Yearn.Finance (YFI) DeFi Was Vulnerable to Flash Loan Attack; Are Funds SAFU? – U.Today


Banteg (@bantg), a core developer of Yearn.Finance (YFI) DeFi ecosystem, shares the details of hypothetical attack against the elements of its protocol that were unveiled by a white-hat hacker.
As per the tweets by Banteg, on Jan.30 2022, a white-hat hacker reported the scenario of an attack against SingleSidedBalancer strategy, an element of Yearn.Finance’s yield farming toolkit.
Yearn has paid a $200,000 bounty to a whitehat who has responsibly disclosed a vulnerability via @immunefi.

Read the vulnerability disclosurehttps://t.co/5rTpkCg7IJ

Learn about our security bounty programhttps://t.co/F3VAdJzyeX
SingleSidedBalancer strategy (or SSB) is designed to allow DeFi enthusiasts to farm Balancer’s native currency BAL providing single-asset liquidity. SSBs are active on Ethereum (ETH) and Fantom (FTM) blockchains.
The attack design was used to allow hackers to imbalance the Balancer pool and obtain USDT at an inflated price as only SSB strategy on yvUSDT was found to be profitably exploitable.
Through a series of flash loans with USDC and DAI, an attacker could drain Yearn.Finance’s liquidity pool for more than $41 million in equivalent.
As per the detailed explanation shared in Yearn.Finance’s security repository on GitHub, the vulnerability was patched in 25 minutes as all exploitable elements were disabled; no funds are at risk now.
By Feb.11, all vulnerable strategies were updated by Yearn.Finance and Balancer. As the possible vulnerability is of a ‘Critical’ category, on Feb. 2 the white-hat attacker was rewarded with a 200,000 USDC bounty bonus.
As covered by U.Today previously, on Feb.10, the team of the Optimism scaling solution for Ethereum (ETH) paid $2 mln to Mr. Jay Freeman who unveiled the flaw in Optimism smart contracts that would have allowed minting an infinite amount of Ether in every wallet.

Related
Jailbreak Veteran Discloses a Bug in Optimism: It Was Possible to Create Infinite ETH!

Similar bounty reward was transferred to a potential Polygon (MATIC) attacker in October, 2021.

Blockchain Analyst & Writer with scientific background. 6+ years in IT-analytics, 3+ years in blockchain.
Worked in independent analysis as well as in start-ups (Swap.online, Monoreto, Attic Lab etc.)
Disclaimer: Any financial and market information given on U.Today is written for informational purpose only. Conduct your own research by contacting financial experts before making any investment decisions.

source


Leave a Reply

Your email address will not be published. Required fields are marked *