Submitted by shenwilly, also found by 0x52, Kumpa, unforgiven, pedroais, MiloTruck, and pauliax
https://github.com/code-423n4/2022-05-rubicon/blob/8c312a63a91193c6a192a9aab44ff980fbfd7741/contracts/rubiconPools/BathPair.sol#L533-L563
https://github.com/code-423n4/2022-05-rubicon/blob/8c312a63a91193c6a192a9aab44ff980fbfd7741/contracts/rubiconPools/BathToken.sol#L343-L369
Strategists can call tailOff with malicious payload to steal all funds within any BathToken.
There are 2 issues that makes this possible:
These allow malicious strategists to input any token address, including the underlying token of a BathToken, and transfer them to a contract of their choosing.
A malicious strategist calls tailOff with the following payload:
bathUSDC BathToken will then send all USDC to the strategists maliciousContract. All deposits are lost.
bghughes (Rubicon) acknowledged, but disagreed with severity 
HickupHH3 (judge) decreased severity to Medium and commented:
bghughes (Rubicon) commented:
