Macauley Peterson

DeFi stalwart <a href="https://blockworks.co/tag/yearn-finance">Yearn Finance</a> was the target of a dizzyingly complex attack early Thursday that resulted in a roughly $11.6 million stablecoin haul for the culprit.&nbsp;



But the root cause dates back over three years, to a version of the savings protocol that has long since been officially abandoned.



At least $8 million in stablecoins remains in the hacker’s control, most of which has been swapped to DAI, with the remaining millions exchanged for ether (ETH) and partially passed to crypto mixer Tornado Cash in an effort to obfuscate its origin.



Yearn’s YFI governance token initially fell by roughly 5% on the news, but remains up nearly 80% year-to-date, <a href="https://www.coingecko.com/en/coins/yearn-finance">data</a> from CoinGecko shows.



Yearn’s official Twitter <a href="https://twitter.com/iearnfinance/status/1646436798086672385" target="_blank" rel="noreferrer noopener">confirmed</a> the exploit, noting that the affected vault is “an immutable contract predating YFI, [that] was deprecated in 2020.”



The attacker was able to take advantage of a vulnerability in the deployment of one of the early Yearn vaults involving tether (USDT) deposits, which receive a Yearn-equivalent token yUSDT, according to security researchers <a href="https://twitter.com/osec_io/status/1646411673299996673?s=20">Otter Sec</a>, s<a href="https://twitter.com/samczsun/status/1646404331967778820?s=20">amczsun</a> and <a href="https://twitter.com/peckshield/status/1646411259125063686?s=20">Peckshield</a>.



Using starting capital of just 10,000 USDT, the perpetrator was able to mint over 1.2 quadrillion yUSDT and then swap those for other stablecoins via Curve Finance to extract a total of $11.6 million.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">It appears the root cause is due to the misconfigured yUSDT, which is exploited to mint huge yUSDT (1,252,660,242,212,927.5) from a small $10K USDT. The huge yUSDT is then cashed out by swapping to other stable coins. <a href="https://t.co/Qz3vwtbcot">https://t.co/Qz3vwtbcot</a> <a href="https://t.co/xlsc2Nlmle">pic.twitter.com/xlsc2Nlmle</a>&mdash; PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1646411259125063686?ref_src=twsrc%5Etfw">April 13, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The attack vector is linked to an apparent oversight from February 2020, when the yUSDT token contract was <a href="https://twitter.com/samczsun/status/1646404331967778820?s=20">deployed</a> with a bug.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">It seems like the iearn USDT token (yUSDT) has been broken since deploy, which was *checks notes* over 1000 days ago. It was misconfigured to use the Fulcrum iUSDC token instead of the Fulcrum iUSDT token.<a href="https://t.co/FMtjACkGNz">https://t.co/FMtjACkGNz</a> <a href="https://t.co/dxW9E0ndF1">pic.twitter.com/dxW9E0ndF1</a>&mdash; samczsun (@samczsun) <a href="https://twitter.com/samczsun/status/1646404331967778820?ref_src=twsrc%5Etfw">April 13, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The detail identified by Samczsun regarding an apparent &#8220;misconfiguration&#8221; is notable, according to Ernesto Garcia, Smart Contract Engineer at OpenZeppelin.



&#8220;It seems weird to me that the Fulcrum iUSDC address is hard-coded,&#8221; Garcia told Blockworks. “If the contract went through a review, it was either an oversight (everyone assuming the correct address), or might’ve been changed before deployment as some tweets out there suggest.”



Garcia suggested that <a href="https://t.yesware.com/tt/252a1dc1b77e7be51bd66e941fd1524918eea58e/1a60fbe2d305cf2e708367f1e0c08e38/e94e47d69f2a91992ca74b120202aa20/blog.openzeppelin.com/improved-security-through-bytecode-verification/">bytecode verification</a> against the audited code from the time would determine whether there was any deliberate tampering.



Aside from the age of the bug, the execution of this attack required multiple steps, three different DeFi protocols, including Aave and <a href="https://blockworks.co/tag/flash-loans">a flash loan</a>.



