# WazirX Transaction Analysis

Consider some of the following biographical information related to what we're looking at too:

1. The address of the logic contract / implementation is `0xd9db270c1b5e3bd161e8c8503c55ceabee709552`. That contract was created at TX `0x0b04589bdc11585fb98f270b1bfeff0fb3bbb3c56d35b104f62d8115d6f7c57f` at block `12504268`\`. This is a smart contract created by Gnosis Safe and used as an implementation proxy address for another smart contract that was exploited by the proxy storage address.
    
2. The address for the proxy smart contract address that was compromised was `0x27fD43BABfbe83a81d14665b1a6fB8030A60C9b4` and that was created by the transaction ID `0x3c889ee7c1a19bb15d899f21c5c7d9da0af0c5a5f597f0e288b7309169b4dba5` and deployed by `0xD7Df5bf3B8d2bd159664dF54A30101d7FAF6cA26` by making a call on the smart contract `0x4e59b44847b379578588920cA78FbF26c0B4956C` to deploy the smart contract address which is labeled as `singleton`. The address responsible for deploying this contract is `0xfA54B4085811aef6ACf47D51B05FdA188DEAe28b` at block height `16132578` and it was deployed from the Gnosis Safe Factory contract located at `0xfA54B4085811aef6ACf47D51B05FdA188DEAe28b`.
    
3. When the smart contract storage proxy address `0x27fD43BABfbe83a81d14665b1a6fB8030A60C9b4` was created, it established 5 different owners. Those owners are `0xaE648f68823bc164CA3ad1f5f5dC0057d9d515aD`, `0x10F16CdE93f1bC9C38a9e31C8DB0eEb89a744824`, `0xD83b89E261D02B0f2f9E384B44907f8d380E9AF0`, `0x9AF78003CecC2383d9D576A49c0C6b17fc34Ae34` and `0xfA54B4085811aef6ACf47D51B05FdA188DEAe28b`. The threshold for this multi-signature address was established as `3`. The initializer was `0x0000000000000000000000000000000000000000` and the address for the smart contract designated as the `fallbackHandler` was `0xf48f2B2d2a534e402487b3ee7C18c33Aec0Fe5e4`. This transaction also designated `0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552` as the `singleton` for this address. The singleton is the logic proxy address that we're examining that serves as the main address.
    
4. The transaction that ultimately compromised both smart contracts in question occurred at transaction ID: `0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d`. The sender of the transaction was an EOA with the address `0xd967113224c354600b3151e27aaba53e3034f372` at block height `20331565`. The transaction involved a delegatecall being made to the singleton smart contract at `0xd9db270c1b5e3bd161e8c8503c55ceabee709552` (*which is our flattened smart contract*) before eventually `calldata` was forwarded to a malicious smart contract address located at `0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2`. This EOA (`0xd967113224c354600b3151e27aaba53e3034f372`)was added as an owner to the `0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4` smart contract in February 2023 during transaction ID: `0xfda0801c5f916fc17d042a8297af15ccdfa91bc12d530fda4708c159e992b19a`. The multi-signature threshold was subsequently raised to `4` afterward.
    

The source code for all smart contracts involved in the creation of the two proxy smart contracts that I mentioned (`0x27fD43BABfbe83a81d14665b1a6fB8030A60C9b4` and `0xd9db270c1b5e3bd161e8c8503c55ceabee709552`) are verified on Etherscan already. Thus, if there is any additional information that is needed then that can be obtained from the blockchain directly.

It is known that none of the keys involved in the multi-signature orchestration were compromised at any point in time and this has been independently verified after the fact. Thus, the flaw, vulnerability or exploit must be laden within the smart contracts themselves. Since the logic within the main proxy (`0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4`) is nominal at best, we have decided to set our focus on dissecting the `singleton` contract that was associated with the deployed proxy from Gnosis Safe.

During the malicious transaction we observed that the storage data in slot 0 was updated for the main proxy. This update swapped out the legitimate `singleton` contract for a malicious one at `0xef279c2ab14960aa319008cbea384b9f8ac35fc6`. The malicious contract that was responsible for returning data back to the main proxy, resulting in an update of that proxy's `singleton` address value in `slot 0` is at the address `0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2`. The bytecode for both malicious contracts is not verified or available on Etherscan. Therefore, any and all attempts to dissect the true nature of these smart contracts will be contingent on the efficacy of associated bytecode disassemblers.

