Time Token Exploit

On 7 December an attacker exploited a framework-level integration bug between ERC-2771 Forwarder and a contract using multicall/delegatecall to cause the TIME token contract to burn ~99.9% of a targeted pool's TIME supply and extract ~84.6 ETH (~$188K). The root cause is incorrect calldata handling that truncates the verified req.from value, enabling unauthorized execution and subsequent price manipulation and theft; the issue affects other projects using the same pattern.