VALUE DEFI

DESCRIPTION OF EVENTS

"Before rebranding, the DeFi space knew Value DeFi as YFValue (YFV). The project was inspired by the Yearn Finance protocol, a platform designed exclusively to cater to yield farmers."

"Value DeFi is a compilation of products and services for the decentralized finance sector that brings innovation and fairness to the community. This project’s main goals are to increase accessibility to yield farming, provide on-chain governance voting, reward stakeholders with flexible yield strategies, and protect user funds through insurance treasuries."

"The Value DeFi suite contains five unique products and services." "vStake is an additional level to Value DeFi’s vSwap, designed as a massive improvement to conventional staking pools. vStake pools are actually active liquidity, while your standard single asset staking pools are dead liquidity. This may appear similar to vFarm, but all vStake pools are created to be 98/2 ratio, which should be noted that other AMMs are not capable of doing. This 98/2 ratio limits any potential impermanent loss to almost nothing. Even with 98/2 pools, vStake is still subjected to all the benefits of vSwap’s with the best exchange rates and slippages. Also, vStake is designed to be the perfect product to farm with your vBSWAP tokens and/or rewards. vBSWAP is a part of the Value DeFi BSC ecosystem, created to serve as a profit-share and incentive token."

"On May 5th 2021, 3:22 AM UTC, the exploiter re-initialized the pool and set the operator role to himself and _stakeToken to HACKEDMONEY. By doing so, the exploiter took control of the pool and called the method governanceRecoverUnsupported() and drained the original stake token (vBWAP/BUSD LP)."\

"The affected pool contract had an initialize() function that should have been activated after deployment."

"The line: initialized = true; is missing from the function."

"This meant anyone could re-initialize the pool and set themself as owner, thereby taking full control. As owner, the exploiter used the governanceRecoverUnsupported(), which is used for recovering pool funds in the event of a bug or undesired event."

"During set up of the profit-sharing vStake pool, the code was not written from scratch but migrated from the old implementation of the Value DeFi Reserve Fund, which had the correct setting. When merging the code, the line was not included."

"Then, the exploiter removed 10,839.16 vBWAP/BUSD LP, then removed liquidity and received 7342.75 vBSWAP and 205,659.22 BUSD."

"The exploiter then sold all 7342.75 vBSWAP for 8790.77 BNB at 1inch. Then, the exploiter used both BNB and BUSD to buy renBTC and use renBridge to move the funds back to BTC, which is laundered to the address 1Cm6WGvXQ9EgvvWX5dRsBxE2NvxFjfbcVF."

"In the end, the hacker was the only one who got their value for their money, a ten million dollar prize without even taking out a loan."

"We will make the community whole again by voting as a collective on the best resolution."

"Option 1: Mint 4540 vBSWAP to compensate all affected users immediately." "After the mint, the subsequent vBSWAP accumulated by the Reserve Fund will be burned over the next 6 months. At which point the extra 4540 vBSWAP will be completely burned, reducing the supply back to normal."

"From our pace of innovation on the bleeding edge of cross-chain DeFi, unfortunately by definition there will always be an element of risk with new deployments. Nonetheless, as laid out in our Missions and Values along with our track record in the space, the community can rest assured that we continue to work tirelessly with our community’s economic benefit and well-being in mind."

ValueDeFi was previously breached in November 2020, which was actually their second issue, since they had another issue where funds were at risk in August 2020.

Their solution was to mint additional tokens, which would obviously devalue the tokens. They plan to offset that by minting more tokens.

HOW COULD THIS HAVE BEEN PREVENTED?

Decentralized finance is extremely complicated, and these smart contracts function as immutable hot wallets.

In this case, the team failed to copy code correctly, and the contract was exploited. It's yet more evidence that a project, despite a previous audit and despite being hacked before, is still not secure.

The only secure storage of funds is in an offline multi-signature wallet. It would also be recommended that any customer funds only be handle by trained and background checked individuals.

Check Our Framework For Safe Secure Exchange Platforms

Value.Defi Hacked For $15 million. Discussion, Funds Located & Psychological Advice For Recovery - YouTube (May 16)
$22 Million Was Stolen From Three Defi Platforms Last Weekend - The Defiant - DeFi News (May 23)
Rekt - Value DeFi - REKT 2 (May 23)
Vstake Pool Incident Post Mortem (May 23)
Binance Transaction Hash (Txhash) Details | BscScan (May 23)
Address: 1Cm6WGvXQ9EgvvWX5dRsBxE2NvxFjfbcVF | Blockchain Explorer (May 23)
Token Transfer | BscScan (May 23)
@FrankResearcher Twitter (May 23)
@value_defi Twitter (May 23)
Rebranding And Expansion (May 23)
Rekt - Leaderboard (May 24)
Contract Address 0x7a8ac384d3a9086afcc13eb58e90916f17affc89 | BscScan (May 24)
Valid Defi - vStake (May 24)
Four Hacks, one week (Jun 19)
SlowMist Hacked - SlowMist Zone (May 18)
07 May 2021 Value Defi Incident Part 1 (May 26)

More case studies

BitBuy Korea
Exit Scam

Tanabata Finance/Taba
Finance Exit Scam