<figure class="wp-block-image size-large"><img decoding="async" loading="lazy" width="1280" height="697" src="https://blockworks-co.imgix.net/wp-content/uploads/2023/04/Peckshield.jpeg?w=1024&amp;h=1024" alt="" class="wp-image-52056" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2023/04/Peckshield.jpeg?w=1280 1280w, https://blockworks-co.imgix.net/wp-content/uploads/2023/04/Peckshield.jpeg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2023/04/Peckshield.jpeg?w=1024 1024w, https://blockworks-co.imgix.net/wp-content/uploads/2023/04/Peckshield.jpeg?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2023/04/Peckshield.jpeg?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2023/04/Peckshield.jpeg?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2023/04/Peckshield.jpeg?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2023/04/Peckshield.jpeg?w=80 80w" sizes="(max-width: 1280px) 100vw, 1280px" /><figcaption class="wp-element-caption">Diagram of the flow of funds; Source: <a href="https://twitter.com/peckshield/status/1646421063176450048" target="_blank" rel="noreferrer noopener">Peckshield</a></figcaption></figure>



Aave itself is unaffected, meaning its users are not at risk, <a href="https://twitter.com/peckshield/status/1646412503583432704?s=20">according</a> to Peckshield, nor are users of more recent Yearn vaults.



The unknown attacker converted $1.2 million USDT to 621 ETH, and used exploited <a href="https://blockworks.co/price/tusd">TUSD</a> stablecoin as collateral in Aave V2 <a href="https://etherscan.io/tx/0x297d0a87f20c8e4753663a4548c9e69e2086b18aaf48520f07561cd396f97088">to borrow</a> a further 320 ETH ($640,000). Much of that ether has been deposited into the Tornado Cash 100 ETH anonymity set, blockchain records <a href="https://debank.com/profile/0x16af29b7efbf019ef30aae9023a5140c012374a5/history">show</a>.



A separate <a href="https://debank.com/profile/0x6f4a6262d06272c8b2e00ce75e76d84b9d6f6ab8">wallet</a> linked to the first received over 4.7 million DAI and 2.5 million USDC, with the latter swapped to DAI, where it remains as of 9:30 am ET.



Hackers prefer DAI and ETH over USDC and USDT because the centralized stablecoins from Circle and Tether are more easily frozen, preventing further transfer.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.



Follow Sam Bankman-Fried’s trial with the <a href="https://blockworks.co/tag/sbf-trial">latest news from the courtroom</a>.

Yearn Finance Exploit Points to Dangers of Old Smart Contracts

Shalini Nagarajan

Euler Finance intends to put out a $1 million bounty on the hacker who <a href="https://blockworks.co/news/euler-suffers-200m-exploit" target="_blank" rel="noreferrer noopener">stole</a> nearly $200 million from the DeFi platform earlier this week — unless they return nearly all of it.



“If 90% of the funds are not returned within 24 hours, tomorrow we will launch a [$1 million] reward for the information that leads to your arrest and the return of all funds,” Euler wrote in an on-chain <a href="https://twitter.com/0xngmi/status/1635769041909342208" target="_blank" rel="noreferrer noopener">message</a> to the hacker.



The bounty message followed a separate on-chain note sent on Monday: “We understand that you are responsible for this morning’s attack on the Euler platform. We are writing to see whether you would be open to speaking with us about any potential next steps.”



Earlier on Monday, hacker(s) had executed what’s known as a <a href="https://blockworks.co/news/flash-loans-expose-growing-gap-in-defi-insurance" target="_blank" rel="noreferrer noopener">flash loan attack</a>. These involve rapidly borrowing and returning crypto within one block while exploiting a smart contract vulnerability to receive an unintended amount of crypto.



In Euler’s case, the attack saw around $197 million <a href="https://twitter.com/FrankResearcher/status/1635241475989721089" target="_blank" rel="noreferrer noopener">siphoned</a> from its Ethereum-powered lending protocol — mostly wrapped staked ether along with smaller amounts of USDC, wrapped bitcoin, wrapped ether, DAI and <a href="https://blockworks.co/news/ethereum-twice-in-crypto-top-10" target="_blank" rel="noreferrer noopener">lido staked ETH</a>.



Independent researcher ZachXBT <a href="https://twitter.com/zachxbt/status/1635209310916743170" target="_blank" rel="noreferrer noopener">tweeted</a> that he was certain the attack was conducted by malicious hackers, “as they were exploiting some random protocol on [Binance Smart Chain] a few weeks ago” with funds deposited to Tornado Cash.



