BlockSec: DBXen contract attacked, loss of approximately $150,000

PANews reported on March 12th that, according to BlockSec Phalcon monitoring, the DBXen contract suffered an attack this morning, with estimated losses of approximately $150,000. The root cause lies in the inconsistent sender identity under ERC2771 transactions. In the `burnBatch()` function, the `gasWrapper()` decorator uses `_msgSender()` (the actual user) to update the state, while the callback function `onTokenBurned()` uses `msg.sender` (the forwarder). This causes `accCycleBatchesBurned` to record for the user, but `lastActiveCycle` incorrectly updates for the forwarder. This inconsistency breaks the logic of `claimFees()` and `claimRewards()`. When `updateStats()` is run for the user, the contract incorrectly assumes there are unprocessed burned batches because `accCycleBatchesBurned` has been updated while `lastActiveCycle` has not, thus incorrectly calculating rewards and fees, allowing the attacker to extract excess funds for profit.