TempleDAO's staking contract lacked access control on the migrateStake function. An attacker exploited this vulnerability to withdraw 321,154 xLP tokens from the staking contract and swap them for 1,418,303 TEMPLE tokens and 1,262,438 FRAX tokens, totaling $2.3M.

The TempleDAO project was hacked, involving an amount of approximately $2.36 million. According to the analysis of the SlowMist security team, in this incident, because the migrateStake function did not check the oldStaking, the attacker could forge the oldStaking contract to add the balance arbitrarily.