Neutra Finance's convert() function used spot price to value LP tokens, but two LP tokens with the same name (CMLT-LP) from different pools could be swapped for each other. An attacker exploited this by converting from one LP token pool (CMLT-LP-65eb) to the other (CMLT-LP-2ea3), extracting value from the price differential.