Sorra Finance's staking contract had a critical flaw in the getPendingRewards() function that failed to track and deduct previously claimed rewards. The attacker deposited 122,868 SOR tokens with a 14-day lockup, then repeatedly called withdraw() to claim the same rewards multiple times before the state was updated.