GYM Network's _autoDeposit function had no transfer check, allowing users to call deposit() and create_deposit_record() without actually transferring tokens. An attacker repeatedly 'deposited' 8 million GYMNET tokens without sending any funds, then withdrew the fake deposit balance.