The central theses
- PolyYeld Finance’s YELD token crashed to zero after attackers exploited a vulnerability to mint nearly 4.9 trillion tokens.
- The attack targeted PolyYeld’s Masterchef pool, which contained xYELD tokens.
- Several other yield farming projects on Polygon have faced similar attacks in recent months.
Share this article
PolyYeld Finance was exploited today, causing its native token to drop in price.
Attacker exploits PolyYeld vulnerability
PolyYeld Finance’s native token collapsed to zero after attackers exploited a vulnerability to mint a surplus of tokens.
According to security firm PeckShield, the attacker successfully minted nearly 4.9 trillion YELD tokens. They sold part of it for around 123 ETH, which is worth around $250,000 in today’s prices.
The attacker exploited a vulnerability in the PolyYeld Masterchef contract, a type of contract used by yield farms to distribute rewards. The attack targeted a Masterchef pool containing another token called xYELD, which generated passive income for holders by charging fees for each transaction and distributing them as YELD rewards.
In a note shared on Telegram, the PolyYeld team claimed that their Masterchef contract could not support xYELD’s reward distribution system, which enabled the attack. Said:
“[The] xYELD token contains a transfer tax added to Masterchef, which unfortunately could not support tokens with transfer taxes.”
The lack of Masterchef support meant attackers could mint free reward tokens by depleting the xYELD liquidity pool.
The Masterchef contract was invented for the distribution of liquidity pool token rewards. But more recently Yield farms on Binance Smart Chain and Polygon have started using master contracts for single asset tokens or “transfer fee tokens” like xYELD.
Security firm PeckShield explained that a deflationary token like xYELD charges a fee for its transfers. Through repeated deposits and withdrawals, the xYELD balance was maliciously shrunk to 1 WEI, the smallest denomination of 1 polygon.
A Masterchef contract estimates rewards by dividing the pool value by the value of the tokens wagered, meaning that decreasing the pool value can increase rewards dramatically. Xuxian Jiang, Founder and CEO of PeckShield told CryptoBriefing:
“By repeatedly depositing and withdrawing money from MasterChef, the attacker often triggers tax collection. This will gradually reduce MasterChef’s xYELD balance down to 1 WEI, leading to actual exploitation.”
When the attackers minted 4.9 trillion tokens and sold part of them, the market was immediately flooded, causing the price to collapse to zero. According to PolyYeld’s website, the maximum supply was intended 62,100 YELD tokens.
Source: TradingView
Since the attack, YELD’s price has plummeted from $25 to $0 in a day. Meanwhile, according to Dex Guru, xYELD has fallen from $100 to around $7.
In the note posted to the PolyYeld Telegram group, the team urged users to withdraw their funds. It added that it was considering a compensation plan and promised a report in the coming days. Meanwhile, Telegram group remains silent along with other communication channels.
This is another instance of security involving polygon-based yield farms. In recent months, projects like Iron Finance, PolyWhale, and SafeDollar have been similarly targeted, with attackers hyperinflating the token supply and causing a price drop.
PolyYeld held a total value of more than $20 million as of last week.
Share this article
The information on or through this website is obtained from independent sources which we believe to be accurate and reliable, but Decentral Media, Inc. makes no representations or warranties as to the timeliness, completeness or accuracy of any information on or through this website. Decentral Media, Inc. is not an investment advisor. We do not provide personalized investment advice or any other financial advice. Information on this website is subject to change without notice. Some or all information on this website may be or become out of date, incomplete or inaccurate. We have the right, but not the obligation, to update any information that is out of date, incomplete or inaccurate.
You should never make an investment decision about any ICO, IEO or any other investment based on the information on this website, and you should never interpret or otherwise rely on the information on this website as investment advice. We strongly encourage you to consult a licensed investment advisor or other qualified financial professional if you are seeking investment advice on an ICO, IEO or any other investment. We do not accept compensation in any form for analysis or coverage of ICO, IEO, cryptocurrency, currency, tokenized sales, securities or commodities.
View full terms and conditions.
Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers
Comments are closed.