Disclosures
Security research and coordinated vulnerability disclosures. Everything here was reported to the affected party and published after remediation or an agreed disclosure window.
critical · 1
2026
1 entry- critical fixed CVSS 9.1
Reentrancy in ExampleVault.withdraw() allows draining of share reserves
A missing state update before an external call lets an attacker re-enter withdraw() and redeem the same shares repeatedly, draining the vault's underlying reserves.