Euler states on its website that it had partnered with six security firms, but it appears those protections weren’t enough.



The vulnerability lay within the &#8220;donateToReserve&#8221; function in the Euler Pool contracts, according to blockchain security firm CertiK. 



This function is said to lack proper checks of the liquidity collateralization status, with the result being that users could willingly abandon a portion of the leveraged deposit, which would leave the pool insolvent.



“With assets borrowed from the flash loan, the attacker first created a highly leveraged insolvent position through the unique ‘mint’ function of the Euler lending protocol as well as the vulnerable ‘donateToReserves’ function within Euler’s pool contracts,” CertiK said. 



“The attacker then liquidates their position in the same transaction to gain a large amount of derivative eTokens before draining the pool through withdrawal. The attacker repeatedly calls the attacks on multiple Euler Pools to drain all of them.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.



Follow Sam Bankman-Fried’s trial with the <a href="https://blockworks.co/tag/sbf-trial">latest news from the courtroom</a>.

Euler Readies $1M Bounty on Crypto Hacker Who Stole $200M

Bessie Liu

Flash loan attacks are not common — but their consequences are dire.



Most recently, decentralized finance (<a href="https://blockworks.co/category/defi" target="_blank" rel="noreferrer noopener">DeFi</a>) lending and borrowing protocol <a href="https://blockworks.co/news/euler-suffers-200m-exploit">Euler Finance booked a $197 million loss</a> in a flash loan attack.



The attacker exploited a vulnerable code, Euler Labs, the team behind the Euler Finance protocol, said in a <a href="https://twitter.com/eulerfinance/status/1635431726364147712" target="_blank" rel="noreferrer noopener">tweet</a>, tricking it into believing there were fewer collateral tokens than debt tokens.



“As a result, the attacker was able to liquidate these underwater accounts and profit from the liquidation bonuses,” the company <a href="https://twitter.com/eulerfinance/status/1635431726364147712" target="_blank" rel="noreferrer noopener">tweeted</a>.&nbsp;



Hugh Karp, the founder of Nexus Mutual, a smart contract insurance company, told Blockworks that flash loans themselves —  where traders are able to borrow cryptocurrencies without any collateral and return assets within the same transaction — are not the problem.



“Flashloans sound sexy, but all flash loans do is allow a hacker to conduct the attack without having spare funds lying around,” Karp said. “The attack would have been exploitable without the use of flash loans.”



<a href="https://www.blockworksresearch.com/" target="_blank" rel="noreferrer noopener">Blockworks Research</a> analyst <a href="https://www.blockworksresearch.com/research?author=ren" target="_blank" rel="noreferrer noopener">Ren Yu Kong</a> said that, ultimately, a fundamental vulnerability exists within the smart contract for a flash loan attack to happen.&nbsp;



“Flash loan attacks are as preventable as any other attack vector, and at the day it still requires developers to go through various security audits and take into account flash loans as an attack vector when writing the code,” Kong said.



The real problem, though, according to Karp, is whether humans are capable of creating secure software free of defects. 



“While that&#8217;s possible, it is quite difficult as even the most security-focused teams, such as NASA and teams within the aviation industry, struggle with this,” Karp said.



Even if DeFi security continues to improve, the possibility of failure is rather inevitable — at some point.&nbsp;



“DeFi cover providers have to be very careful with their risk selection and in their risk management practices, like setting exposure limits and adequately pricing risk. There are no shortcuts,” Karp said.



Jesse Pollack, Coinbase’s protocol lead, said in a <a href="https://twitter.com/jessepollak/status/1635418569159897088" target="_blank" rel="noreferrer noopener">tweet</a> that in order to prevent further attacks, “better insurance primitives and coverage need to be a part of the solution.”



Existing DeFi insurance is underpriced, according to Kong — considering it’s often marketed as yield, though the costs associated with an insurance premium could potentially outweigh the downside protection it provides.



“That&#8217;s a combination of exploits in DeFi generally being all or nothing — if a protocol gets exploited, more often than not everything is gone — and a much higher percentage chance of an exploit occurring than insurance underwriters price,” Kong said.&nbsp;



Another solution, a Twitter user who goes by Duncan <a href="https://twitter.com/wrapped_dday/status/1635438078113505280" target="_blank" rel="noreferrer noopener">said</a>, is bringing in more audits to cover soft exploits, adding that there are a “ton of different examples right now” along those lines.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.



