On May 29, SlowMist reported that a vulnerability in the ONTR token contract's onlyOwner modifier allowed for access control bypass. When owner == address(0), any address could pass the permission check. Prior to the attack, the owner address had been set to zero. The attacker exploited this vulnerability by calling transferOwnership() to set the ownership to their contract, then called desertJasper() to add hidden balances to the queue, and finally executed glenFlash() to run ashBud(), increasing the balance of that address to 1e30 base units without increasing the totalSupply. Subsequently, the attacker transferred these 'generated' tokens to a standard PancakePair and exchanged them for assets from a legitimate WETH liquidity pool via swap(). The attacker manipulated account balances and minted tokens without cost due to the access control vulnerability in the token contract, stealing WETH from a legitimate automated market maker (AMM) liquidity pool. The attack resulted in a loss of 49.4801 WETH, approximately $98,315.16.