MetaPoint was exploited through a public approval function that allowed attackers to transfer all user assets. The attacker created bulk contracts to invoke the unrestricted approve function and drain maximum token amounts from user deposits.

MetaPoint ($POT) on BSC was hacked with a loss of $920K. The root cause is that users will create a new contract to hold their funds each time they deposit $POT, but the contract has a public approve function to transfer all users' assets.