Shezmu's vault contract vulnerability allowed unauthorized minting of ShezUSD stablecoin without collateral, bypassing required checks and enabling attackers to mint unlimited ShezUSD and borrow assets to drain $4.9M. After negotiation, 80% was recovered.