Tru-Media Podcast, Content creator. AI. Ad Infernum. ‘Recharge on Solar’ Be Safe, Be Well, Be You!
Neptune
- Tweets 13,445
- Following 2,023
- Followers 2,255
- Likes 13,156
Pinned Tweet
Do all the good you can,
By all the means you can,
In all the ways you can,
In all the places you can,
At all the times you can,
To all the people you can,
As long as ever you can."
J. Wesley
25
23
136
7,832
Magic Eden stopped using a settlement contract in 2024. The approvals stayed live, and they got drained this week.
This should have been fixed years ago, across the whole industry. It wasn’t. So fix it now, before it’s your users.
Scope approvals to the order. Put time limits on them where possible. Make every settlement contract pausable. When you retire one, announce it loudly and make sure users aren’t left exposed to it.
“Revoke your approvals” isn’t a security model.
It’s what you say after you’ve already fucked up.
@opensea
a short update on the limit break / magic eden incident response
as a reminder, no @opensea systems or contracts are affected
> known-impacted ERC721 NFTs have been flagged on OpenSea & cannot be sold
> newly exploited NFTs are automatically flagged (limiting exploiter access to offers)
> users with open approvals will see a banner on opensea.io with links to revoke on @RevokeCash
we’re continuing to do all we can to help limit the impact of the industry incident on as many users as possible
thanks to @0xQuit & @RevokeCash for their work & support on this
2
4
6
130
A market built on resolution criteria should read the fine print.
It's SEC staff guidance with no legal force, and LSTs are "digital tools" by default. Only protocol-based liquid staking tokens may be classified as digital commodities.
sec.gov/about/divisions-offi…
36
I scored 60 on the AI purity test.
aipuritytest.org
@ShortyTalls100
@DCBK2LA
@KcMagination
@sapere_vin33159
@AiArsenals
@amoonbeamsstar
@edizkan_
@funnyquant
1
66
If you are a collection owner of an ERC721C or ERC1155C collection, chances are your holders will be unable to claim from the rescue site.
You can either:
- set 7702 delegate OTC enabled in your transfer validator settings or
- allowlist 0xa5F629Daf7F21364ED39f84bD730FF6571227648 (eth) or 0xcec36a4a219749c79c82778dcef87a665750c69c (apechain) as a 7702 delegate on your list
Currently blocked collections here (Yuga controlled collections will be fixed tomorrow):
some notes:
- some collections impose transfer validator enforcements that prevent claims at the moment. I will work with collection owners to enable those over the next few days.
- the claim interacts with a 7702 delegated wallet, which seems to fuck up simulation and can even throw a scary warning (at least in Rabby).
- If you have any issues with the site, fuck you I'm going to sleep (I'll work on it more in the morning)
21
25
153
16,890
What a joke. “No, it’s his fault, blame them, not me.”
You are responsible for the infrastructure you choose to put in front of your users.
Magic Eden integrated this contract, users approved it through your marketplace, and those approvals were left live long after you abandoned EVM.
You were happy to extract value from NFTs when the market was booming. You don’t get to walk away from the security responsibility when things go wrong.
Own your part in this.
1
3
151
Let’s keep passing the buck. This should have been done a long time ago
Thanks Chris. Just a build on what you're saying -
Magic Eden was not exploited, it was Limitbreak's smart contracts that were exploited and we stopped using those contracts 2 years ago.
We're contacting LB to see what else they can do to mitigate the damage incl progress on pausing the transfers.
Agree with your recommendation for folks to revoke approvals on ME though - more details here
nitter.net/MagicEden/status/21034…
77
Quick clarification: today’s exploit was not @MagicEden. It was @limitbreak’s trading protocol / smart contracts. ME stopped using that protocol in 2024.
We’re in contact with Limit Break about further mitigations, including pausing transfers at the protocol level. For now, the best step is to revoke approvals on the contract.
