JHY Token's TokenDividendTracker contract had a critical flaw where it set user balances to the LP token balance, allowing users to swap more tokens than they owned. This accounting error enabled attackers to drain funds by exploiting the incorrect balance tracking.