Security Researchers Warn Users to Revoke Authorization for Blur Immediately Due to Upgradeable Contracts
Security researchers warn users to immediately revoke authorization for Blur due to its upgradeable contracts, which pose future security risks in the context of the team's front-end going offline.
Blur announced it will deprecate its front-end on November 12, 2026, but the on-chain protocol and BLUR token fee switch will continue to operate. Researchers found no known vulnerabilities in the current contract but pointed out that the upgrade mechanism allows the contract to switch to malicious logic at any time, with NFTs worth tens of millions of dollars currently under authorization.
Last month, related contracts of Magic Eden were exploited, resulting in losses of millions of dollars. White hat operations rescued over 23,155 NFTs worth more than $5.7 million, but about 660 WETH could not be recovered in time, highlighting the ongoing risks of open authorization amid advancing attack tools.
Blur uses an upgradeable proxy contract design, where user authorizations for contracts like ExecutionDelegate are permanent and cover the entire collection, remaining valid long-term unless actively revoked. Researchers recommend using tools like revoke.cash to immediately clear authorizations to prevent contract upgrades or operational security failures.
The current operational status of the Blur team is reportedly leaning towards dissolution, with the security of authorized assets entirely dependent on the team's operational security. The protocol itself can still match orders on-chain, but the front-end going offline reduces daily monitoring and response capabilities.
Funds and assets flow from user wallets to market contracts holding authorization, driven by the front-end deprecation and historical vulnerabilities, putting pressure on NFT holders with open authorizations, while users who revoke authorization and white hat rescuers benefit from reduced risk.
Source: Public Information
ABAB AI Insight
Since its launch in 2022, Blur has adopted an upgradeable proxy contract and ExecutionDelegate architecture. Early audits indicated that owners could upgrade and transfer authorized assets, similar to the modular designs of OpenSea Conduit and LooksRare TransferManager, but with long-term reliance on team keys and operational security.
Users grant permanent collection-level authorization when placing orders, directing control of funds and NFTs to market contracts. The Blur team holds potential intervention capabilities through upgrade rights, motivated by flexible fixes and functional iterations, yet after the front-end deprecation, risks are concentrated on private key security.
Similar cases include the September 2026 vulnerability caused by residual authorizations from Magic Eden's Limit Break Payment Processor V2, where white hats rescued over $5.7 million in assets; this is also akin to historical authorization issues faced by early NFT markets like OpenSea. The current phase is characterized by a contraction in the NFT market, with the front-end going offline marking a shift from active operation to protocol dormancy.
Essentially, this reflects a lack of regulatory change and a shift in trust: upgradeable contracts transfer asset security from immutable code to ongoing trust in team operational security, with the mechanism allowing single transactions to alter logic, while authorizations do not automatically expire, making historical interactions a persistent attack surface.
ABAB News · Cognitive Laws
Authorization is trust; revocation is safety.
Upgradeable contracts carry risks with the team.
Front-end offline; on-chain authorization remains.