exploits, acquiring vast capital to force pricing inefficiencies in a single block and walking away with risk-free profit.

    Step-by-Step: How Users Can Prevent Exploit Exposure

    While users cannot rewrite a protocol’s smart contract, they can perform simple security audits to identify high-risk platforms. Before depositing capital, run through this checklist:

    1. Check Audit Records: Never deposit funds into an unaudited protocol. Verify that the contracts have been reviewed by reputable security firms (e.g. CertiK, OpenZeppelin, Trail of Bits). Multiple audits from different firms are a strong indicator of safety.
    2. Review Multi-Signature Governance: Verify who controls the protocol’s upgrade keys. If a single developer wallet can modify the contract code without a multi-signature threshold or a timelock delay, the protocol is highly vulnerable to a rug-pull or single-point-of-failure hack.
    3. Audit Total Value Locked (TVL) vs. Domain Age: Scams and vulnerable forks often buy fake volume. If a protocol has $50 million in TVL but its domain was registered two weeks ago, it is highly likely to be a honey-pot or an insecure copy of another protocol.
    4. Limit Token Approvals: When approving a protocol, never grant unlimited access to your wallet’s entire balance. Only approve the exact amount of tokens you plan to deposit, and revoke the approval using Etherscan or Revoke.cash when you exit.

    Hands-On Sandbox Testing with XTSG

    Analyzing smart contract risk theoretically is important, but practical experience is far more effective. This is why we created the XTSG Smart Contract Threat Simulation Terminal.

    The simulation terminal is a safe, sandboxed environment where users can:

    • Run Exploit Scenarios: Execute simulated reentrancy, oracle manipulation, and flash loan attacks against dummy contracts to see exactly how funds are drained on-chain.
    • Inspect Transaction Payloads: Study what a malicious transaction payload looks like in your wallet interface before you sign it. Learning to spot these variables is the most effective way to prevent signing bad transactions.
    • Verify Contract Code: Test copy-pasted smart contract addresses against XTSG’s automated auditor to parse for logical flaws and owner privileges.

    DeFi offers incredible yield opportunities, but it requires a defensive mindset. Audit every protocol, run test scenarios in the XTSG simulator, and limit your wallet approvals to protect your hard-earned capital.

  • How to Revoke Smart Contract Approvals Safely

    How to Revoke Smart Contract Approvals Safely

    If you have traded on a decentralized exchange, minted an NFT, or deposited tokens into a yield farm, you have signed a transaction approval. In most Web3 interfaces, platforms default to requesting “unlimited approval” to spend your tokens. This is designed to save you gas fees on subsequent trades. However, it also creates a massive security loophole. If that protocol is ever exploited, or if the developers perform an exit-rug, every wallet that has an active allowance can be drained of its tokens, even if they are stored offline.

    To secure your wallet, you must know how to perform a revoke smart contract approval process. In this step-by-step guide, we will explain exactly what smart contract approvals are, why legacy allowances are a silent security threat, and how to verify and revoke them using public blockchain tools.

    What Is a Smart Contract Approval?

    Unlike traditional databases, smart contracts cannot automatically withdraw tokens from your wallet address. To swap tokens on Uniswap or stake funds in a pool, you must first authorize the protocol’s smart contract to interact with your balance. This is done through standard ERC-20 token standards using two main functions:

    1. approve(address spender, uint256 amount): Authorizes a specific contract (spender) to withdraw up to a designated amount of tokens from your wallet.
    2. setApprovalForAll(address operator, bool approved): Used in NFT contracts (ERC-721/1155). This grants the operator permission to transfer all NFTs of that specific collection out of your wallet.

    When you click “Approve” in MetaMask or Rabby, you are writing an immutable record on the blockchain that says: “This contract address is allowed to spend my tokens.”

    Why Legacy Approvals Are a Silent Security Threat

    Many users assume that disconnecting their wallet from a Web3 site revokes approvals. This is incorrect. Disconnecting simply tells the frontend site to stop reading your public address. The approval record remains active on the blockchain ledger forever.

    This creates two major vulnerabilities:

    • Protocol Exploits: If a protocol you used three years ago has a vulnerability in its smart contract code, hackers can exploit that contract to call the transferFrom() function. Since you granted that contract an unlimited allowance, the hacker can drain your tokens directly from your wallet. This is exactly how the Multichain and SushiSwap Router exploits drained millions from offline wallets.
    • Phishing Drainers: Phishing sites are designed to mimic legitimate swap interfaces but display a transaction prompt requesting approval for a malicious contract address. Once you sign the approval, the drainer script instantly transfers your assets.

    Step-by-Step Guide: How to Revoke Approvals

    You can revoke approvals using dedicated revocation portals or block explorer tools. Here is how to clean up your wallet approvals safely.

    Method 1: Revoking via Revoke.cash

    Revoke.cash is the gold-standard interface for allowance auditing. It supports dozens of EVM chains and is highly intuitive.

