The wRAM token contract had a reentrancy vulnerability in the buyram function. When wram::buyram was called multiple times simultaneously, the asynchronous call to eosio::buyram caused the same RAM bytes value to be used across multiple calls, allowing minting of more tokens than intended.

The wRAM of the EOS ecological DeFi liquidity mining project Coral was attacked by hackers and lost more than 120,000 EOS.