authorization

NVIDIA (NVDA.O) announced an increase in the stock repurchase authorization scale by $150 billion.

Revoke.cash stated that Limit Break's payment processor has a known vulnerability, and users who traded NFTs on the Magic Eden Ethereum marketplace may still retain relevant contract authorizations.The vulnerability has been addressed by white hat security researcher 0xQuit. Currently, NFT assets are expected to be unaffected, but users should still check and revoke affected authorizations to reduce subsequent risks.

Magic Eden announced that the vulnerability occurred in the NFT trading protocol Payment Processor V2 maintained by Limit Break. Magic Eden adopted this protocol for EVM network transaction settlements in 2024 but stopped using V2 in October 2024 and will completely shut down the EVM market in the first quarter of 2026. Therefore, NFTs currently listed on Magic Eden are not affected by this vulnerability.NFTs listed through its EVM market between February and October 2024 may be affected, while listings after October 2024 are generally not impacted. The platform is contacting the protocol owner and maintainer Limit Break to explore other risk mitigation measures, including pausing protocol transfers, and will continue to investigate the actual scope of the impact.Magic Eden reminds users who have listed or traded NFTs on its EVM market to revoke relevant contract authorizations on the Ethereum, Polygon, and Base networks. Users can filter the address through revoke.cash and revoke all authorizations marked as "approved for all" for NFTs. Magic Eden emphasizes that revoking authorization cannot recover assets that have already been transferred.Yuga Labs' Vice President of Blockchain Quit stated today that at 9 AM Eastern Time, attackers exploited the Payment Processor V2 vulnerability to steal a large number of NFTs. After contacting the LimitBreak team, the latter quickly paused the similarly affected Payment Processor V3. However, V2 could not be paused, and V3 on ApeChain is also temporarily unable to be paused. Therefore, the team implemented a white-hat operation, successfully transferring and protecting 23,155 NFTs valued at over 5.7 million dollars.

Binance Wallet announced the launch of real-time detection and risk interception features for high-risk signature scenarios to prevent phishing attacks that exploit the authorization mechanisms of DeFi projects.Binance stated that some attacks only require inducing users to complete offline signatures that do not require gas fees, which could lead to asset theft. In the future, it will continue to expand the scope of risk identification scenarios and security protection coverage.

Taiyuan Chengming Technology Co., Ltd. sent a letter to Beijing Zhipu Huazhang Technology Co., Ltd., raising multiple demands regarding the alleged unauthorized upload of company data assets and trade secrets by its ZCode client, and reserving the right to pursue legal accountability. Chengming Technology pointed out that although Zhipu has publicly apologized for the "silent upload of user local repository data" and claimed to have fixed the issue, independent evidence collection revealed that the upload behavior was automatically triggered and occurred in bulk, including complete archived files such as project source code, system architecture, version control history, database passwords, cloud service credentials, and employee personal information, far exceeding the scope of collection stated in its Privacy Policy.Although the client was updated to version 3.12.3 on September 16, upload behavior was still detected in the early hours of the day Zhipu publicly apologized, raising doubts about the actual effectiveness of the "fix." At the same time, the ZCode client’s network requests pointed to a Singapore entity, while the service agreement was signed with Beijing Zhipu Huazhang, requesting clarification on the responsible party for this upload, as well as whether the data was transmitted abroad or stored overseas.Chengming Technology demanded that Zhipu respond in writing by October 10 and complete the immediate cessation of processing and thorough deletion of all uploaded data and related derivative data, caches, and backups, provide a complete list of processing situations, clarify the data's whereabouts, whether it was shared with third parties, whether it was used for model training, and whether cross-border transmission occurred, explain the management of encryption private keys and complete operation logs, clarify the exact scope of "destruction" mentioned in previous public responses, issue proof of deletion completion, provide a written commitment not to upload without authorization again, legally provide access, copying, and explanation of personal information, and designate formal communication channels, among other matters. Currently, Zhipu has not publicly responded to the aforementioned letter.

