DODO's V2 Crowdpooling contract left init() callable after funding, allowing an attacker to reconfigure pools with worthless tokens and drain the real reserves. Around $3.8M was taken, but $3.1M was returned within a day as MEV bots captured most of the exploit profit.