FEG's swapToSwap() function lacked input validation on the 'path' parameter, allowing attackers via flashloan to gain unlimited allowance and drain contract assets. Multiple attacks on May 15-16 extracted ~$1.3M + $1.9M total across ETH and BSC networks.