YieldCore RWAVault Unauthorized Withdraw via Missing ERC4626 Allowance Check

On April 28, 2026, YieldCore's Ethereum RWAVault lost 398,655.47 USDC because overridden ERC4626 withdraw and redeem paths burned owner shares without requiring caller authorization or allowance.