Follow Sam Bankman-Fried’s trial with the <a href="https://blockworks.co/tag/sbf-trial">latest news from the courtroom</a>.

Flash Loans Expose Growing Gap in DeFi Insurance

Sebastian Sinclair

<div id="highlights-block_6318600a68459" class="highlights">
 <ul>
 <li>The flash loan is said to have generated hundreds of thousands of dollars worth of USDC for the attacker</li>
 <li>DEX Trader Joe, staking platform Nereus Finance and AMM Curve Finance are believed to have been affected</li>
 </ul>
 
</div>



A flash loan attack on the <a href="https://cms.blockworks.co/tag/avalanche/" target="_blank" rel="noreferrer noopener">Avalanche</a> blockchain has extracted $370,000 in USDC from a smart contract, as well as several liquidity providers, blockchain cybersecurity firm CertiK said Tuesday.



Decentralized exchange Trader Joe, staking platform Nereus Finance and automated market maker Curve Finance are thought to have been impacted, the firm said in a <a href="https://twitter.com/CertiKAlert/status/1567314528357990401?s=20&amp;t=H0Sq29gTMSLHgPJHZYaMWw" target="_blank" rel="noreferrer noopener">tweet</a>.



A flash loan exploit is an abuse of a smart contracts security whereby a nefarious actor typically borrows uncollateralized funds from a lending protocol and manipulates the price of a given asset, driving up its value.&nbsp;



Because of the nature of a flash loan, the attacker then sells back the borrowed capital in the same transaction after they’ve managed to arbitrage the asset, pocketing the difference.



The attack, executed around 3:26 pm ET on Tuesday, was picked up by CertiK’s on-chain security software Skynet which actively monitors and displays suspicious smart contract data online.



Blockworks attempted to contact CertiK and Avalanche but did not receive a response by press time. The identity of the attacker, as in the majority of cases involving flash loan exploits, remains unknown.



Avalanche, a layer-1 smart contract platform built by Singapore-based Ava Labs, has risen to prominence in recent years, having grown to become a top 20 crypto in market cap terms.



Compatible with Ethereum, the Avalanche network consists of an ecosystem of decentralized application as well as staking initiatives via its proof-of-stake consensus mechanism.



Flash loans have been involved in several high-profile crypto heists before, including the third-largest of 2022, when DeFi dapp <a href="https://cms.blockworks.co/the-nine-largest-crypto-hacks-in-2022/" target="_blank" rel="noreferrer noopener">Beanstalk lost</a> $182 million.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.



Follow Sam Bankman-Fried’s trial with the <a href="https://blockworks.co/tag/sbf-trial">latest news from the courtroom</a>.

Avalanche Flash Loan Attack Nets $370K

Sam Reynolds

<div id="highlights-block_617a76923229f" class="highlights">
 <ul>
 <li>Another flash loan exploit hits Cream Finance, this time for $130 million</li>
 <li>Flash loan exploits involve clever arbitrage plays that drain the protocol’s liquidity pools of their assets, devaluing the token for users</li>
 </ul>
 
</div>



Late Wednesday, <a href="https://twitter.com/peckshield/status/1453364046904786950" target="_blank" rel="noreferrer noopener">Blockchain security provider Peckshield</a> identified that a flash loan attack was underway against DeFi lending platform <a href="https://cream.finance/" target="_blank" rel="noreferrer noopener">Cream Finance</a>, with attackers attempting to pilfer Cream liquidity provider tokens. In total, $130 million was stolen, according to on-chain data. This comes after two other successful attacks earlier this year, which saw hackers nab $37.5 million in February and $18.8 million in August.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Our Ethereum C.R.E.A.M. v1 lending markets were exploited and liquidity was removed on October 27, 1354 UTC. The attacker removed a total of ~$130m USD worth of tokens from these markets, using this address: <a href="https://t.co/17sPIDpCmr">https://t.co/17sPIDpCmr</a> No other markets were impacted.&mdash; Cream Finance 🍦 (@CreamdotFinance) <a href="https://twitter.com/CreamdotFinance/status/1453455806075006976?ref_src=twsrc%5Etfw">October 27, 2021</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Cream is affiliated with DeFi stalwart <a href="https://yearn.finance/" target="_blank" rel="noreferrer noopener">Yearn Finance</a>, as a result of <a href="https://medium.com/iearn/yearn-cream-v2-merger-e9fa6c6989b4" target="_blank" rel="noreferrer noopener">a 2020 &#8216;merger&#8217;</a>, but the much larger Yearn family of products was unaffected, according to the group&#8217;s Twitter feed.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Yearn products are not affected by Cream Finance attack. Our engineers are assisting Cream with investigation of the exploit.&mdash; yearn.finance (@iearnfinance) <a href="https://twitter.com/iearnfinance/status/1453397867675201537?ref_src=twsrc%5Etfw">October 27, 2021</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<h3 class="wp-block-heading">What is a flash loan exploit?</h3>



