According to yield farming protocol Yearn Finance, a flawed multisig script destroyed 63% of its treasury. Users' funds were not affected.
A disclosure post on GitHub said the incident occurred during a “regular fee token conversion process on behalf of Yearn Treasury.” Due to a script malfunction, Yearn's entire treasury balance of 3,794,894 lp-yCRVv2 tokens was swapped for 779,958 yvDAI tokens.
“The entire treasury balance of lp-yCRVv2 (POL, plus fees) was incorrectly transferred to the trading multisig when only a much smaller fee share was expected,” the post said.
The post continued: “The script used by Trading Multisig to exchange tokens did not have sufficient issuance checks and contained a logical error that would have limited the trade size to a reasonable amount.”
The protocol team reported that there was a sharp price drop after the trade, “which was soon returned to normal price by the market.” They demanded that users who had benefited from the price movement “return an amount that they believe is commensurate with Yearn’s main multisig.”
The protocol's developers intended to “split POL funds into dedicated manager contracts, introduce more readable spending messages in trading scripts, and enforce stricter price impact thresholds” to prevent similar incidents in the future, the post said.
According to PeckShield, an exploit related to an early Yearn version called iearn caused $11.6 million in damage earlier this year. One of its vaults contained $11 million worth of cryptocurrencies that were lost in an exploit in February.
Also Read: Yearn Finance Rejects Wintermute’s $2.18 Million YFI Token Bid
Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers
Comments are closed.