That transaction [can be found here](https://etherscan.io/tx/0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d). The transaction itself is **highly complex** and reveals a lot of potential issues in the **Safe contract deployment** (yes, those guys formerly known as Gnosis Safe).

Before we make anymore assertions about the nature of the hack, let's go ahead and take a look at the malicious transaction, starting with Etherscan's view.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1726857539648/fc1ad404-b8b2-45a3-b339-1b7901abbcce.png align="center")

As we can see, it **appears** that the transaction was initiated by the `0xd967` address - which we've already established as belonging to the team.

The transaction was sent directly to the `0x27fD` address, which is the WazirX team's **main proxy**. As we've discussed in a (separate guide), the specific proxy upgradable orchestration that WazirX used involves deploying a unique proxy from a "factory contract" (*which served as the 'template' for their proxy*).

However, the **other associated contracts** (i.e., their [implementation/singleton](https://etherscan.io/address/0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552) & [fallback handler](https://etherscan.io/address/0xf48f2B2d2a534e402487b3ee7C18c33Aec0Fe5e4)) are **Gnosis Safe deployments**. They were never deployed or owned by the team. Thus, any compromise arising out of the functionality of those contracts should also be attributed to the Safe team (*more specifically for their failure to make it a widespread imperative for users to upgrade to better constructed implementations*).

Getting back to the malicious transaction, let's take a look at the internal transaction trace that the malicious transaction created:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1726857565965/75957f9b-cdb9-44d6-a8ed-a0408af8c1b8.png align="center")

> *As we can see abvoe, the entry point was the team's proxy contract with a function call that triggered the contract's* `fallback` *function, ultimately leading to a call being delegated to a malicious proxy contract* ([0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2](https://etherscan.io/address/0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2))

Moving forward, let's see if we can't glean more information about the nature of this attack by looking at a simple stack execution trace of the actual compromise.

Check out the parity stack trace below (*you can find this on* [Etherscan too](https://etherscan.io/vmtrace?txhash=0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d&type=parity)):

```json
                                    
  {
    "action": {
      "from": "0xd967113224c354600b3151e27aaba53e3034f372",
      "callType": "call",
      "gas": "0x2c9f8",
      "input": "0x6a761202000000000000000000000000fbffef83b1c172fe3bc86c1ccb036ab9f3efcaf20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000024804e1f0a000000000000000000000000ef279c2ab14960aa319008cbea384b9f8ac35fc60000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001043da7c6bd7c130430cf662de3d9af067c4a0629f849e29003c40ad3979cd670720c3ceb3a61e38fb7166353e3262eb6554c3f6571807cf22f9bdc4a83a56441661f8e64a89386af2f223b8433a1df65db8f0ff60544b2f02c56ec02b640d6fb15a11f7dffda5b99b0292b5e02d0cc44508d7d8f994515358e9da3016d8098b2258820000000000000000000000000d967113224c354600b3151e27aaba53e3034f37200000000000000000000000000000000000000000000000000000000000000000140082eba0f71627a3451d47132b8f4c266bc9be2bebe4424848757d10f13e76963af0b543a2357765d9f290410e919301ad065f0f2efa1233eb8634c93111f0e2000000000000000000000000000000000000000000000000000000000",
      "to": "0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4",
      "value": "0x0"
    },
    "blockHash": "0xf0716718399afb665776df3378a2bc7c1ff02c03a40af8d6471193b1611b873b",
    "blockNumber": 20331565,
    "result": {
      "gasUsed": "0xb4eb",
      "output": "0x0000000000000000000000000000000000000000000000000000000000000001"
    },
    "subtraces": 1,
    "traceAddress": [],
    "transactionHash": "0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d",
    "transactionPosition": 21,
    "type": "call"
  },
  {
    "action": {
      "from": "0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4",
      "callType": "delegatecall",
      "gas": "0x2abe6",
      "input": "0x6a761202000000000000000000000000fbffef83b1c172fe3bc86c1ccb036ab9f3efcaf20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000024804e1f0a000000000000000000000000ef279c2ab14960aa319008cbea384b9f8ac35fc60000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001043da7c6bd7c130430cf662de3d9af067c4a0629f849e29003c40ad3979cd670720c3ceb3a61e38fb7166353e3262eb6554c3f6571807cf22f9bdc4a83a56441661f8e64a89386af2f223b8433a1df65db8f0ff60544b2f02c56ec02b640d6fb15a11f7dffda5b99b0292b5e02d0cc44508d7d8f994515358e9da3016d8098b2258820000000000000000000000000d967113224c354600b3151e27aaba53e3034f37200000000000000000000000000000000000000000000000000000000000000000140082eba0f71627a3451d47132b8f4c266bc9be2bebe4424848757d10f13e76963af0b543a2357765d9f290410e919301ad065f0f2efa1233eb8634c93111f0e2000000000000000000000000000000000000000000000000000000000",
      "to": "0xd9db270c1b5e3bd161e8c8503c55ceabee709552",
      "value": "0x0"
    },
    "blockHash": "0xf0716718399afb665776df3378a2bc7c1ff02c03a40af8d6471193b1611b873b",
    "blockNumber": 20331565,
    "result": {
      "gasUsed": "0xa187",
      "output": "0x0000000000000000000000000000000000000000000000000000000000000001"
    },
    "subtraces": 1,
    "traceAddress": [
      0
    ],
    "transactionHash": "0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d",
    "transactionPosition": 21,
    "type": "call"
  },
  {
    "action": {
      "from": "0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4",
      "callType": "delegatecall",
      "gas": "0x214ec",
      "input": "0x804e1f0a000000000000000000000000ef279c2ab14960aa319008cbea384b9f8ac35fc6",
      "to": "0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2",
      "value": "0x0"
    },
    "blockHash": "0xf0716718399afb665776df3378a2bc7c1ff02c03a40af8d6471193b1611b873b",
    "blockNumber": 20331565,
    "result": {
      "gasUsed": "0xc2e",
      "output": "0x"
    },
    "subtraces": 0,
    "traceAddress": [
      0,
      0
    ],
    "transactionHash": "0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d",
    "transactionPosition": 21,
    "type": "call"
}
```

