- ME-25Negative
The Sandbox (@TheSandboxGame)
Security Notice: Magic Eden / Payment Processor V2 Exploit A vulnerability in Payment Processor V2, an old trading contract built by Limit Break and used by Magic Eden in 2024, is being exploited to take NFTs from wallets that previously listed assets on Magic Eden. The Sandbox's smart contracts are safe and have not been compromised. The exploit abuses old approvals that wallets gave to Payment Processor V2 when listing on Magic Eden. Magic Eden stopped using the contract, but those approvals stay active on-chain until you revoke them. What we know so far: 37 LAND were taken on Ethereum 1,027 ASSETS were taken from 47 wallets on Polygon Some of the assets taken may be held by whitehat rescuers. We are working to identify where they went and will share updates. If you have ever listed LAND or ASSETS on Magic Eden, please take action now: 1. Check your wallet Use Revoke Cash's Magic Eden exploit checker to see whether your wallet is affected: http://revoke.cash/exploits/magic-eden 2. Revoke the old Magic Eden approval Revoke every approval to Payment Processor V2 on both Ethereum and Polygon, for LAND, ASSETS and WETH. Payment Processor V2 contract address (same on all chains): 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834 The Sandbox contracts to check: LAND (Ethereum): 0x5CC5B05a8A13E3fBDB0BB9FcCd98D38e50F90c38 LAND (Polygon): 0x9d305a42A3975Ee4c1C57555BeD5919889DCE63F ASSETS (Polygon): 0xDbc52cd5b8EdA1A7BCBABb838ca927d23E3673e5 Can't revoke right away? Move your LAND and ASSETS to a new wallet that has never approved Magic Eden. 3. If your assets were taken Independent whitehats rescued thousands of NFTs during the exploit and are returning them to owners who revoke the approval. Check http://revoke.cash/exploits/magic-eden for official recovery information. Canceling your old Magic Eden listings does NOT protect you. Only revoking the approval does. Stay vigilant Scammers are already using this exploit as bait. Be especially cautious of unfamiliar accounts, links and DMs offering to "recover" your assets. The Sandbox will never ask for your seed phrase, a payment or a signature to protect or return your assets. As a general security practice, this is a good time to review your wallet permissions and revoke approvals you no longer need. Stay safe everyone 🙏