Read

Glitch

Safety

In a significant setback for <a href="https://coingape.com/yearn-finance-yfi-price-declines-amid-soaring-whale-activity/" rel="noopener noreferrer nofollow">Yearn Finance</a>, a leading player in the decentralized finance (DeFi) sector, a script malfunction in its multisig (multi-signature) system led to a substantial loss of its treasury assets. The incident on December 11 resulted in the unintended swap of Yearn’s treasury balance, amounting to a loss of approximately 63%.
The company confirmed that the loss affected only the treasury funds and did not impact customer funds. The mishap involved the accidental exchange of 3,794,894 <a href="https://coingape.com/yearn-vaults/" rel="noopener noreferrer nofollow">lp-yCRVv2 tokens </a>from Yearn’s treasury. This transaction, executed on CoW Swap, led to significant market slippage due to the large volume involved, further exacerbating the loss.
<h2 id="strong-yearn-finance-treasury-error-triggers-huge-loss-strong">Yearn Finance Treasury Error Triggers Huge Loss</h2>
The event unfolded as a result of multiple oversights in handling the treasury funds. Yearn’s <a rel="noopener noreferrer nofollow" href="https://github.com/yearn/yearn-security/blob/master/disclosures/2023-12-11.md">statement explained</a> that the entire treasury balance, including fees, was mistakenly transferred to a trading multisig, initiating over 30 trade orders. Among these was the critical swap of the treasury balance.
This transaction’s complexity and high volume of trades hindered effective human review, allowing the error to pass unnoticed. The protocol identified that the script used for token swapping lacked adequate output checks and contained a logical flaw. This flaw failed to cap the trade size, leading to the unintended large-scale transaction.
<h2 id="strong-new-safety-steps-at-yearn-post-loss-strong">New Safety Steps at Yearn Post Loss</h2>
Yearn Finance has implemented several measures to prevent a recurrence in response to this incident. The protocol plans to segregate protocol-owned liquidity (POL) funds into separate entities and enhance its trading scripts to produce more comprehensible output messages. Additionally, it will enforce stricter price impact thresholds during trades.
This incident is not the first security challenge Yearn has faced. Earlier in the year, the protocol was the<a href="https://coingape.com/curve-finance-hackers-exploit-vyper-vulnerabilities-could-state-sponsored-hackers-be-involved/" rel="noopener noreferrer nofollow"> target of an attack</a> where a vulnerability in a Yearn vault was exploited, resulting in the theft of approximately $11 million in stablecoins. The attacker utilized a small amount of tether (USDT) to mint a vast quantity of yUSDT. This Yearn-equivalent token was exchanged for stablecoins, culminating in a significant financial loss for the protocol.
Yearn Finance has reached out to the community, appealing to those who profited from arbitraging the mistake to return a reasonable amount to Yearn’s main multisig wallet, ychad.eth. This appeal highlights the collaborative and self-regulating nature of the DeFi community.
Read Also: <a href="https://coingape.com/fasb-introduces-fair-value-crypto-accounting-standards/" rel="noopener noreferrer nofollow">FASB Introduces Fair-Value Crypto Accounting Standards</a>
The post <a href="https://coingape.com/yearn-finance-hit-by-63-treasury-loss-due-to-script-glitch/" rel="noopener noreferrer nofollow">Yearn Finance Hit by 63% Treasury Loss Due to Script Glitch</a> appeared first on <a href="https://coingape.com" rel="noopener noreferrer nofollow">CoinGape</a>.

Yearn Finance Hit by 63% Treasury Loss Due to Script Glitch

Table of Contents

Coingape News Media

Other articles published on Dec 13, 2023

Understanding Bitcoin’s Abrupt Plummet

Kucoin Exits New York Market, Pays $22 Million in Settlement

Can XRP and Altcoins Break Free from Bitcoin’s Shadow? Experts Discuss

Coinbase Expands Global Reach with Spot Trading for Non-US Institutions!

Analysis of XRP’s Decline in December 2022

Deutsche Bank’s DWS Group Teams Up with Galaxy Digital to Issue Euro Stablecoin

Join our free newsletter for daily crypto updates!