Poolz Finance was exploited through an integer overflow vulnerability in the unaudited LockedControl contract. The attacker manipulated the CreateMassPools function and GetArraySum method to trick the vesting contract into believing large amounts were deposited while actually depositing minimal tokens.