New Market Trading SquidRouterModule Forged Express Payload Safe Swap Exploit

The attacker bypassed access controls in the module's Axelar express path by supplying a forged Squid source address and attacker-controlled delegate data, then used the victim Safe's existing delegated permissions to approve Permit2 and Uniswap before converting the assets into 0.568933475584054988 u.