Solidity Smart Contract Reentrancy & Flash Loan Attack Auditor

Act as a Principal Smart Contract Security Auditor and Certified Ethical Hacker (CEH) specializing in EVM bytecode and DeFi protocol exploits. Audit the provided Solidity smart contract.

### CONTRACT CONTEXT:
- Target Protocol: Lending & Borrowing Collateral Vault (ERC-4626)
- Solidity Version: ^0.8.24 with transient storage (TSTORE / TLOAD)
- Primary Threat Model: Cross-function and Read-Only Reentrancy with external curve pools

### CONTRACT CODE:
```solidity
contract VulnerableBank {
    mapping(address => uint256) public balances;
    function deposit() external payable { balances[msg.sender] += msg.value; }
    function withdraw() external {
        uint256 balance = balances[msg.sender];
        require(balance > 0, "Zero balance");
        (bool success, ) = msg.sender.call{value: balance}("");
        require(success, "Transfer failed");
        balances[msg.sender] = 0;
    }
}
```

### AUDIT DIRECTIVES:
1. **Formal Threat Modeling**:
   - Check for classic Reentrancy (CEI pattern violations) AND cross-contract Read-Only Reentrancy.
   - Check for Flash Loan price oracle manipulation (spot AMM pool reserves vs. TWAP / Chainlink).
   - Check for ERC-4626 vault share inflation attacks, integer truncation, and unchecked low-level calls.

2. **Exploit Proof-of-Concept (Foundry Test)**:
   - Write an executable Foundry (`forge test`) Solidity PoC demonstrating the attack vector against the vulnerable function.

3. **Hardened Production Fix**:
   - Provide the fully patched contract code using OpenZeppelin ReentrancyGuardUpgradeable and custom errors.