MUSystem’s deposit() counted the first-deposit bonus in both the immediate ETH refund and the user’s MUS allocation, while withdraw() allowed same-transaction redemption without capping returned ETH to the amount deposited. Sixteen fresh addresses repeated this cycle and drained ETH from the contract, causing about $36,900 in losses.