Limit Break Payment Processor V2: 23,000 NFTs Exposed via Legacy Approval Exploit

Stale ERC-721 approval grants to a deprecated Limit Break contract allowed an attacker to execute zero-price NFT transfers on September 25, 2026, putting $5.7M in NFTs at risk before whitehats rescued all 23,155 tokens.

Root Cause

Limit Break's Payment Processor V2 handled NFT order settlement for Magic Eden's EVM marketplace. Wallets that listed NFTs on the Magic Eden EVM storefront between February and October 2024 granted standing ERC-721 approve or setApprovalForAll grants to the Payment Processor V2 contract. When Magic Eden migrated away from this processor in October 2024 and shut its EVM marketplace in early 2026, it did not prompt users to revoke those approvals.

The contract vulnerability: fillOrder validated the seller's original listing signature but contained no floor on the sale price. An attacker could call fillOrder with order.price = 0, pass the signature check (the listing was genuinely signed in 2024), and receive the NFT while paying the seller nothing.

// Simplified illustrative vulnerable pattern in PaymentProcessorV2:
function fillOrder(
    Order calldata order,
    bytes calldata sellerSignature
) external payable {
    _validateSignature(order, sellerSignature); // valid — signed legitimately in 2024
    // BUG: no require(order.price > 0)
    IERC721(order.tokenContract).safeTransferFrom(
        order.seller, msg.sender, order.tokenId
    );
    // msg.value == 0; seller receives nothing
}

Because the 2024 listing signature remained valid and the contract lacked a non-zero price guard, ~23,000 NFTs across Ethereum, Polygon, and Base were vulnerable to theft.

Attack Steps

Step	Action
1	On-chain scan identifies wallets with active `approve`/`setApprovalForAll` grants to Payment Processor V2
2	Attacker targets NFT with a historic valid listing signature from Magic Eden's 2024 marketplace
3	Calls `fillOrder` with `price = 0` ETH — signature check passes, price check absent
4	Contract transfers NFT to attacker; seller receives 0 ETH
5	September 25, 2026: attack begins; whitehat security researchers (and RevokeCash) detect the pattern
6	Whitehats front-run remaining vulnerable NFTs, rescuing 23,155 tokens worth ~$5.7M (Meebits, Otherdeeds, others)
7	September 26, 2026: RevokeCash issues advisory; users told to revoke approvals on revoke.cash

Impact

At risk: 23,155 NFTs across Ethereum, Polygon, and Base; estimated value ~$5.7M (includes Meebits, Otherdeeds)
Actually stolen: small quantity before whitehat intervention; majority of at-risk NFTs rescued
Chain: Ethereum, Polygon, Base (ERC-721)
Date: 2026-09-25 (attack) / 2026-09-26 (advisory)
No confirmed permanent loss for users whose NFTs were in the rescued set.
Limit Break and Magic Eden opened a claims process for users to reclaim their rescued NFTs.

Lessons for Auditors

Protocol sunset must include approval revocation campaigns: Decommissioning a contract without notifying users to revoke approval grants leaves an indefinitely open attack surface. Document revocation steps in all deprecation announcements.
Historic signatures must not serve as living consent: Payment processors should include per-order nonces, expiry timestamps, or an on-chain cancellation mapping so that old listings cannot be replayed as zero-price theft vectors.
Floor the payment amount explicitly: Any settlement function should require(msg.value >= order.price && order.price > 0) — never assume callers will pass a non-zero price.
Approvals are permanent until revoked: ERC-721 approve and setApprovalForAll grants have no built-in expiry. Protocols holding large approval grants need real-time monitoring for anomalous zero-price fill activity.
Add emergency revocation UI to all marketplace front-ends: A one-click revoke for the protocol's own contracts dramatically reduces blast radius when a deprecated contract becomes exploitable.