It is not a bug. It is complete lack of Byzantine fault tolerance. A bug is an implementation error. This is a holistic design error. There is no design. Virtual synchrony is his claimed method. Virtual synchrony does not provide Byzantine fault tolerance.
What more is there for me prove? You are asking me to prove a dog isn't a cat. Isn't it obvious a dog is not a cat.
You are right, virtual synchrony does not provide Byzantine agreements, indeed. The white paper and the explanations in the Vanilla coin topics are also a bit sketchy without too many details. Some more details about the locking mechanism would be nice.