BitBay
Oct 8, 2026
BitBay’s vault contained a vulnerability in _withdraw() that transferred the contract’s entire token balance whenever liquidity == 0, without restricting withdrawals to the user’s proportional entitlement. 47 DAI belonging to the vault.
How the exploit worked
View reproducible PoCthe UsdcDaiV4Vault _withdraw liquidity==0 branch pays the vault entire DAI and USDC balance to the caller with no share-weighted cap, and reposition() is permissionless once the tick is outside the narrow LP range, so the attacker deposits one wei for a single share, swaps the Uniswap v4 pool to push the tick onto tickUpper, calls reposition to recompute a position whose liquidity rounds to zero and leaves the pooled funds as raw balance, then redeems that one share to sweep the whole 14838 DAI pool.
Lost: 14838.466608989135865711 DAI swept from the vault by a single 1-wei share on Polygon (reproduced to the wei against the on-chain Withdrawn amount), the attac…
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Protocol Logic
- Technique
- Withdrawal Logic Flaw
- Attribution
- Unknown
- Chains
Event timeline
- Oct 8, 2026Exploit executed — $15K drained via withdrawal logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)