A withdrawal rule failed in BitBay’s vault, while EtherVista’s swap reserve check was bypassed. SlowMist linked the fund losses to two separate contract flaws on October 9.
Blockchain security firm SlowMist reported two attacks on October 9 involving a BitBay DeFi vault and an EtherVista liquidity pool. Its incident records put the losses at approximately $14,000 for BitBay and $18,600 for EtherVista. The reports concern separate contracts and different types of fault.
A minimal share unlocked the BitBay vault balance
The BitBay alert concerns UsdcDaiV4Vault, a DAI/USDC vault on Polygon. According to SlowMist, its withdrawal function sent the smart contract’s entire token balance when liquidity reached zero, instead of limiting the payment to the withdrawing user’s share.
The attacker used the vault’s repositioning function to bring liquidity to zero, then redeemed just one minimal share unit to withdraw about 14,838.47 DAI.
SlowMist’s alert covers this Polygon vault. It does not identify losses in other products sharing the BitBay name or across a cryptocurrency exchange’s entire holdings.
SlowMist’s October 9 alert on the BitBay vault
The post loads from X when you open it.
EtherVista’s reserve check failed
The EtherVista flaw arose in a calculation used to check the pool’s reserves after a swap. SlowMist said multiplying the two reserves inside EtherVistaPair.swap() exceeded the range of their integer type and wrapped to an incorrect value. The check could therefore accept a swap even when the actual reserve product had fallen sharply.
According to the security firm, an attacker-controlled contract was registered as an authorised router. Two crafted swaps then removed WETH and VISTA from the pool. SlowMist estimated the pool’s loss at approximately $18,600.
SlowMist’s October 9 alert on the EtherVista pool
The post loads from X when you open it.
Loss estimates and unanswered questions
The 14,838.47 DAI reported for BitBay is a token amount. The roughly $14,000 figure is SlowMist’s valuation estimate. The token quantity and the dollar loss estimate are separate measures.
SlowMist published transaction links and addresses for the attacker and affected contract in each case. The findings come from the firm’s initial investigation. The alerts do not specify how many users suffered losses, whether the faults have been fixed or whether a reimbursement plan exists.
SlowMist listed different attacker addresses for the two incidents. Its alerts do not establish whether those addresses were controlled by the same person.
