A critical initialization bug in the 88mph NFT contract allowed anyone to call initialize() multiple times, enabling arbitrary contract owner takeover and unrestricted NFT minting. An attacker could have stolen all underlying assets by minting/burning user NFTs. Reported via Immunefi with $42,069 bounty; 88mph patched within 2 hours.