    1. Navigate to the official Revoke.cash portal.
    2. Connect your hot or cold wallet (MetaMask, Rabby, Ledger).
    3. Audit the list of active approvals. It will show the token, the spender contract, the approved allowance (e.g. “Unlimited” or a specific amount), and the total asset exposure.
    4. Click the “Revoke” button next to any unneeded approval.
    5. Confirm the transaction signature in your wallet. This writes a new blockchain transaction resetting the allowance to 0.

    Method 2: Revoking via Block Explorers (Etherscan Token Approval Checker)

    If you want to avoid third-party interfaces, you can interact directly with Etherscan or other chain explorers.

    1. Go to Etherscan and select More -> Tools -> Token Approvals.
    2. Connect your Web3 wallet.
    3. Inspect the tabs for ERC-20, ERC-721, and ERC-1155.
    4. Click the Revoke button next to the spender address and sign the transaction in your wallet.

    Advanced Defense: Pair Revocation with XTSG Threat Monitoring

    Auditing and revoking approvals is a critical hygiene habit, but it is reactive. If you approve a smart contract that gets hacked five minutes later, manual auditing will be too slow. This is where the XTSG On-Chain Risk Dashboard comes in.

    By connecting your wallet to the XTSG monitoring suite, you establish an automated safeguard:

    • Pre-Sign Verifications: Before you approve any smart contract transaction, check the XTSG dashboard to verify the contract’s safety history and identify if it is a known malicious address.
    • Exploit Alerts: The dashboard monitors your active approvals in real-time. If an active exploit is detected on a smart contract you are approved to, the system will trigger a high-priority alert, prompting you to revoke the approval instantly before the exploit reaches your address.

    Keep your wallet clean and isolated. Use Etherscan or Revoke.cash to scrub your approvals monthly, and monitor active protocols with XTSG to maintain a complete Web3 security posture.

  • Hardware Wallet vs Software Wallet: Which Is Safer in 2026?

    Hardware Wallet vs Software Wallet: Which Is Safer in 2026?

    As cryptocurrency markets scale and Web3 applications integrate deeper into global commerce, the question of asset security has evolved. Storing digital wealth is no longer just about memorizing a password; it requires managing complex cryptographic key infrastructures. For anyone actively trading or holding tokens, the fundamental choice comes down to a battle of architectures: Hardware Wallet vs Software Wallet.

    Each system is built on opposing trade-offs between convenience and vulnerability. In this comprehensive analysis, we will tear down the security frameworks of both cold hardware storage and hot software interfaces, explore the real-world attack vectors targeting each in 2026, and explain why both architectures share a critical vulnerability in the DeFi ecosystem that requires complementary platform-level monitoring.

    1. The Architecture of a Software Wallet (Hot Storage)

    A software wallet (often called a “hot wallet”) is a digital application that resides on an internet-connected device, such as a desktop computer, a smartphone, or a browser extension. Common examples include MetaMask, Rabby, Phantom, and Trust Wallet.

    Cryptographic Storage:

    Unlike traditional bank applications that retrieve balances from a corporate server, a crypto wallet must store your private keys locally to sign on-chain transactions. In a software wallet, your private keys or seed phrase are encrypted using a password you choose and then saved within the device’s local application folder or browser storage partition (such as IndexDB or local storage).

    The Attack Surface of Hot Environments:

    Because the host device (your PC or phone) is connected to the internet, the software wallet is exposed to several critical threat vectors:

    • Memory Extraction Malware: Sophisticated spyware can inspect the memory space (RAM) of your browser or operating system. When you unlock your wallet, the decrypted private key briefly resides in memory, where advanced trojans can dump it and exfiltrate it to remote servers.
    • Clipboard Hijacking: Specialized clipboard drainers monitor your copy-paste history. If you copy a destination address or attempt to back up a seed phrase, the malware instantly swaps the recipient’s address in the clipboard for the attacker’s, tricking you into sending funds to the wrong address.
    • Operating System Zero-Days: If your underlying OS (Windows, macOS, Android) suffers from an unpatched browser exploit or remote code execution vulnerability, an attacker can bypass application sandboxing entirely and read raw application data directory files.

    2. The Architecture of a Hardware Wallet (Cold Storage)

    A hardware wallet (commonly called “cold storage”) is a dedicated physical device engineered solely to manage cryptographic keys. Major models include Ledger, Trezor, Keystone, and GridPlus. The central design principle is simple: your private keys must never touch an internet-connected computer or operating system.

    The Secure Element (SE):

    Premium hardware wallets utilize specialized microchips called Secure Elements (graded EAL5+ or EAL6+), similar to those used in credit cards, passports, and secure military communication modules. These chips are physically designed to resist micro-probing, power-analysis attacks, and physical tampering. Even if you connect the device to a malware-infected computer, the PC can only request a signature; it can never request the private key itself.

    Physical On-Screen Verification:

    The secondary guardrail of a hardware wallet is its independent screen and physical buttons. When a transaction payload is sent to the device, the hardware’s internal firmware parses the raw data and displays the destination address and gas fees on its physical screen. Because this screen is powered directly by the Secure Element and not your PC, it cannot be spoofed by computer-based malware. The transaction is only signed when you physically press the physical buttons on the device.

