On April 15, 2024, ChaingeFinance on BSC was exploited via arbitrary external call in the swap function. Both the target contract and callData parameters were controllable, allowing attackers to execute unauthorized transferFrom calls on victim accounts, draining all approved tokens.