Share-to-asset price is derived from a manipulable on-chain balance (token.balanceOf(vault)). An attacker donates or flash-borrows to move the ratio, minting or redeeming shares at an unfair rate.
uint256 price = internalTotalAssets * 1e18 / totalShares; // internal accounting
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.