TronWeekly

Crypto World News

You are here: Home / Archives for yearn finance

yearn finance

DeFi: Yearn Finance Lost $11M After Attackers Exploited An Outdated Contract

by

DeFi protocols Yearn Finance and Aave suffered exploitation to the tune of over $11 million owing to a misconfigured yUSDT, blockchain security expert Peckshield revealed.

Initially, the attack was thought to be limited to Aave V1, but later on-chain sleuths found that the protocol was instead exploited to mint huge yUSDT from a small $10K USDT.

The massive amount of yUSDT was then converted to other stablecoins and cashed out. So far, the flash loan exploiter stole millions worth of USDT, TUSD, BUSD, USDC, and DAI.

image 47
DeFi: Yearn Finance Lost $11M After Attackers Exploited An Outdated Contract 2

Shortly after that, Yearn Finance’s team issued a public statement as it continues its investigation.

We’re looking into an issue with iEarn, an outdated contract from before Vaults v1 and v2. This problem seems exclusive to iEarn and does not impact current Yearn contracts or protocols. iEarn is an immutable contract predating YFI, it was deprecated in 2020. Vaults v1, with upgradeable strategies, was also deprecated in 2021. There’s no indication it’s affected. The current version, Yearn v2 Vaults [written in Vyper], remains unaffected as well.

As further information came to light, different security analysts pointed out that the issue is still specific to the liquidity pool and the 2020-launched iEarn legacy protocol. Vaults for Yearn v2 don’t appear to be affected.

Voicing a similar opinion, White-hat hacker samczsun said, “It seems like the iEarn USDT token [yUSDT] has been broken since deployment, which was *checks notes* over 1000 days ago. It was misconfigured to use the Fulcrum iUSDC token instead of the Fulcrum iUSDT token.”

For those new, prominent Web3 developer Andre Cronje pioneered two DeFi projects — yEarn Finance and iEarn. Cronje renamed iEarn to Yearn Finance [YFI] in July 2020 after it showed success in yield aggregation.

Cyber experts have so far highlighted the vulnerability in Yearn’s predecessor’s contracts. Meanwhile, a similar incident of smart contract exploitation took place a few days back.

DeFi Protocol Sushi DEX Hack

Popular decentralized protocol Sushi DEX reported a loss of over $3 million due to a bug on the “RouterProcessor2” contract that is used to route trades on the SushiSwap exchange.

The issue seems to only impact customers who approved SushiSwap contracts in the previous four days, according to @0xngmi, a pseudonymous DefiLlama developer.

After the incident, SushiSwap chief developer Jared Grey requested users to remove access to any contracts on the platform as a security precaution.

Grey also assured that the team was “working with security teams to mitigate the issue.”

DeFi Godfather Andre Cronje and Anton Nell Quit, Associated Tokens Tumble

by

According to a tweet shared by Anton Nell, the DeFi godfather and the creator of Yearn.Finance and Keep3r, Andre Cronje has called it quits with fellow software architect Anton Nell.

Nell reports that effective from April 3, a total of 25 decentralized financial applications would be canceled. Yearn.Finance, Keep3r Network, Solidly, and more protocols are among the initiatives that have been abandoned.

https://twitter.com/AntonNellCrypto/status/1500405473337565191

The YFI token’s price has dropped around 13% since the announcement. However, it has subsequently recovered some of its losses. The cryptocurrency gained much attention after a big spike during “DeFi summer” in 2020, but it has since faded into oblivion.

Associated DeFi projects tumble following the news

The total value locked (TVL) of the Fantom protocol has declined by $3.35 billion since March 3, which appears to be tied to Cronje’s departure.

The Fantom (FTM) has also dropped 13% in the last 24 hours.

Solidly (SOLID) plummeted by 67% during the same period, Multichain (MULTI) fell by almost 14%, and Chainlist fell by 4.3%. All of this demonstrates Cronje’s clout in the sector. However, it also revealed how misunderstanding might derail initiatives in the DeFicontributing domain.

Andre Cronje’s initial response to the issue on the Keep3r telegram group gave the impression that the projects were closing down. But, in actuality, he was delegating to other teams.

Fear of a rug pull prompted a significant sell-off by various holders. As people hurried to withdraw their cash, Fantom Network GAS surged to 10,000 gwei.

However, the project team has attempted to explain the issues. According to the Fantom Foundation, Cronje’s departure does not affect the project since “Fantom isn’t and never was a one-man team.” Fantom employs over 40 individuals.”

It went on to say that “Andre’s choice will have no influence on Fantom’s progress.” Big things are on their way, as planned.”

Cronje’s resignation was first reported on Twitter on Saturday when he updated his LinkedIn page to reveal that the Fantom Foundation, Yearn.Finance, or Ethereum, no longer employed him.

Cronje published a blog article titled “Building in DeFi Sucks” in January, but it was nothing more than a “therapeutic” rant. Cronje is very serious about resigning, as Nell has clarified.

https://twitter.com/AntonNellCrypto/status/1500405603096739841