A huge thank you to @0xQuit. The whitehat rescue saved a bad situation from turning worse. We’ll share more once we have it.
nitter.net/MagicEden/status/21034…
1
1
95
MetaBeast retweeted
Beasts it's gonna be alright.
revoke.cash for now revoke all nft access and tell everyone you know who holds/held beasts to do the same even if they've already been compromised perform this action.
13
52
122
4,201
MetaBeast retweeted
If during or after a huge exploit like today’s; your founder/dev doesn’t reach out, communicate, or step up to help the community. That means you’re in the wrong community & u bought the wrong NFT, because Real communities show up when it matters most. 💯
AK
CB
Goodnight! 🌙
6
3
24
293
Your suggested change is better. I also verified the key facts: reporting confirms V3 was paused while V2 could not be, and the exploit also exposed WETH approvals.
The lesson from the Magic Eden / Limit Break exploit should not simply be “remember to revoke your approvals.”
It should be: stop designing systems that leave dangerous approvals sitting around long after they’re needed.
Magic Eden stopped using Limit Break’s Payment Processor V2 in October 2024, yet old NFT and WETH approvals remained active. When the vulnerability was discovered, V3 could be paused. V2 could not, leaving a whitehat rescue and user revocations as the primary defenses. (The Block)
ERC-721 approvals do not expire automatically today, which makes marketplace design even more important. Use narrower permissions where possible, order-specific signatures and time limits where supported, and make critical settlement contracts pausable and safely retireable.
Right now, if you used Magic Eden’s affected EVM marketplace, revoke the vulnerable approvals.
But manual revocation should be the emergency exit, not routine wallet maintenance.
The goal should be simple: permissions should last only as long, and reach only as far, as the transaction actually requires.
This makes the distinction you were after much clearer: revoke now because the system failed, but design future systems so routine revoking is largely unnecessary.
we're aware of a security incident affecting Magic Eden & Limit Break
the team is working to make sure that these items are not able to be re-sold on @opensea
so far over 3,000 items have been marked as stolen & prevented trading
@RevokeCash have an exploit checker live here to see if you've approved your assets for ME here:
revoke.cash/exploits/magic-e…
note: all approvals to OpenSea are safe
2
1
5
406
Your suggested change is better. I also verified the key facts: reporting confirms V3 was paused while V2 could not be, and the exploit also exposed WETH approvals.
The lesson from the @MagicEden Eden / Limit Break exploit should not simply be “remember to revoke your approvals.”
It should be: stop designing systems that leave dangerous approvals sitting around long after they’re needed.
Magic Eden stopped using Limit Break’s Payment Processor V2 in October 2024, yet old NFT and WETH approvals remained active. When the vulnerability was discovered, V3 could be paused. V2 could not, leaving a whitehat rescue and user revocations as the primary defenses. (The Block)
ERC-721 approvals do not expire automatically today, which makes marketplace design even more important. Use narrower permissions where possible, order-specific signatures and time limits where supported, and make critical settlement contracts pausable and safely retireable.
Right now, if you used Magic Eden’s affected EVM marketplace, revoke the vulnerable approvals.
But manual revocation should be the emergency exit, not routine wallet maintenance.
The goal should be simple: permissions should last only as long, and reach only as far, as the transaction actually requires.
This makes the distinction you were after much clearer: revoke now because the system failed, but design future systems so routine revoking is largely unnecessary.
@opensea
@DCBK2LA
@Rafsby
1
1
4
317
People are extremely lucky if this person snagged your NFTs first. This raises a question though, WHY IS IT WE STILL HAVE TO REVOKE? IS THERE NO BETTER WAY?
I don’t know the ins and outs, but couldn’t a platform deny any NFT smart contracts that leave a wallet open to this kind of thing to happen and having to be revoked why are they not automatically revoked?
The bulk of the damage is done, but there are still assets that are vulnerable to the exploit. I'm doing what I can to sweep what's left but hundreds of scammers are also doing the same.
Whether you're affected or not, if you have open approvals to the addresses below, please revoke them. The open approvals can and will be used against you if affected assets are returned to your wallet while they're still open.
2
7
351