According to the FCA official website, the Financial Conduct Authority (FCA) of the United Kingdom has released new guidance on the regulation of crypto assets to help businesses understand the scope and authorization requirements of the future crypto asset regime in the UK. This regime will officially take effect on October 25, 2027, and the application channel for authorization will open on September 30, 2026.The guidance covers activities such as issuing qualified stablecoins, operating crypto asset trading platforms, trading and matching, crypto asset custody, and staking arrangements. FCA Executive Director David Geale stated that this guidance aims to provide clarity for businesses so they can confidently prepare for regulation. The government has also made targeted amendments to relevant laws, introducing certain exemption clauses and further clarifying provisions for specific technology service providers. The FCA will launch a special consultation in October regarding the aforementioned legal changes, involving topics such as qualified stablecoins, proprietary trading and market making, decentralized protocols, and financial promotions.

The European Securities and Markets Authority (ESMA) stated in its latest risk report that major prediction market platforms such as Polymarket and Kalshi have not obtained the necessary authorization to provide event contract services in the EU, and some platforms only restrict users from certain EU countries. ESMA questioned the effectiveness of their geographical restrictions and VPN blocking measures.ESMA pointed out that event contracts may be classified as financial instruments based on their specific structure, fall under the MiCA framework, or be regulated by member states' betting regulations. If classified as financial instruments, their marketing, distribution, and sale to retail investors are generally subject to existing binary options restrictions.

According to GoPlus monitoring, a user lost 97,000 USD worth of SYN tokens to a phishing attack after signing a malicious Permit transaction 922 days ago. The user did not revoke the related authorization, which subsequently led to another theft of 122,000 USD worth of SYN.

According to official news, Circle Gateway has implemented a programmable authorization model by supporting ERC-1271 signatures, allowing smart contracts and smart contract wallets to directly use the Gateway.Developers do not need to set up additional delegated approvers and can access a unified USDC balance system through existing smart contract authorization logic.

GoPlus Security issued a security alert stating that a user signed a malicious Permit transaction 183 days ago, resulting in approximately $1,625 of USDC being transferred by a phishing attacker.Since the user did not revoke the relevant authorization afterwards, the attacker again used that authorization to transfer approximately $75,780 of USDC.

Robinhood Chain's Pons launchpad officially responded to previous reports regarding a token authorization vulnerability in its frontend, stating that the Pons launchpad trading page does not have any Multicall3 functionality. The Multicall3 functionality mentioned in the tweet comes from the previous version of the Debank Chain cross-chain bridge, which was launched before the Pons launchpad and does not affect launchpad users.Currently, the only confirmed affected asset is 0.6 NOXA tokens, valued at approximately $0.66. As a security precaution, Pons recommends that users who have used the old cross-chain bridge revoke token authorization through revoke.cash. The team is currently working with auditing firms to investigate potential risks and stated that they will restore Pons frontend services once it is confirmed that there are no actual vulnerabilities.

According to a community alert released by Blockaid, the old governance proposals (#14 and #15) of BarnBridge Smart Yield have token authorization risks. If maliciously executed or upgraded, they may jeopardize existing token authorizations. It has not yet been confirmed that any funds have been withdrawn, but users are advised to check and revoke relevant authorizations on Ethereum as soon as possible.Proposal #14 is in an executable grace period, while proposal #15 is queued, with an expected on-chain execution time of July 16 at 09:23:58 UTC. The affected tokens include USDC, DAI, USDT, GUSD, and RAI, and the relevant contract addresses have been publicly disclosed. Blockaid reminds users to use trusted authorization management tools, not to trust links in replies or accounts claiming to be "support," and not to send funds or sign transfers to any address, only revoke authorizations through trusted tools.

According to CoinDesk, as the competition for tokenization in the capital markets heats up, the Securities Transfer Association (STA) recently submitted a letter of opinion to the U.S. Securities and Exchange Commission (SEC), warning that stock tokens issued by third-party organizations may undermine market integrity and calling on regulators to prioritize support for tokenized securities authorized by publicly listed companies in future rule-making.The STA represents several Wall Street transfer agents, whose members believe that true tokenized stocks should be formally authorized by the issuing company and recorded in the official shareholder register, rather than created as "packaged" token products by independent platforms.The association pointed out that third-party stock tokens may confuse investors about the actual rights they hold and expose them to risks related to platform credit, custody, and operations, without establishing a direct legal relationship with the publicly listed company. Therefore, any innovative exemptions, pilot projects, or permanent regulatory frameworks for tokenized securities should prioritize the issuer-supported model.The STA also urged the SEC to reform the existing Direct Registration System (DRS), arguing that the current U.S. securities custody system is inadequate to meet the real-time transfer and settlement needs of on-chain securities, and suggested that regulators collaborate with the Depository Trust & Clearing Corporation (DTCC) to optimize the digital securities infrastructure.Currently, the global market for tokenized stocks, valued at approximately $2 billion, is primarily dominated by third-party models, including products launched by Ondo Finance and Kraken, while organizations like Securitize and Figure adopt the issuer authorization model.

