Auctus options protocol had a beta contract allowing arbitrary low-level calls with controlled calldata. An attacker exploited this to drain approved user funds from wallets, targeting those who had granted unlimited approval to the contract.