ReflexerGEB exploit analysis

Reflexer's GEB framework is in Global Settlement since January 2021. The GebProxyActions library at 0x84FE452d9fb495a335c74a225e6ad52c35eb8616 is a shared, stateless "proxy actions" library meant to be DELEGATECALLED through each user's own DSProxy. From GebSafeManager's point of view, msg.sender is then the per-user proxy that owns the SAFE. Several SAFEs (ids 3, 5, 8, 18 for the ETH-A collateral type) were registered in GebSafeManager with ownsSAFE[safe] set to the GebProxyActions library's own address, meaning the library itself was recorded as the SAFE owner rather than any per-user proxy.

GebProxyActions.quitSystem(manager, safe, dst) is a plain public function with no authentication. It simply forwards to GebSafeManager.quitSystem(safe, dst). When called directly on the library (not through a proxy), the manager sees msg.sender == library address, which equals ownsSAFE[safe], so the safeAllowed(safe) check passes. Any external caller can therefore migrate the collateral of those SAFEs to an address of its choosing.

Because the system is in Global Settlement, the per-SAFE flow is GlobalSettlement.processSAFE (clears the SAFE's debt, leaving free collateral in the handler), then GebProxyActions.quitSystem (moves that free collateral into the attacker's own SAFE balance), then GlobalSettlement.freeCollateral (converts it to the internal ETH-A tokenCollateral). Looping every stolen SAFE through those steps, one CollateralJoin.exit plus WETH.withdraw turns the proceeds into ETH.

The attacker (EOA 0xb929c7215c0ec8ebad5fbf73b1da63bccfff1896, via helper 0x6a213f0b5bd9eed865d3e2efc867b73dfe9039e7) ran the drain in a single transaction on block 25,873,572 of Ethereum (0xfbce28e35c26358110dd9ed91f9ceef588acb264c3cf6c573df65ca21335058f), draining SAFEs 3, 5, 8, and 18 for ~5.9436 ETH, or roughly $14K, in one transaction.

This drains leftover collateral from old CDP positions of a protocol that has been shut down since January 2021. It is not an attack on a live protocol in active use, but it is a real, self-contained, permissionless theft of other users' funds.

The fix on the protocol side is to re-register the affected SAFEs to their actual owners (or, more broadly, to migrate the proxy-actions library to a model where each user proxy is the registered owner). The defensive pattern for shared proxy-actions libraries is that the manager must verify msg.sender is the proxy that owns the SAFE, never the library address itself.