Magic Eden : This vulnerability does not affect the current listing, which is due to expire in 2024.

Magic Eden disclosed on September 25 that the vulnerability occurred in Limit Break-maintained Payment Processor V2. The current Magic Eden listings are not affected; February to October 2024 EVM marketplace listing users need to check Ethereum, Polygon and Base contract authorizations and revoke approved for all licenses to reduce historical licensing residual risk.

Why the history window needs to be checked

According to BlockBeats on September 25, Magic Eden explained that the vulnerability occurred in Payment Processor V2, an NFT transaction protocol maintained by Limit Break. Magical Eden adopted this protocol for EVM network transactions settlement in 2024, but stopped using V2 in October 2024 and will completely shut down the EVM market in the first quarter of 2026.

The platform also gives a narrower timeframe: NFTs listed through its EVM marketplace between approximately February and October 2024 may be affected; listings after October 2024 are in principle unaffected. For users, the focus of this event is not whether assets are currently on display at Magic Eden but whether they have left their contract authorization when using the EVM Marketplace in the past.

NFT market transactions in the EVM ecosystem often rely on contracts on a chain to complete ordering, bidding, trading and settlement. In order for a contract to execute operations, users usually need to grant appropriate permissions. If a protocol is vulnerable, risks may be amplified by existing authorization; even if the platform discontinues the protocol after that time, authorizations on the chain still require user-initiated checks.

Approved for all Why it needs to be revoked

Magic Eden reminds that users who have listed or traded NFTs in its EVM marketplace can check the relevant addresses on Ethereum, Polygon and Base networks and revoke all NFT licenses marked as approved for all by sifting through revoke.cash. Such licenses typically allow licensed contracts to transfer multiple types of NFT held by a user within their allowance limits, which is broader than single-asset licensing and therefore better suited to work together as security clearance counterparts.

The platform emphasizes that the revocation of authorization cannot recover assets that have already been transferred. In other words, this step serves to cut off subsequent call paths and reduce the likelihood that historical rights continue to be used, rather than recovering losses that have occurred.

Platform survey and follow-up concerns

Magic Eden said that the platform is in contact with agreement owners and maintainer Limit Break to study risk mitigation measures, including suspending protocol transfers, and continue investigating the actual scope of impacts. Three areas of follow-up are possible: (1) details of the vulnerability in Payment Processor V2 and progress on repairs; (2) whether the addresses, asset types and transaction scope actually affected have been disclosed; (3) whether Magic Eden will provide further clearing guidance on historical EVM market authorizations.

For users who have used the Magic Eden EVM marketplace to list, the most immediate action is to confirm whether they are in the February-October 2024 window and check the authorization status on Ethereum, Polygon, Base. The platform has been shown not to be affected by this vulnerability for users currently still listed on Magic Eden; for listings after October 2024, it is also not in principle within the risk window.