Limit Break Payment Processor

A vulnerability in Limit Break’s Payment Processor allowed an attacker to abuse users’ existing token and NFT approvals to transfer assets without a legitimate marketplace purchase. Payment Processor V2 on Ethereum was exploited first, and V3 contained the same vulnerability.

Limit Break paused V3 where possible, while whitehats transferred vulnerable NFTs to safe custody because V2 could not be paused and ApeChain V3 could not immediately be paused. The same underlying approval flaw could be used in reverse against WETH approvals, resulting in 660 WETH being stolen along with other tokens before whitehats could secure it.