Enjin

Enjin’s legacy CryptoItems infrastructure was exploited through a storage-slot collision between a registered adapter and its Managed Delegate Proxy. Because adapter functions execute in the proxy’s storage context via DELEGATECALL, the attacker called the adapter’s public initialize(uint256), which wrote the attacker’s address into the proxy’s pendingManager storage slot.

The attacker then called acceptManager(), gained managerial control, registered a malicious adapter, stole ENJ-backed assets from users, and liquidated them through melt().