ShapeShift FOX Colony

An attacker exploited the EtherRouterCreate3 contract's meta-transaction mechanism by abusing the arbitrary self-call capability combined with DSAuth's automatic authorization logic for address(this). The attacker bypassed the auth modifier, replaced the contract's core routing component (resolver) with a malicious version, then used delegatecall to drain all ERC20 assets.

7K.