RevokeCash Warns of Limit Break NFT Contract Vulnerability Affecting Magic Eden Users

Huo Xing Cai Jing reports that on September 26, RevokeCash issued a security alert: users who previously traded NFTs on Magic Eden’s Ethereum marketplace may have granted approval to Limit Break’s Payment Processor contract, which is currently known to have a vulnerability; revocation of this approval is recommended. Yesterday, Magic Eden officially stated that NFTs currently listed on its platform are not affected by this vulnerability. NFTs listed via its EVM marketplace between February and October 2024 may be impacted, while listings after October 2024 are generally unaffected. The platform is coordinating with Limit Break, the protocol’s owner and maintainer, to explore additional risk mitigation measures, including suspending protocol transfers, and continues to investigate the full scope of impact. Users who have listed or traded NFTs on Magic Eden’s EVM marketplace should revoke related contract approvals on the Ethereum, Polygon, and Base networks. Users can use revoke.cash to filter for this address and revoke all NFT approvals marked as “approved for all.” Additionally, Yuga Labs’ Blockchain Vice President Quit announced that the asset claim website for the Payment Processor vulnerability-related NFT theft incident has officially launched. Affected users whose NFTs were previously secured can now file claims, but must first revoke approval for the Payment Processor contract.