YieldCore's RWAVault overrode ERC4626 withdraw() and redeem() functions but removed the standard authorization check when msg.sender ≠ owner. Any caller could specify an arbitrary depositor as owner and direct withdrawn assets to an arbitrary receiver. An attacker drained 392,764 USDC of principal from eight depositors across multiple calls.