JokInTheBox staking contract had an unstaking vulnerability where the state variable was not properly checked, allowing attackers to unstake multiple times from the same balance. Exploiter continuously withdrew funds, draining ~$34K from affected users.