The attack was enabled by a user misconfiguring the decimals places for PAXG relative to USDC. Source link Share