Abusing feature to steal your tokens