WebKeyDAO's buy() function lacked proper access controls, allowing an attacker to purchase WKEYDAO tokens at artificially low prices set via an unprotected setTokenInfo() call. The attacker exploited this to acquire tokens at 1/10th market price and immediately sold them on DEX for profit, limited only by a built-in 67-token sale cap.