A user of Alchemix's Yearn yvVault has suffered a $1 million loss following an unauthorized contract attack. On-chain analyst PeckShield identified that the breach occurred after the user approved an unverified contract, deployed 10 days prior, which contained a vulnerability allowing arbitrary call execution. The attacker exploited this flaw to transfer the user's yvVault position. PeckShield has disclosed the vulnerability's logic and advises users to revoke token approvals to unverified contracts to protect their assets.