🚨 Exploit Analysis | ShapeShift FOX Colony Authorization Trust Chain Flaw SlowMist analyzed the recent ShapeShift FOX Colony exploit on Arbitrum, where attackers abused a semantic conflict between meta-transactions and DSAuth self-call authorization to hijack the resolver and drain all ERC20 assets via malicious delegatecall. 🔍 Key Takeaways: • Arbitrary self-call in executeMetaTransaction() • DSAuth auto-trust for address(this) • Resolver hijacking through meta-tx • Full asset drain via delegatecall 🌟This incident shows how individually “reasonable” designs can combine into a complete privilege bypass chain. Developers should strictly restrict sensitive selectors in meta-transaction systems and avoid unconditional self-call authorization patterns. Full analysis👇 https://medium.com/@slowmist/analysis-of-the-exploit-trust-chain-flaw-in-shapeshift-fox-colony-authorization-mechanism-b35a61865a80(SlowMist)