BlockSec: DBXen contract遭遇攻击,损失约 150,000美元

By: rootdata|2026/03/12 16:42:00
0
Share
copy

According to BlockSec monitoring, the DBXen contract was attacked this morning, with estimated losses of about $150,000. The root cause lies in the inconsistency of the sender's identity under the ERC2771 meta-transaction. In the burnBatch() function, the gasWrapper() modifier uses _msgSender() (the actual user) to update the state, while the callback function onTokenBurned() uses msg.sender (the relayer). This leads to accCycleBatchesBurned being recorded for the user, but lastActiveCycle being incorrectly updated for the relayer.

This inconsistency disrupts the logic of claimFees() and claimRewards(). When updateStats() is run for the user, the contract incorrectly assumes there are unprocessed burned batches because accCycleBatchesBurned has been updated while lastActiveCycle has not, resulting in incorrect calculations of rewards and fees, allowing the attacker to extract excess funds for profit.

-- Price

--

You may also like

Four Key Truths and Cost Traps Behind Polymarket LP Market Making Incentives

The potion left in the witch's hand is still poison; let's wait for Polymarket's major announcement tomorrow.

San Francisco Stablecoin Weekly Insights: The XYZ Coordinate System of 2026

Stablecoins 2026 New Narrative: No longer just "issuing coins," but reconstructing global financial infrastructure along three dimensions: AI payment authorization, RWA on-chain credit, and cross-border on-chain FX.

Asia's Next Great Dog Coin Debuts at the Weex AI Trading Hackathon

A BNB Chain meme token inspired by the Shih Tzu dog, blending community culture, creativity, and long‑term loyalty in Web3.

Fluxor: Connecting Global Builders With the WEEX AI Trading Hackathon

A hackathon platform connecting builders and creators to collaborative opportunities and innovation in Web3, enabling AI-oriented developers to experiment and create at scale.

The growth of AI-driven tools and community collaboration in Web3 has created new opportunities for developers worldwide. As a community partner and sponsor of the WEEX AI Trading Hackathon, Fluxor's mission to unify hackathon experiences and foster creative partnerships aligns with this spirit of collective innovation.

Houthi Deadline Countdown Begins | Rewire News Morning Brief

Trump's 48-Hour Ultimatum was issued on Saturday and expires on Monday night

Middle East Conflict Escalation and Rate Hike Expectation Trigger Worst Gold Sell-Off in 43 Years

The key reasons for the sharp decline include heightened oil prices due to Middle East conflict, suppressed interest rate cut expectations, and intensified selling pressure triggered by tightening USD liquidity.

Popular coins

Latest Crypto News

Read more