On 2020-11-17 at 00:47:19 UTC an attacker exploited a flash-loan-funded reentrancy in OUSD VaultCore's mint function to inflate totalSupply. The contract failed to validate the transferred-in asset and lacked reentrancy protection, allowing the attacker to redeem against the inflated supply and drain the vault.