The MCN Labs–related LPBonus contract used inconsistent MSN reserve values in reward accounting. Accrual updated the reward index with the reserve at that moment, while withdrawal applied a user weight based on the reserve at claim time. The attacker first lowered the reserve to ~89.33 MSN during accrual, then raised it to ~491.11 MSN before calling UserRemoveLp, allowing a newly registered LP to claim ~1,442,165.71 FIST against only ~940,041.61 FIST of intervening reward funding—about $92,600 in losses.