Skip to main content
• 3 min read

The DBXen protocol was hit by an ERC-2771 identity
obfuscation attack, resulting in a loss of approximately $150,000.

According to monitoring by BlockSec Phalcon, the DBXen protocol suffered from an identity verification inconsistency due to the mixed use of _msgSender() and msg.sender during meta-transaction processing. The attacker exploited this logic vulnerability to manipulate reward settlements, illicitly extracting approximately $150,000 in assets from contracts on both the Ethereum and BSC chains.

AUTOSEC.DEVAUTOSEC.DEV
The DBXen protocol was hit by an ERC-2771 identity obfuscation attack, resulting in a loss of approximately $150,000.
  • Exploit Date: March 12, 2026
  • Target: DBXen
  • Target Overview: DBXen is a multi-chain decentralized yield generation protocol that allows users to participate in periodic reward distributions by burning tokens.
  • Total Loss: ~$150,000
  • Attack Vector: Logic Vulnerability

Incident Review and Technical Details​

1. Attack Path​

  1. Meta-Transaction Integration: The DBXen protocol integrated the ERC-2771 standard to support gasless transactions. In its processing logic, the contract must distinguish between the Forwarder address (msg.sender) and the Actual user address (_msgSender()).
  2. Identity Identification Conflict: During the execution of the burnBatch() function, the gasWrapper() modifier correctly utilized _msgSender() to identify the actual user and incremented their accCycleBatchesBurned (accumulated cycle batches burned).
  3. State Update Misalignment: However, the subsequent burn callback, onTokenBurned(), erroneously used the native msg.sender. Since the request was sent via a forwarder, the system updated the lastActiveCycle (last active cycle) for the Forwarder address, while the actual user’s state bit remained unchanged (retaining its old value).
  4. Logic Arbitrage: When calling claimFees() or claimRewards(), the updateStats() function encountered a logic error. Because the user’s burn records had increased but their active cycle was not marked as processed, the system allowed the attacker to double-count and over-extract reward assets.

2. Scope of Impact​

The exploit primarily affected contracts on Ethereum and BNB Smart Chain (BSC), leading to the illicit claiming of assets within the reward pools.

3. Official Determination​

The root cause was the inconsistent mixing of _msgSender() and msg.sender within the same transaction flow, causing the Accounting Logic to fail under a meta-transaction environment.

AUTOSEC.DEV Solution: Building a 360-Degree Defense​

To counter hybrid attacks involving "Web2 Breach + Web3 Monetization," AUTOSEC.DEV provides comprehensive protection from code to personnel:

  1. Team OPSEC (Operations Security) Audit & Hardening: We provide enterprise-grade security training and configuration for core Web3 team members. We assist teams in deploying security hardware and risk detection software to increase the difficulty of social engineering attacks, while auditing password management protocols and device security policies.
  2. End-to-End Incident Response (IR): In an emergency, every second of confusion amplifies the loss. AUTOSEC.DEV provides standardized SOPs (Standard Operating Procedures) and rapid response services tailored to specific business needs to help projects mitigate losses quickly.

Service Content​

Reference​

https://x.com/Phalcon_xyz/status/2031955394025996688