Yearn asks for money back after it accidentally loses part of its treasury

The incident happened after a “faulty multisig script” swapped Yearn’s entire treasury balance

article-image

Andre Cronje/Shutterstock modified by Blockworks

share

Updated Dec. 13, 2023 at 1:33 pm ET: Modified headline and context following Yearn clarification.

Thanks to a script error, Yearn lost part of its treasury.

While it initially posted that it lost 63% of the treasury, it corrected its GitHub post to say that it lost “63% of the LP value.” The clarification was made Wednesday after Blockworks published the initial figures.

“When factoring in the 779,958 yvDAI tokens received from this trade, the total loss experienced by Yearn’s treasury comes out to about 63%,” the post said initially.

This loss occurred when a malfunction in a multisig (multi-signature) script led to the unintended swap of Yearn’s treasury balance.

The company clarified that the funds were strictly from Yearn’s treasury, and not from any customer funds.

According to a post, a “faulty multisig script caused Yearn’s entire treasury balance of 3,794,894 lp-yCRVv2 tokens to be swapped.” The incident happened on Dec. 11. 

“This amount comprised a large portion of the Curve pool, and therefore incurred significant slippage which arbed back to the normal price by the market shortly after,” Yearn wrote.

“When factoring in the 779,958 yvDAI tokens received from this trade, the total loss experienced by Yearn’s treasury comes out to about 63%.”

The DeFi protocol is also asking “anyone who profitably arbed this mistake to return an amount that they feel is reasonable to Yearn’s main multisig ychad.eth.”

The post explained that multiple oversights led to the faulty transfer. The entire treasury balance, including fees, was transferred to the trading multisig, which sent the transaction to CoW Swap for 30 or so orders — including the one to swap the balance. 

Read more: Sorella and CoW Protocol have something in common: Making on-chain exchanges work better

The post said that the high volume of trades involved in this single transaction significantly complicated the process of human review, leading to the oversight not being caught in time.

“The script used by the trading multisig to swap tokens lacked sufficient output checks and contained a logical error that would have capped the trade size to a reasonable amount,” Yearn wrote.

The protocol put new checks in place to prevent the same error from happening again. These include segregating protocol-owned liquidity (POL) funds into separate entities, enhancing trading scripts with more human-readable output messages, and imposing “stricter price impact thresholds” during trades.

Earlier this year, Yearn was targeted in an attack. The attacker was able to make off with roughly $11 million in stablecoins. 

The attack happened when a vulnerability in a Yearn vault was exploited, allowing the attacker to access tether (USDT) deposits.

Using 10,000 USDT, the attacker then minted 1.2 quadrillion yUSDT — the Yearn-equivalent token — and swapped them for stablecoins using Curve Finance to bag $11.6 million.


Don’t miss the next big story – join our free daily newsletter.

Tags

Upcoming Events

Hilton Metropole | 225 Edgware Rd, London

Mon - Wed, March 18 - 20, 2024

Crypto’s premier institutional conference returns to London in March 2024. The DAS: London Experience: Attend expert-led panel discussions and fireside chats Hear the latest developments regarding the crypto and digital asset regulatory environment directly from policymakers and experts.

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

Research report - cover graphics (1).jpg

Research

In this report, we dive into crypto private market data to gather insights on where the future of the industry is headed. Despite a notable downturn in private raises, capital continues to infuse promising projects that aim to transform payments, banking, consumer experiences, community, and more, with 2023 being the fourth-largest year for crypto venture capital.

article-image

BUZZ holds shares of Coinbase, Robinhood and MicroStrategy

article-image

Opinion: Even though I didn’t pay for my “Diamond Hands” burger with BTC, don’t let that fool you into thinking that crypto’s development is futile

article-image

The results mark “a major positive inflection point,” one analyst says, as the exchange carries net income momentum into a crypto rally

article-image

While the slate of 10 US spot bitcoin funds have tallied $4.6 billion of net inflows thus far, half of the field is lagging the leaders

article-image

Trading volumes totalled $154 billion in Q4, including $125 billion in institutional volume

article-image

DeFi on Bitcoin is all the rage right now and Stacks is positioned to benefit