Huma Finance's deprecated V1 BaseCreditPool contracts on Polygon were exploited via a credit-lifecycle logic error combined with unrestricted access control. An attacker created Requested credit records through an open requestCredit() path with preApproved=false, then advanced those unapproved records to GoodStanding using an unrestricted refreshAccount() call. The attacker then exploited drawdown() to borrow the pools' residual balances.