> Later on, we’re going to go ahead and dissect the bytecode that was sent to the malicious contract and walk through how the opcodes operated on said calldata, step by step to get a better understanding of how this compromise took place.

While this raw trace (*parity*) is far from complete in terms of what it does for us, it does provide us with some preliminary information that can begin to give us an understanding of how this hack took place:

1. The initial 'action' (i.e., function call) is noted as coming from the `0xd967` address (*more on what this means later and how the hackers could have possibly done this*).
    
2. That call - which was made to the WazirX main proxy (`0x27fd4`), triggered the proxy's fallback function, which will always be a `delegatecall` by default (*that's how proxies are designed*). For those new to the world of smart contract hacks, compromises, rugpulls etc., this opcode is one of **the most problematic** ones in the entire EVM system.
    
3. The first 4 bytes of the `calldata` tell us what function was being called. If you look back at the `json` stack execution trace that's printed above, you can identify the `calldata` as that large hexadecimal value next to the topic called "**input**". If you found it, then you'll notice the first 8 characters (4 bytes) after the `0x` prefix are `6a761202`. This hexadecimal value corresponds with the function that was called by the hacker. A quick lookup in a database like `4bytes` or [`evm.codes`](http://evm.codes) reveals that this hexadecimal value corresponds with the function signature `execTransaction(address,uint256,bytes,uint8,uint256,uint256uint256,address,address,bytes)`.
    
4. The `calldata` that was ultimately sent to the malicious proxy was `0x804e1f0a000000000000000000000000ef279c2ab14960aa319008cbea384b9f8ac35fc6`. There have been some attempts to dissect the meaning of this calldata already in the general public. But thus far, most analyses fall woefully short of breaking down the potency of this short, yet simply crafted `calldata` value.
    

What makes this hack so intriguing is its complexity. Despite all we've covered thus far, we've still barely scratched the surface in terms of **how exactly** the threat actor was able to compromise WazirX. But without any further deliberation, let's move forward here. A better breakdown of this transaction is going to require us decompiling the bytecode behind the calldata or piping the transaction itself into a high-quality debugger.

