SlowMist Team said a vault contract tied to DeFi project BitBay was exploited, resulting in a loss of about $14,000 in DAI. According to the disclosure, the bug appeared when liquidity dropped to zero: the contract’s _withdraw() function transferred the full token balance instead of capping the payout to the user’s proportional share. The attacker allegedly used reposition() to force the vault into a zero-liquidity state, then redeemed just one minimum share unit to drain funds. SlowMist put the stolen amount at about 14,838.47 DAI. The attacker address was identified as 0x59Ae3c8dd50063429D86BdaEBbC350fB64e9884B, while the affected contract address was listed as 0x048E88311ca84876aeA086125825492e2AF2e5A0. The disclosure was cited by Techub News.
Techub News reported, citing @SlowMist_Team, that a vault contract in DeFi project BitBay was exploited, causing a loss of about $14,000 in DAI.
How the flaw worked
According to the disclosure, the issue came from the contract’s _withdraw() function. When liquidity was zero, the function transferred the entire token balance instead of limiting the payout to the user’s proportional share.
The attacker used reposition() to trigger a zero-liquidity state, then redeemed only one minimum share unit and stole about 14,838.47 DAI.
Addresses disclosed
The attacker address was 0x59Ae3c8dd50063429D86BdaEBbC350fB64e9884B. The affected contract address was 0x048E88311ca84876aeA086125825492e2AF2e5A0.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
