DBXen's ERC2771 meta-transaction implementation had an identity confusion bug where burnBatch() used _msgSender() to identify the actual user but onTokenBurned() used msg.sender() to identify the forwarder, allowing attackers to claim accumulated fees from 1,085 cycles using brand-new addresses.

According to monitoring by BlockSec Phalcon, the DBXen contract was attacked this morning, with estimated losses of approximately $150,000.The root cause lies in a sender identity inconsistency within the ERC-2771 meta-transaction mechanism.