Exactly Protocol's DebtManager on Optimism was exploited on August 18, 2023 when unvalidated market address parameter allowed attacker to bypass permit checks and reenter crossDeleverage to steal users' deposited collateral. A copycat repeated the attack the same day.