Before we do that, we’re going to need to get a more detailed view of the stack execution trace. This is going to require us going through a debugger similar - either via the terminal or through the use of an online tool that we can use like ‘Tenderly’, ‘Sentio’ or ‘Phalcon’. The latter two of those three online tools are entirely free while Tenderly requires that we at least sign up to obtain a trial subscription (14 days) before payment is necessary. All of them come with their own specific benefits. For those that are not as comfortable with using the terminal, we’re going to go ahead and see

Fortunately, there are plenty of tools in the Ethereum ecosystem that will allow us to do either. And those tools cater to both developers and folks that aren't as comfortable with navigating a terminal. Let's start with the 'terminal' approach.

Before we do that, we’re going to need to get a more detailed view of the stack execution trace. This is going to require us going through a debugger similar - either via the terminal or through the use of an online tool that we can use like ‘Tenderly’, ‘Sentio’ or ‘Phalcon’. The latter two of those three online tools are entirely free while Tenderly requires that we at least sign up to obtain a trial subscription (14 days) before payment is necessary. All of them come with their own specific benefits. Since most users are not quite as well-versed with the terminal, we’re going to go ahead and look at those latter two visual debuggers.

> **Disclaimer**: *To be clear, the best debugger* (in the author's opinion), *would be Tenderly since it tends to give us the most accurate decoding of the stack execution trace, step by step. Misinterpretations of some of the steps as well as the sub-steps are what lead to differing outputs as far as the debuggers are concerned*.

#### Sentio Debugger

For those that have never visited this site, you can find its main interface here: [https://app.sentio.xyz](https://app.sentio.xyz).

> *They may ask you to signup on the main website. If you want to bypass this step, just go ahead and visit this link here*: [https://app.sentio.xyz/tx/1/0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d?t=1&block=0x131fe81](https://app.sentio.xyz/tx/1/0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d?t=1&block=0x131fe81) ; *this will take you directly to the malicious transaction in question without being forced to sign-up or login to the website*.

Once you arrive at the panel for the malicious transaction, you should see the following:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1727930923438/17f72253-4c6d-48e1-a5c8-985e11d9bad3.png align="center")

From here, we're going to take a look at some of the panels at the bottom, which go by the names of `Call Trace`, `Call Graph` and `Gas Profiler` (*we're not quite as interested in the last tab, but we may take a breeze through it for good measure*).

**Call Trace Panel**

> *If you're not used to looking at transaction traces, this may be a bit overwhelming at first, but don't worry - we'll make ourselves familiar with the context shortly*

Upon firs visiting the `Call Trace` panel on the Sentio site for the malicious transaction, we should see the following at the bottom half of the page.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1727930946794/b9558e4c-184e-4f72-96c4-4f487f045093.png align="center")

Its worth noting that definition for a 'Stack Call Trace' given in the top right corner of our screenshot above. Specifically, it states, "*In a smart contract transaction, a static call (also known as a view or constant call) is a read-only operation that retrieves data from the blockchain without modifying any state. This means that a static call does not change the state of the blockchain or of the smart contract being called.*"

That's how we're able to get that stack execution trace that we see below (*keep in mind, this still isn't the debugged version of the transaction*). Some of the data here won't be entirely accurate and there are also some parts of the data that we need to further decode in order to get the "decoded" version.

#### Tenderly Debugged Transaction

> *Tenderly is probably the best platform to use if you want to not only get a thorough transaction trace but a fully debugged, stepped re-simulation of the transaction itself as well*

Assuming you've already signed up for an account on [Tenderly](https://app.tenderly.co) (*they provide a free trial for new users for 14 days before restricting some features*), this will be our best source for debugging the full transaction trace.

We're going to proceed forth with a free account for the sake of brevity (*sorry, Tenderly, we're on a budget - but if you'd like to throw a free membership, that would be greatly appreciated!*).

> *Seriously though, if you got the chance, make sure you go ahead and grab a Tenderly subscription / membership if you need to do anything even peripherally related to these activities in the blockchain space*.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1727931003536/c467f66b-fd43-4c94-a45a-4086496ec871.png align="center")

Once we're at the dashboard, we can go setup a virtual testnet, which will be based on a fork of the target network (Ethereum) at its current height (at the time of writing), which is well beyond the time of the hack. Don't worry though, if we need to revert the state of the blockchain to an earlier point in time, we'll be able to do so without any issue (*you'll understand why this was mentioned later on*).

