Submitted by WatchPug, also found by gzeon
Zap.sol L216-L238
In the current implementation of. Zap.sol#redeem(), the outAmount of IbyvWbtc.withdraw() is not controlled by minOut.
Consider implementing the minOut check in between L236 and L237.
GalloDaSballo (BadgerDAO) confirmed:
