On June 19, 2025, old BankrollStack contracts containing an integer underflow vulnerability in the sell() function were exploited. Attackers manipulated dividend accounting through lingering token approvals, draining funds from users who had previously interacted with the abandoned contracts.