MetaLabz token locker contract had an unprotected emergencyWithdraw() function that bypassed NFT stake records and reward calculations. Users could deposit both NFTs and ERC20 tokens, then execute emergencyWithdraw to extract tokens without processing proper stake accounting.

MetaLabz tweeted: "In order to ensure the supply we hold, we deployed an unaudited contract (token locker), but the contract has been exploited. The situation was then exacerbated by the liquidity attack, resulting in a total loss of slightly more than 400 BNB." According to analysis, the reason is that the authorization check was bypassed.