BonfireSwap Router Access Control Flaw Leads to ~$50K Loss, 41 Users Affected

According to SlowMist security team's disclosure, BonfireSwap's router contract suffered a loss of approximately $50,000 due to a missing access control in its transfer function. The function did not verify whether the caller was the `from` address, nor did it check the caller's authorization over the `from` address's assets, allowing attackers to set users who had previously approved the router as the `from` address and themselves as the `to` address, thereby transferring victims' TOKEN and exchanging it through the same token pool. SlowMist stated that a total of 41 TOKEN holders who had authorized the router were affected; the vulnerable contract address is 0x17e801e17cefc6334059189c178d4783830e03d3.