Main navigation

Yearn.Finance (YFI) DeFi Was Vulnerable to Flash Loan Attack; Are Funds SAFU?

Sat, 02/12/2022 - 16:27
article image
Vladislav Sopov
Yearn.Finance (YFI), a top-league DeFi ecosystem and one of the most overhyped protocols of 2020 DeFi Summer, shared the attack design against its architecture (now fixed)
Yearn.Finance (YFI) DeFi Was Vulnerable to Flash Loan Attack; Are Funds SAFU?
Cover image via
Read U.TODAY on
Google News

Banteg (@bantg), a core developer of Yearn.Finance (YFI) DeFi ecosystem, shares the details of hypothetical attack against the elements of its protocol that were unveiled by a white-hat hacker.

USDT at discount, maximum bounty to attacker

As per the tweets by Banteg, on Jan.30 2022, a white-hat hacker reported the scenario of an attack against SingleSidedBalancer strategy, an element of Yearn.Finance's yield farming toolkit.

SingleSidedBalancer strategy (or SSB) is designed to allow DeFi enthusiasts to farm Balancer's native currency BAL providing single-asset liquidity. SSBs are active on Ethereum (ETH) and Fantom (FTM) blockchains.

The attack design was used to allow hackers to imbalance the Balancer pool and obtain USDT at an inflated price as only SSB strategy on yvUSDT was found to be profitably exploitable.

Through a series of flash loans with USDC and DAI, an attacker could drain Yearn.Finance's liquidity pool for more than $41 million in equivalent.

Another day, another jaw-dropping bounty reward?

As per the detailed explanation shared in Yearn.Finance's security repository on GitHub, the vulnerability was patched in 25 minutes as all exploitable elements were disabled; no funds are at risk now.

By Feb.11, all vulnerable strategies were updated by Yearn.Finance and Balancer. As the possible vulnerability is of a 'Critical' category, on Feb. 2 the white-hat attacker was rewarded with a 200,000 USDC bounty bonus.

As covered by U.Today previously, on Feb.10, the team of the Optimism scaling solution for Ethereum (ETH) paid $2 mln to Mr. Jay Freeman who unveiled the flaw in Optimism smart contracts that would have allowed minting an infinite amount of Ether in every wallet.

Jailbreak Veteran Discloses a Bug in Optimism: It Was Possible to Create Infinite ETH!

Similar bounty reward was transferred to a potential Polygon (MATIC) attacker in October, 2021.

article image
About the author

Blockchain Analyst & Writer with scientific background. 6+ years in IT-analytics, 3+ years in blockchain.

Worked in independent analysis as well as in start-ups (, Monoreto, Attic Lab etc.)