A critical vulnerability in Mezo's ERC-20 bridgeOut precompile allows an attacker to repeatedly drain the Layer 1 bridge without reducing their Mezo balance. This occurs due to a state management flaw where inner StateDB burns are overwritten by stale outer StateDB storage, restoring the attacker's balance and allowance while the bridge unlock event is recorded and triggers token release on L1. The flaw enables repeated full drains of bridged ERC-20 tokens such as USDC on Ethereum mainnet. A fixed version (8.0.0) has been deployed.