#QnQSec

This writeup explains how the Timelock contract in QnQSec 2025 could be bypassed by abusing ERC-20 allowances. While the timelock blocked direct transfers from the player, it didn’t restrict transferFrom, allowing an attacker to drain the player’s tokens through an approved spender.