The Idols NFT contract had a flaw in the _beforeTokenTransfer function that incorrectly handled reward distribution when sender and recipient were the same address. By repeatedly calling safeTransferFrom with identical from/to addresses, an attacker exploited the logic flaw to drain 97 stETH from the reward pool.

The attacker exploited a vulnerability in The Idols project's smart contract to steal 97 stETH (approximately $324,000) from the project.