First, we're going to add some of the relevant contracts to our dashboard. See the truncated list of contracts we're going to provide below:

* `0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4` (WazirX main proxy contract)
    
* `0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552` (Logic Contract/Singleton for the Main Proxy)
    
* `0xf48f2B2d2a534e402487b3ee7C18c33Aec0Fe5e4` (Fallback Handler for the Contract)
    
* `0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2` (this is the attacker contract that was involved in the OG malicious transaction that ultimately compromised the WazirX main proxy contract)
    

> *If you're feeling ambitious/productive, then you can go ahead and hunt down the factory contracts that some of the proxies were deployed from as well as the contracts responsible for the deployment* (where this is applicable)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1727931026666/00b4d08a-38dc-4b1a-b9ac-c3d03b8e81f0.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1727931035358/50071544-34af-4553-83b4-e5e4c0524618.png align="center")

Now that we have the contracts added, let's take a renewed look at the stack execution trace for the main hack that occurred.

This requires having an RPC endpoint that we can query to get the full trace of the transaction. Since we have Tenderly, that's not an issue. On the lefthand side on the panel menu, there's an option that reads, 'Node RPCs'.

If we select that option, then we'll see an option to `Create Node`. Once we click on that, we just navigate through the interface and then select the appropriate options.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1727931139383/007102d5-c7f3-4691-a3be-4081eb88c83c.png align="center")

Once a node is created, users are taken to the following 'home screen' for their personal node (RPC endpoint).

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1727931198049/66b06e63-e59c-4741-ae74-2871cf23ae48.png align="center")

On the lefthand side of the panel, we can see an option called 'RPC Builder'. We're going to select that option and then pull up the following screen.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1727931228704/97e0cd23-49bc-4bed-8e76-71154b6fb61a.png align="center")

From here, we're going to select an RPC option called `tenderly_traceTransaction`. Its stated that this RPC call, "*Replays transaction on the blockchain and provides information about the execution, such as status, logs, internal transactions, etc.*"

For those not as savvy with the terminal, all that one needs to do is edit the `params` key with the value of whatever transaction ID they're looking to receive a stack execution trace for (*which in this case is* [0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d](https://etherscan.io/tx/0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d)).

If done correctly, your screen should look as follows:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1727931250715/394c20dd-bbb6-44d1-93fe-7e8a823e5d6e.png align="center")

When we click the 'Run' button located at the top right, then we'll receive the full, detailed trace.

