Old Magic Eden NFT approvals put users at risk after whitehat moves 3,832 NFTs

[Revoked Payment Processor V2 Authorizations Expose Former Magic Eden NFT Users to Financial Risk]

Former Magic Eden NFT users remain vulnerable to potential asset loss following a potential compromise. On September 25, Revoke.cash issued a critical alert regarding a vulnerability discovered in Limit Break’s Payment Processor V2, which impacts wallets that retain authorizations for cross-chain NFT movements. These privileged permissions stay active indefinitely unless explicitly revoked by the owner.

A security researcher, identified only as 0xQuit, leveraged the identified flaw to transfer 3,832 high-value NFTs from previously approved wallets using zero ETH payments. Citing his operation as a proactive recovery measure, he explained the transferred tokens were temporarily parked within a custodial wallet awaiting a secure disposition. While Revoke.cash documented the total volume of transfers, the organization has yet to confirm whether any victimized assets were ultimately extracted.

The underlying technical specifics of the exploit were not disclosed in the initial disclosure, and Revoke.cash acknowledged uncertainty regarding whether malicious entities successfully exploited the vulnerability. Consequently, the confirmed count reflects only the magnitude of transactions observed, leaving the actual number of compromised NFTs undetermined. To mitigate ongoing exposure, users with persistent authorizations should proactively withdraw these permissions.

Source link