What happened
On October 9, 2026, BitBay’s UsdcDaiV4Vault on Polygon was exploited for approximately ~$14,800 USD (14,838.47 DAI ) due to an edge-case logic flaw in _withdraw() that transferred the contract's entire DAI balance when vault liquidity equaled zero.
The vulnerability existed in BitBay's DAI/USDC vault contract (0x048E...) within its internal _withdraw() function. The logic contained a faulty check: when vault liquidity == 0, it transferred the entire token balance held by the vault contract directly to the caller instead of capping the payout to the user's proportional share holding. The attacker executed reposition() to force the vault into a zero-liquidity state, then redeemed just 1 minimal share unit.
This triggered the zero-liquidity withdrawal branch and allowed the attacker to extract the entire balance of 14,838.47 DAI.
Attack Transaction Hash: 0x5b795dc5…4a7ff2
Attacker Address: 0x59Ae3c8d…e9884B
Vulnerable Contract: 0x048E8831…F2e5A0 (UsdcDaiV4Vault)
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
