repayAllDebt joins system tokens to the proxy not to the Safe contract
Lines of code Vulnerability details Impact repayAllDebt now calls joinSystemCoins with dest = addressthis, which in case a proxy makes a delegated call to this function will cause the user's tokens to be transferred to its proxy, then in CoinJoin.join it will transfer internal coins from CoinJoin...