DexibleApp aggregator hacked for $2M via ‘selfSwap’ function

The buggy function was intended to allow users to provide their own routing information, but the code did not limit routers to a pre-approved list.