Share/asset conversions round in the user's favor (mint rounds up, redeem rounds up) rather than the protocol's. Repeated deposits/withdrawals extract a wei of value each time, slowly draining the pool via rounding dust.
// each redeem rounds up by 1 wei in the user's favor. // attacker loops deposit/redeem thousands of times, skimming dust // until the vault is measurably short.
// mint shares: round DOWN; redeem/withdraw assets owed: round DOWN to protocol
shares = assets.mulDiv(supply, totalAssets, Math.Rounding.Floor);
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0217 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.