That trace should look like the following:

```json
{
  "id": 0,
  "jsonrpc": "2.0",
  "result": {
    "status": true,
    "gasUsed": "0x11f43",
    "cumulativeGasUsed": "0x11f43",
    "blockNumber": "0x1363c2d",
    "type": "0x2",
    "logsBloom": "0x00000000400000000000000000000000000000000000000000000000040000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "logs": [
      {
        "name": "ExecutionSuccess",
        "anonymous": false,
        "inputs": [
          {
            "value": "0x4e82121a3bc2fb62c0b06ab5fff5ca965ceab4f51cc949c6e50d85ed63e6aa70",
            "type": "bytes32",
            "name": "txHash",
            "indexed": false
          },
          {
            "value": "0",
            "type": "uint256",
            "name": "payment",
            "indexed": false
          }
        ],
        "raw": {
          "address": "0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4",
          "topics": [
            "0x442e715f626346e8c54381002da614f62bee8d27386535b2521ec8540898556e"
          ],
          "data": "0x4e82121a3bc2fb62c0b06ab5fff5ca965ceab4f51cc949c6e50d85ed63e6aa700000000000000000000000000000000000000000000000000000000000000000"
        }
      }
    ],
    "trace": [
      {
        "type": "CALL",
        "from": "0xd967113224c354600b3151e27aaba53e3034f372",
        "to": "0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4",
        "gas": "0x2c9f8",
        "gasUsed": "0xb4eb",
        "value": "0x0",
        "input": "0x6a761202000000000000000000000000fbffef83b1c172fe3bc86c1ccb036ab9f3efcaf20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000024804e1f0a000000000000000000000000ef279c2ab14960aa319008cbea384b9f8ac35fc60000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001043da7c6bd7c130430cf662de3d9af067c4a0629f849e29003c40ad3979cd670720c3ceb3a61e38fb7166353e3262eb6554c3f6571807cf22f9bdc4a83a56441661f8e64a89386af2f223b8433a1df65db8f0ff60544b2f02c56ec02b640d6fb15a11f7dffda5b99b0292b5e02d0cc44508d7d8f994515358e9da3016d8098b2258820000000000000000000000000d967113224c354600b3151e27aaba53e3034f37200000000000000000000000000000000000000000000000000000000000000000140082eba0f71627a3451d47132b8f4c266bc9be2bebe4424848757d10f13e76963af0b543a2357765d9f290410e919301ad065f0f2efa1233eb8634c93111f0e2000000000000000000000000000000000000000000000000000000000",
        "decodedInput": [
          {
            "value": "0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2",
            "type": "address",
            "name": "to",
            "indexed": false
          },
          {
            "value": "0",
            "type": "uint256",
            "name": "value",
            "indexed": false
          },
          {
            "value": "0x804e1f0a000000000000000000000000ef279c2ab14960aa319008cbea384b9f8ac35fc6",
            "type": "bytes",
            "name": "data",
            "indexed": false
          },
          {
            "value": 1,
            "type": "uint8",
            "name": "operation",
            "indexed": false
          },
          {
            "value": "0",
            "type": "uint256",
            "name": "safeTxGas",
            "indexed": false
          },
          {
            "value": "0",
            "type": "uint256",
            "name": "baseGas",
            "indexed": false
          },
          {
            "value": "0",
            "type": "uint256",
            "name": "gasPrice",
            "indexed": false
          },
          {
            "value": "0x0000000000000000000000000000000000000000",
            "type": "address",
            "name": "gasToken",
            "indexed": false
          },
          {
            "value": "0x0000000000000000000000000000000000000000",
            "type": "address",
            "name": "refundReceiver",
            "indexed": false
          },
          {
            "value": "0x3da7c6bd7c130430cf662de3d9af067c4a0629f849e29003c40ad3979cd670720c3ceb3a61e38fb7166353e3262eb6554c3f6571807cf22f9bdc4a83a56441661f8e64a89386af2f223b8433a1df65db8f0ff60544b2f02c56ec02b640d6fb15a11f7dffda5b99b0292b5e02d0cc44508d7d8f994515358e9da3016d8098b2258820000000000000000000000000d967113224c354600b3151e27aaba53e3034f37200000000000000000000000000000000000000000000000000000000000000000140082eba0f71627a3451d47132b8f4c266bc9be2bebe4424848757d10f13e76963af0b543a2357765d9f290410e919301ad065f0f2efa1233eb8634c93111f0e20",
            "type": "bytes",
            "name": "signatures",
            "indexed": false
          }
        ],
        "output": "0x0000000000000000000000000000000000000000000000000000000000000001",
        "decodedOutput": [
          {
            "value": true,
            "type": "bool",
            "name": "success",
            "indexed": false
          }
        ],
        "subtraces": 1,
        "traceAddress": []
      },
      {
        "type": "DELEGATECALL",
        "from": "0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4",
        "to": "0xd9db270c1b5e3bd161e8c8503c55ceabee709552",
        "gas": "0x2abe6",
        "gasUsed": "0xa187",
