OWNLY's unstake function lacked claim status validation, allowing attackers to repeatedly call unstake() and extract 930M OWN tokens without authorization. The staking contract was drained of ~$37K in BNB equivalent before discovery.

The ownlyio project's NFTStaking contract was attacked, with a total of 115 BNB stolen and a loss of about $36,418. The reason for this attack is that the unstake function of the pledge contract of the ownio project does not check the user's claim status, so the attacker can use the unstake function to receive the own tokens in the contract infinitely, thereby extracting all the own tokens in the pledge contract, and finally the attacker The acquired owned tokens are exchanged for 115 BNB through the pair transaction.