BasketDAO's BMIZapper contract lacked input validation in the _primitiveToBMI function, allowing arbitrary external calls. The attacker passed a malicious address to drain all approved crypto assets held by the contract.