The StepHeroNFTs claimReferral function was vulnerable to reentrancy, allowing an attacker to repeatedly trigger transfers before state updates. The attacker drained approximately 90K USD in a single transaction.