1. PixelPlaygroundHome
  2. Blockchain Briefs

Investigating the Attack on Yearn Finance: Progress Report

• Blockchain Briefs • 145 views

On April 14th, it was reported that Yearn Finance posted on Twitter the progress of the investigation into the attack, stating that as previously stated, the root cause of the atta

Investigating the Attack on Yearn Finance: Progress Report

On April 14th, it was reported that Yearn Finance posted on Twitter the progress of the investigation into the attack, stating that as previously stated, the root cause of the attack on Yearn was a vulnerability left in the iEarn USDT (yUSDT) token contract. This vulnerability exists in multiple versions and leads to multiple Curve pools (y, busd, pax) being exploited and exhausted. The liquidity providers who deposit LP tokens into downstream protocols are still affected, including users who encapsulate the Yearn v2 vault (2) and the old version v1 vault (2) of these affected LPs. In previous tweets, Year stated that the current version of Year v2 Vaults is not affected.

Year: The vulnerability in yUSDT token contract exists in multiple versions, and the liquidity providers of downstream protocols are still affected

Yearn Finance, a decentralized finance (DeFi) protocol, has been under attack since February 2021. On April 14th, the team posted a progress report on Twitter about the investigation into the attack. The report revealed that the root cause of the attack was a vulnerability in the iEarn USDT (yUSDT) token contract. In this article, we will explore the details of the attack, its impact on Yearn Finance, and the progress made in its investigation.

Background of Yearn Finance

Before diving into the attack, it’s important to understand what Yearn Finance is and how it operates in the DeFi space. Yearn Finance is a yield aggregator that helps users find the highest yield for their investments. It does this by automatically moving funds between different DeFi protocols to find the most profitable opportunity.
The platform has gained a lot of attention and popularity in recent times due to its innovative approach to yield farming. Its native token, YFI, has also gained significant value, making it a prime target for attackers.

The Attack on Yearn Finance

The attack on Yearn Finance started on February 4th, 2021, when the team noticed significant losses on some of its vaults. The attackers exploited a vulnerability in the iEarn USDT (yUSDT) token contract, allowing them to manipulate the prices of certain tokens and drain the liquidity from the affected pools.
The attack affected multiple Curve pools (y, busd, pax), causing significant losses for liquidity providers who deposited LP tokens into these pools. Additionally, users who encapsulate the Yearn v2 vault (2) and the old version v1 vault (2) of these affected LPs were also affected.

Impact of the Attack

The attack resulted in massive losses for Yearn Finance and its users. The team estimates that the attacker was able to drain around $11 million, which is a significant amount considering the value of the funds involved. The attack also had a negative impact on the overall market sentiment towards DeFi protocols.
However, the team acted quickly and was able to contain the damage by pausing the affected vaults and implementing new security measures to prevent further attacks. They also launched an investigation to determine the root cause of the attack and find ways to prevent similar incidents in the future.

Progress in the Investigation

In the progress report posted on Twitter on April 14th, the team confirmed that the root cause of the attack was indeed the vulnerability in the iEarn USDT (yUSDT) token contract. They also revealed that the vulnerability exists in multiple versions of the contract, making it a widespread issue.
However, they also confirmed that the current version of Yearn v2 Vaults is not affected by the vulnerability. This is good news for users who have been using the platform since its inception and are concerned about the safety of their funds.

Conclusion

The attack on Yearn Finance was a wake-up call for the DeFi industry, highlighting the need for better security measures and more comprehensive auditing processes. The progress made in the investigation so far is reassuring, but it’s important to remain vigilant and continue exploring ways to improve the security of DeFi protocols.

FAQs

1. What is Yearn Finance?
Yearn Finance is a DeFi yield aggregator that helps users find the highest yield for their investments.
2. What was the root cause of the attack on Yearn Finance?
The root cause of the attack was a vulnerability in the iEarn USDT (yUSDT) token contract.
3. Has Yearn Finance taken any measures to prevent further attacks?
Yes, the team has implemented new security measures to prevent further attacks and is conducting an investigation to determine the root cause of the attack.

This article and pictures are from the Internet and do not represent Fpips's position. If you infringe, please contact us to delete:https://www.fpips.com/14594/

It is strongly recommended that you study, review, analyze and verify the content independently, use the relevant data and content carefully, and bear all risks arising therefrom.

Like (0)
Previous 04/14/2023 02:04
Next 04/14/2023 02:19

Recommended articles