According to Scam Sniffer monitoring, a user lost approximately 999,999 USDT after signing a phishing token authorization on Ethereum.The attacker initially attempted to withdraw 1 million dollars (which was 631 dollars more than the wallet balance) but failed. After 36 seconds, they recalculated and successfully withdrew the entire remaining balance. Scam Sniffer reminds users to verify all signature requests and never rush to sign transactions.

According to The Block, Ripple announced that it has obtained a full authorization as a MiCA CASP (Crypto Asset Service Provider) issued by the Luxembourg financial regulator CSSF, allowing it to legally provide crypto asset services in all 30 countries of the European Economic Area.

The Spanish National Securities Market Commission has authorized the cryptocurrency platform Venga to operate under the EU's Markets in Crypto-Assets Regulation (MiCA), making it one of the few entities in Spain to receive MiCA approval. The MiCA transitional period took effect on July 1, and digital asset companies that previously operated under national rules must obtain formal approval under the new regime, or they must cease providing regulated services in the EU.This authorization allows Venga to provide services within the market composed of 27 EU member states based on a single regulatory framework. Michael Stroev, co-founder and CEO of Venga, stated that the MiCA review covers aspects such as ownership structure, corporate governance, management suitability, risk framework, and product infrastructure. Previously, over 3,000 crypto companies in the EU held local virtual asset service provider registrations, but currently, about 240 companies have received full MiCA authorization, with fewer than 15 companies approved in Spain.

According to The Block, Benchmark Equity Research maintains a Buy rating on Strategy and reiterates a target price of $570. This target price still has about a 515% upside compared to Strategy's closing price of $92.68 on Monday.Analyst Mark Palmer stated in the report that the digital credit capital framework launched by Strategy allows it to actively manage both ends of its capital structure based on market conditions, including repurchasing common and preferred stock when needed, selling Bitcoin to meet obligations, and suspending new issuances when the stock price is not at a premium.Palmer believes that this framework marks a shift for Strategy from a past focus on one-way issuance of securities to proactive two-way capital management. He stated, "This is a significant positive for shareholders."The report also noted that this framework addresses market concerns about dilution and enhances flexibility through a structured repurchase plan. Palmer also believes that the authorization to sell up to $1.25 billion worth of Bitcoin is negligible compared to Strategy's reserve of approximately 847,000 BTC.

According to official news, Binance has announced that it has decided to withdraw its MiCA license application submitted in Greece and instead seek authorization in another EU member state. The company stated that this move is based on a prudent assessment of the current approval progress and timeline in Greece, emphasizing that user interests are at the core of the decision.Binance stated that Europe remains an important market for it, and its commitment to operate in compliance with the EU MiCA unified regulatory framework remains unchanged. It expects to obtain the relevant licenses in a new member state within the next few months, but the specific country will be announced "when ready."

The blockchain infrastructure protocol Lava Network has signed a non-binding memorandum with developer BHL Group to design a tokenized regulatory sandbox for the planned residential development project Alba Bay in the Caribbean. The project plans to build over 40,000 residential units, covering nearly 40 million square meters, with a cost of billions of dollars, and is expected to break ground in the first quarter of 2027.Lava claims this is its first real-world asset authorization project. Currently, no units have been tokenized, and no infrastructure has been deployed; BHL is not required to pay any upfront fees to Lava. Lava's role is to support ecological promotion, coordinate the application of crypto-native teams, and participate in the sandbox design, with commercial terms based on usage, no fixed fees, equity, or token grants.According to CoinGecko data, the LAVA token has fallen over 90% from its peak in 2024, with a market capitalization of approximately $9 million. Lava stated that the tokenization structure has not yet been determined, and any tokens will supplement rather than replace existing property registrations; whether the project can advance to the tokenization stage depends on subsequent assessment results.