DBXen exploited for $133K via msg.sender vs _msgSender() logic error in burnBatch function; attacker drained ~65.36 ETH in protocol fees.
Security & Exploits ·
DBXen suffered a $133K exploit on March 11, 2026, stemming from a logic error in its burnBatch() function that mishandled caller identity across different contexts. The vulnerability lay in a mismatch between msg.sender and _msgSender() (ERC2771): while XEN token burns were debited from msg.sender, the gasWrapper modifier credited reward accrual to _msgSender(), the actual meta-transaction signer. When routed through a trusted Forwarder, this allowed an attacker to burn tokens from the Forwarder's balance while accumulating protocol fee credits under their own address.
The attacker leveraged this over multiple cycles to accumulate approximately 65.36 ETH in protocol fees assigned to address 0x425d, then drained the entire fee pool in a single transaction and transferred the funds to their externally owned account. Token price fell 42.8% in 24 hours, while the protocol's TVL collapsed to $95K from a previous $408K staking pool balance.
The vulnerability highlights a critical risk when ERC2771 meta-transaction patterns interact with balance-checking logic, though full details of how the Forwarder was initially seeded with sufficient XEN tokens remain unclear from available on-chain evidence.