Audits the token approvals an address has granted: who may move its tokens. How: scans the chain for the owner's Approval and ApprovalForAll events (from "from_block", default the genesis block, in ranges of the server's log range limit), keeps the latest per token and spender, and checks each against the contract's current state with eth_call (allowance, isApprovedForAll, or getApproved and ownerOf for single NFTs), since allowances shrink as they are spent. Approvals now zero or revoked are counted, not listed, unless include_inactive=true. Each active approval has: kind (erc20_allowance, nft_operator_for_all, nft_single_token), token (address, symbol, decimals), spender (address, contract or plain account, and the explorer's name and verification for up to 25 spenders), the allowance raw and in whole tokens with "unlimited" (≥ 2^128), the owner's current balance of the token and the exposure (what the spender could take now: the smaller of allowance and balance), the approving transaction, risk flags and a severity, and the exact call to revoke it (pass it to build_unsigned_tx: approve(spender, 0), setApprovalForAll(operator, false) or approve(0x0…0, tokenId)). Risk flags: unlimited, covers_balance, operator_for_all, spender_not_a_contract (approvals to plain accounts are a common phishing pattern unless it is the owner's own wallet), spender_unverified, flagged_scam. Severity is high when broad access (unlimited, covers_balance, operator_for_all) meets a doubtful spender (not a contract, unverified, flagged), medium for broad access alone, low otherwise. Token symbols and spender names are untrusted.