Skip to main content
• 5 min read

ShapeShift FOX Colony Exploit: $132K
Drained via Meta-Transaction Self-Call and Resolver Hijack

ShapeShift FOX Colony on Arbitrum was drained for about $132,700 after a meta-transaction self-call interacted with DSAuth self-authorization, letting the attacker replace the resolver and drain USDC and FOX-related assets in one transaction.

AUTOSEC.DEVAUTOSEC.DEV
ShapeShift FOX Colony Exploit: $132K Drained via Meta-Transaction Self-Call and Resolver Hijack
  • Incident Date: May 14, 2026
  • Target: ShapeShift FOX Colony / Colony Network EtherRouterCreate3 deployment on Arbitrum
  • Target Overview: ShapeShift FOX Colony is a community governance deployment tied to the FOX ecosystem and built with Colony Network-style router architecture. The affected contract used an EtherRouter / resolver pattern with meta-transaction support and legacy DSAuth authorization behavior.
  • Total Loss: ~$132,700 in USDC and FOX-related assets
  • Attack Vector: Meta-Transaction Arbitrary Self-Call / DSAuth Self-Authorization / Resolver Hijack / Malicious Delegatecall Drain

Incident Review & Technical Details​

1. Attack Path​

  1. FOX Colony Contract Was Targeted on Arbitrum: Blockaid reported that ShapeShift FOX Colony, tied to Colony Network contracts, was drained for roughly $132.7K in USDC and FOX on Arbitrum.
  2. Meta-Transaction Handler Allowed Arbitrary Self-Call: SlowMist's later technical analysis traced the root cause to executeMetaTransaction(), which verified a user signature and then executed attacker-controlled functionSignature data through address(this).call(callData).
  3. Sensitive Selectors Were Not Filtered: The meta-transaction path did not block privileged calls such as setResolver(address). The attacker could sign their own valid meta-transaction and make the contract call a sensitive admin function on itself.
  4. DSAuth Trusted the Contract's Own Address: Legacy DSAuth.isAuthorized() logic automatically allowed calls where src == address(this). Because the self-call made msg.sender appear as the victim contract itself, the protected setResolver() call passed authorization.
  5. Resolver Was Replaced with Malicious Routing Logic: The attacker redirected the resolver to attacker-controlled logic. That changed how unknown function selectors were mapped to implementation contracts.
  6. Assets Were Drained Through Delegatecall: The attacker mapped a custom drain(address,address) selector to malicious code. When called through the hijacked resolver, the victim contract executed the malicious implementation via delegatecall, so token balances held by the victim contract were transferred out.
  7. Single-Transaction Execution: Public technical reporting described the exploit as a single atomic transaction, with setup and drain logic executed through a temporary attack contract.

2. Impact Scope​

  • Direct Losses: Public alerts and reporting put the loss at approximately $132K-$132.7K. SlowMist's transaction reconstruction identified 132,704.591501 USDC plus additional FOX-related assets swapped into 1.9495 WETH, so final USD estimates can vary with FOX and WETH pricing.
  • Affected Contract: The affected EtherRouterCreate3 / EtherRouter contract was reported as 0x5c59d0ec51729e40c413903be6a4612f4e2452da on Arbitrum.
  • Attacker EOA: SlowMist identified 0xeed236afb6967f74099a0a6bf078bc6b865fbf28 as the attacker EOA.
  • Temporary Attack Contract: The attack was routed through temporary contract 0x835a701fd76b96a76ee84de037d41f059ee29f5c.
  • Malicious Resolver: Technical analysis identified malicious resolver 0x4e321af09012e15a67756522187c05b108b7ee0a.
  • Malicious Drain Implementation: The delegatecall drain implementation was reported as 0x0b971e0a8ecc7d5b2465c903cf75aeaedbfc39e2.
  • Potentially Similar Deployments: Blockaid warned that other Colony Network deployments using similar architecture could be exposed if the same meta-transaction and resolver assumptions are present.

3. Root Cause Assessment​

The exploit came from a semantic conflict between meta-transaction UX logic and internal authorization assumptions:

  • Self-Calls Became Privileged Calls: executeMetaTransaction() turned user-provided calldata into an internal self-call. DSAuth then treated that self-call as trusted authority.
  • Admin Selectors Were Reachable from a User Path: A meta-transaction feature intended for user operations could reach setResolver(), a high-impact routing/admin function.
  • Resolver Control Was Equivalent to Contract Control: Once the resolver was replaced, the attacker controlled where fallback-routed function selectors delegated execution.
  • Delegatecall Preserved Victim Storage and Balances: The malicious drain code ran in the victim contract's context, so address(this) referred to the FOX Colony contract holding the assets.
  • Composed Trust Boundaries Were Not Tested Together: The individual components, meta-transactions, DSAuth, resolver routing, and delegatecall, each have known use cases. The vulnerability appeared in their combined behavior.

The core invariant should have been strict: user-signed meta-transactions must never be able to trigger privileged self-calls such as owner changes, authority changes, resolver updates, upgrades, or arbitrary delegatecall routing.

4. Mitigation and Response​

Recommended actions for DAO tooling, router proxies, and meta-transaction systems:

  • Block sensitive selectors inside meta-transaction executors, including owner, authority, resolver, upgrade, pause, and token-drain paths.
  • Do not treat address(this) as automatically authorized when user-controlled calldata can trigger self-calls.
  • Separate user-call meta-transaction paths from privileged administration paths at the contract level.
  • Add explicit allowlists for functions callable through executeMetaTransaction().
  • Require timelocks, multisig approval, and event monitoring for resolver or implementation changes.
  • Test trust-boundary composition, not only isolated functions: meta-transaction execution, fallback routing, DSAuth authorization, and delegatecall behavior must be fuzzed together.
  • Scan related Colony-style deployments for exposed executeMetaTransaction() routes that can reach setResolver(), setOwner(), setAuthority(), or equivalent privileged selectors.

AUTOSEC.DEV Solution: Building a 360-Degree Defense​

ShapeShift FOX Colony's exploit shows how a user-experience feature can accidentally become an admin bypass when it is composed with legacy authorization and router patterns.

  1. Smart Contract Logic Audit: AUTOSEC.DEV reviews meta-transaction handlers, resolver routing, fallback paths, delegatecall destinations, and authorization libraries for cross-component privilege escalation.
  2. Access Control & Upgrade Review: We test owner, authority, resolver, proxy admin, upgrade, and implementation-switching paths for unauthorized reachability.
  3. Composability Testing: We build fork tests and fuzz harnesses that combine signed meta-transactions, self-calls, fallback routing, delegatecall execution, and treasury-held ERC-20 balances.
  4. Incident Response (IR): AUTOSEC.DEV supports rapid exploit reconstruction, affected-contract scoping, related-deployment scanning, treasury exposure analysis, and post-incident hardening.

Service Content​

Reference​