TokenHolder suffered an insufficient access control vulnerability where unauthorized callers could invoke restricted functions. The attacker exploited missing permission checks in the contract to drain approximately $26K from the protocol.