        "input": "0x6a761202000000000000000000000000fbffef83b1c172fe3bc86c1ccb036ab9f3efcaf20000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00000000000000000000000000000000000000000000000000000000000000024804e1f0a000000000000000000000000ef279c2ab14960aa319008cbea384b9f8ac35fc60000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001043da7c6bd7c130430cf662de3d9af067c4a0629f849e29003c40ad3979cd670720c3ceb3a61e38fb7166353e3262eb6554c3f6571807cf22f9bdc4a83a56441661f8e64a89386af2f223b8433a1df65db8f0ff60544b2f02c56ec02b640d6fb15a11f7dffda5b99b0292b5e02d0cc44508d7d8f994515358e9da3016d8098b2258820000000000000000000000000d967113224c354600b3151e27aaba53e3034f37200000000000000000000000000000000000000000000000000000000000000000140082eba0f71627a3451d47132b8f4c266bc9be2bebe4424848757d10f13e76963af0b543a2357765d9f290410e919301ad065f0f2efa1233eb8634c93111f0e2000000000000000000000000000000000000000000000000000000000",
        "decodedInput": [
          {
            "value": "0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2",
            "type": "address",
            "name": "to",
            "indexed": false
          },
          {
            "value": "0",
            "type": "uint256",
            "name": "value",
            "indexed": false
          },
          {
            "value": "0x804e1f0a000000000000000000000000ef279c2ab14960aa319008cbea384b9f8ac35fc6",
            "type": "bytes",
            "name": "data",
            "indexed": false
          },
          {
            "value": 1,
            "type": "uint8",
            "name": "operation",
            "indexed": false
          },
          {
            "value": "0",
            "type": "uint256",
            "name": "safeTxGas",
            "indexed": false
          },
          {
            "value": "0",
            "type": "uint256",
            "name": "baseGas",
            "indexed": false
          },
          {
            "value": "0",
            "type": "uint256",
            "name": "gasPrice",
            "indexed": false
          },
          {
            "value": "0x0000000000000000000000000000000000000000",
            "type": "address",
            "name": "gasToken",
            "indexed": false
          },
          {
            "value": "0x0000000000000000000000000000000000000000",
            "type": "address",
            "name": "refundReceiver",
            "indexed": false
          },
          {
            "value": "0x3da7c6bd7c130430cf662de3d9af067c4a0629f849e29003c40ad3979cd670720c3ceb3a61e38fb7166353e3262eb6554c3f6571807cf22f9bdc4a83a56441661f8e64a89386af2f223b8433a1df65db8f0ff60544b2f02c56ec02b640d6fb15a11f7dffda5b99b0292b5e02d0cc44508d7d8f994515358e9da3016d8098b2258820000000000000000000000000d967113224c354600b3151e27aaba53e3034f37200000000000000000000000000000000000000000000000000000000000000000140082eba0f71627a3451d47132b8f4c266bc9be2bebe4424848757d10f13e76963af0b543a2357765d9f290410e919301ad065f0f2efa1233eb8634c93111f0e20",
            "type": "bytes",
            "name": "signatures",
            "indexed": false
          }
        ],
        "method": "execTransaction",
        "output": "0x0000000000000000000000000000000000000000000000000000000000000001",
        "decodedOutput": [
          {
            "value": true,
            "type": "bool",
            "name": "success",
            "indexed": false
          }
        ],
        "subtraces": 1,
        "traceAddress": [
          0
        ]
      },
      {
        "type": "DELEGATECALL",
        "from": "0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4",
        "to": "0xfbffef83b1c172fe3bc86c1ccb036ab9f3efcaf2",
        "gas": "0x214ec",
        "gasUsed": "0xc2e",
        "input": "0x804e1f0a000000000000000000000000ef279c2ab14960aa319008cbea384b9f8ac35fc6",
        "output": "0x",
        "subtraces": 0,
        "traceAddress": [
          0,
          0
        ]
      }
    ],
    "stateChanges": [
      {
        "address": "0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4",
        "storage": [
          {
            "slot": "0x0000000000000000000000000000000000000000000000000000000000000000",
            "previousValue": "0x000000000000000000000000d9db270c1b5e3bd161e8c8503c55ceabee709552",
            "newValue": "0x000000000000000000000000ef279c2ab14960aa319008cbea384b9f8ac35fc6"
          },
          {
            "slot": "0x0000000000000000000000000000000000000000000000000000000000000005",
            "previousValue": "0x00000000000000000000000000000000000000000000000000000000000006b6",
            "newValue": "0x00000000000000000000000000000000000000000000000000000000000006b7"
          }
        ]
      },
      {
        "address": "0x95222290dd7278aa3ddd389cc1e1d165cc4bafe5",
        "balance": {
          "previousValue": "0xfd1064e88789a744",
          "newValue": "0xfd11419f913eea44"
        }
      },
      {
        "address": "0xd967113224c354600b3151e27aaba53e3034f372",
        "nonce": {
          "previousValue": "0xb9c",
          "newValue": "0xb9d"
        },
        "balance": {
          "previousValue": "0xab9e0a1fde78eca",
          "newValue": "0xab777e165b284d3"
        }
      }
    ]
  }
}
```

Now that we have this full stack execution trace, we can properly assess what exactly happened here on a more thorough basis.