    The Cold Storage Rule: In cold storage, the signing key is physically isolated. If your computer is fully compromised by a hacker, they can modify the UI of your browser, but they cannot force your hardware wallet to sign a transaction without your physical button confirmation.

    3. Threat Model Comparison: Hardware vs. Software

    To understand the practical trade-offs, we must analyze how each wallet type handles various real-world security scenarios in the table below:

    Threat Vector Software Wallet (Hot) Hardware Wallet (Cold)
    Remote Hacking / Malware High Risk. Keyloggers or memory scrapers can steal keys. Protected. Keys are physically isolated on the Secure Element.
    Physical Theft of Device Medium Risk. Depends on device lock screen strength. Protected. PIN locks and cryptographic wipe limits block access.
    Phishing Web3 Sites High Risk. Easy to sign a malicious contract call. High Risk. User can still manually sign a malicious transaction.
    Cost & Setup Latency Free, instant setup, low signing latency (<1s). Costly ($70-$200+), manual button confirmations required.

    4. The Shared Vulnerability: The DeFi Smart Contract Approval Trap

    There is a critical misconception in the crypto space: “I use a hardware wallet, so my assets are completely safe from hackers.” This is dangerously false in modern DeFi environments.

    Historically, hackers stole crypto by acquiring seed phrases. Today, they leverage Smart Contract Approvals. When you interact with decentralized exchanges (DEXs), lending pools, or NFT marketplaces, the smart contract requests approval to move your tokens. This is standard ERC-20 / ERC-721 functionality (using functions like approve() and setApprovalForAll()).

    How the Trap Works:

    If you visit a phishing site or click a malicious link that spoofs a DeFi protocol, the dApp will generate a transaction request asking for “Unlimited Approval” to spend your USDT or NFTs. If you approve this request—even if you sign it using a physical hardware wallet—you have legally authorized that smart contract address to withdraw tokens from your wallet on-chain at any time in the future.

    Once signed, the attacker does not need your private keys, your hardware wallet, or your computer to empty your balance. They simply call the contract’s transfer function directly from the blockchain node, and the ledger processes it because your signature previously authorized it.

    Defending Against Approval Exploits with XTSG:

    Because hardware isolation cannot protect you from signing a bad transaction approval, you must employ additional layers of defense:

    1. Active Approval Audits: Use the **XTSG Smart Contract Approval Revocation Tool** regularly. This tool inspects your on-chain registry, lists all active spend authorizations, and lets you immediately reset or revoke old allowances.
    2. Real-Time Threat Dashboard: The XTSG threat intelligence dashboard monitors smart contracts for sudden code mutations or blacklisted ownership transfers. If a protocol you are approved to gets exploited, the dashboard alerts you immediately so you can revoke permissions before the drainer scripts execute.

    5. Making Your Decision: Which System to Choose?

    To build an optimal custody strategy, match your wallet setup to your activity profile:

    The Active Trader / DApp User Profile

    If you execute daily swaps, trade memecoins, or mint NFTs, running all interactions through a hardware wallet is cumbersome and slow. Instead, use a **Hybrid Setup**:

    • Maintain a **Hot Software Wallet** containing only your active trading capital. This limits your exposure if you make a mistake on a dApp.
    • Store 90% of your long-term capital in an isolated **Cold Hardware Wallet** that never connects to speculative smart contracts.

    The Long-Term Holder Profile

    If your strategy is strictly buying and holding (HODLing) assets like BTC or ETH, a **Hardware Wallet** is the only logical choice. Keep the device locked, keep your seed phrase backed up on steel sheets, and avoid connecting it to any browser extensions.

    Conclusion: Cold Storage is the Foundation, Security Hygiene is the Shield

    In the Hardware Wallet vs Software Wallet comparison, hardware wallets are undeniably safer for storing keys. However, the ultimate security baseline is your own signing hygiene. A hardware wallet is a lock on your door, but it cannot prevent you from opening the door and handing your assets to an intruder. Combine physical cold storage with active on-chain protection tools like XTSG’s approval revoker, and you will achieve a full-stack, institutional-grade security posture in 2026.

    Frequently Asked Questions (FAQ)

    Can a hardware wallet be hacked if plugged into an infected PC?

    No. The private key never leaves the secure chip. The infected PC can send a transaction request, but the device’s firmware will force you to review the destination address on the physical screen. If the PC malware has modified the address, you will see the mismatch on the device screen and can reject the transaction.

    What happens if I lose my physical hardware wallet?

    Your crypto is not stored on the physical device; it resides on the blockchain ledger. The device is simply a tool to access your keys. If you lose the device, you can purchase a new one (or use a software wallet) and enter your 12-or-24-word backup seed phrase to fully restore all your balances.

    How often should I revoke token approvals?

    It is recommended to run an approval audit using XTSG’s tools at least once a month, or immediately after interacting with a new, unverified DeFi platform. Any unlimited approvals for platforms you no longer use should be revoked immediately.