Curio exploited March 23-25, 2024 via access control flaw in voting power. Attacker with small CGT stake escalated voting power to execute delegatecall to malicious contract, minting ~1B CGT worth $16M.