Blockaid warns of active smart contract exploit
Blockchain security firm Blockaid flagged an active smart contract exploit draining $132,700 from ShapeShifts FOX Colony on Arbitrum.The attacker targeted the executeMetaTransaction function in FOX Colonys contracts, using a delegate call to redirect funds to a malicious contract.A second related exploit drained an additional $50,000 shortly after the initial attack, bringing total losses to approximately $182,700.Blockaid warned every Colony Network deployment exposing executeMetaTransaction on top of EtherRouter, across any chain, may face the same vector. Blockaid flagged the incident on X on May 13, identifying the attacker wallet at 0xeed236Afb6967f74099a0a6bf078BC6b865fbf28. FOX Colony is ShapeShifts community governance and participation programme, allowing FOX token holders to stake, vote, and engage in ecosystem activities through Colony Network contracts on Arbitrum. According to Blockaid‘s analysis, the vulnerability sits in the executeMetaTransaction function. The attacker meta-signed a targeted transaction, repointed the colony’s resolver to a malicious contract, and then used a delegate call to drain the funds. Because any external address can call the affected registration function without permission modifiers, the flaw is effectively equivalent to making a copy of the protocols key available to any attacker who finds it. Why other Colony Network protocols remain at risk Blockaid alerted the broader DeFi community that every Colony Network colony exposing