After spending 2min on it and using this hint from the article:
> The affected pool contract had an initialize() function that should have been activated after deployment.
> The line: initialized = true; is missing from the function.
That's really the crux of the issue. Have a look at the `initialize()` function. It's meant to be called only once (that's why it uses the modifier `notInitialized`), right after the smart contract is deployed, and never again. But the `initialized` variable is never set to true, meaning that it can be called again, and it seems that's what the attacker did.
...so for those who expected something fancy and technically advanced, that's not for you.
The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091...
After spending 2min on it and using this hint from the article:
> The affected pool contract had an initialize() function that should have been activated after deployment.
> The line: initialized = true; is missing from the function.
That's really the crux of the issue. Have a look at the `initialize()` function. It's meant to be called only once (that's why it uses the modifier `notInitialized`), right after the smart contract is deployed, and never again. But the `initialized` variable is never set to true, meaning that it can be called again, and it seems that's what the attacker did.
...so for those who expected something fancy and technically advanced, that's not for you.