BonfireSwap’s public transfer path accepted a caller-supplied token owner address and passed it as the from address to BONFIRE’s transferFrom without verifying that the caller was that owner or otherwise authorized by the owner. Because BONFIRE saw BonfireSwap itself as msg.sender, existing victim-to-BonfireSwap allowances authorized the transfers. The attacker repeatedly selected wallets with standing approvals, transferred their BONFIRE into the BONFIRE/WBNB PancakeSwap pair, and used the router’s public skim path to collect the resulting excess before selling the harvested BONFIRE for BNB. No private key, admin privilege, flash loan, or PancakeSwap invariant failure was required