SlowMist reported an attack on BitBay that resulted in losses of about $14,000.

Foresight News attributes the issue to the Vault's withdraw() function, which transfers the contract's full token balance when liquidity is zero instead of restricting redemptions to the caller's share.

The attacker used reposition() to drive liquidity to zero, then redeemed a single minimum share unit and withdrew roughly 14,838.47 DAI.