A smart contract vulnerability in a tranche vault protocol on the Avalanche network enabled an attacker to extract over $1.01 million in USDC using a flash loan share manipulation scheme.