Flash loan attacks exploit one of the key pillars of DeFi: the ability to obtain leverage without collateral. Flash loans seek to nullify the defining fear of the credit market — the borrower will run off with the money, leaving the lender empty-handed. Sure, collateral like a house as part of a mortgage would partially eliminate this risk, but needing to post collateral to obtain credit is by its nature exclusionary and, for the world of digital assets, might not work as it would require the participation of lenders that are hostile to crypto.



So, the DeFi and digital assets industry has invented the flash loan. This is a specific type of loan which, via the underlying smart contract, allows the borrower to obtain credit, complete a transaction with said credit (the most common of which is to utilize arbitrage opportunities), and then repay the loan all within the same transaction on the blockchain.



<figure class="wp-block-image"><img decoding="async" src="https://lh5.googleusercontent.com/d5XJde__ztZHWHU4dm-r-M_EMBRCd0yO5Ii5yOZRC-lwR1KNP0o83_DcyHe9FPX6Ii8SbAt29qAauXAkRvP7V8p0RJtjNZ-p3kcJC23JSI8QYhUra5K4FPc5TJJmR9_tfY9-qoRy" alt=""/><figcaption>A flash loan attack in progress; Source: Ethexplorer</figcaption></figure>



Should any part of the process fail, the entire transaction will be reverted, thereby undoing the loan — meaning that, in theory, the lender has no risk — provided that the smart contract which controls the whole operation has code strong enough to withstand adversarial scrutiny.&nbsp;



A flash loan attack occurs when the borrower manipulates the markets as the loan is taking place, driving the value of the borrowed token underwater thanks to excess slippage, and then allowing the attacker to buy back the token at a deflated price. Because the slippage and price deflation is limited to one market, the attacker is free to sell the tokens on other markets for the real price and pocket the profits.



Technically, this particular exploit was quite complex, involving multiple Ethereum wallets and <a href="https://twitter.com/Mudit__Gupta/status/1453401698563596293" target="_blank" rel="noreferrer noopener">dozens of discrete steps</a>. The attacker is now in the process of <a href="https://twitter.com/peckshield/status/1453400696330481668?s=20" target="_blank" rel="noreferrer noopener">laundering the stolen funds</a>.



<h3 class="wp-block-heading">How many DeFi attacks have occurred in 2020?</h3>



According to various leaderboards such as <a href="https://rekt.news/leaderboard/" target="_blank" rel="noreferrer noopener">Rekt’s DeFi hack list</a>, there has been over $500 million in theft from different kinds of DeFi hacks like flash loan exploits during 2021 including this most recent one from Cream Finance. In total, there has been approximately $1.2 billion stolen from DeFi protocols since the inception of the industry, <a href="https://cryptosec.info/defi-hacks/">according to CryptoSec.info</a>.



SEC Chair Gary Gensler has <a href="https://cms.blockworks.co/sec-reportedly-could-look-to-regulate-defi-projects/" target="_blank" rel="noreferrer noopener">repeatedly said</a> that regulation of the DeFi sector is coming under the guide of consumer protection, and it&#8217;s only a matter of time before regulation is implemented. Cream Finance’s token recovered during the Asia trading day as the market digested news of the exploit, but remains down 25% over the past 24 hours, <a href="https://www.coingecko.com/en/coins/cream" target="_blank" rel="noreferrer noopener">according to Coingecko</a>.