CoinDesk reported:
The MsgExec message is used in the Cosmos SDK to allow authorized message execution by allowing one account to grant authorization to another account. However, this feature was not properly secured, allowing the attacker to bypass the ‘EthGasConsumeDecorator,’ which is responsible for deducting gas fees from transactions.