DBXen contract exploited, estimated loss of $150,000

ChainCatcher report: According to BlockSec monitoring, the DBXen contract was attacked this morning, with estimated losses of approximately $150,000. The root cause lies in inconsistent sender identification under ERC2771 meta-transactions. In the burnBatch() function, the gasWrapper() modifier uses _msgSender() (the actual user) to update state, while the callback function onTokenBurned() uses msg.sender (the forwarder). This causes accCycleBatchesBurned to be recorded for the user, but lastActiveCycle is incorrectly updated for the forwarder. This inconsistency disrupts the logic of claimFees() and claimRewards(). When updateStats() is executed for the user, the contract erroneously assumes there are unprocessed burned batches because accCycleBatchesBurned has been updated while lastActiveCycle has not, leading to incorrect calculations of rewards and fees—allowing the attacker to extract excess funds for profit.