Flow said a Cadence runtime type confusion bug enabled a $3.9M exploit, allowing forged tokens without compromising user balances.