YEARN FINANCE

DESCRIPTION OF EVENTS

"Yearn.finance is the brainchild of Andre Cronje. After leaving the iEarn project in February 2020, Cronje returned to oversee a rebirth, with new tools emerging and YFI going live in July." "Cronje has a long career in cryptocurrency and has become synonymous with DeFi in particular. He also has positions at smart contract ecosystem Fantom and CryptoBriefing, a resource dedicated to initial coin offerings (ICOs) and crypto media." "The prospect of what one observer called an "intuitive interface to all of DeFi" is what makes Yearn and its YFI coin stand out from the recent crop of "Weird DeFi" projects."

"Yearn.finance set out to simplify DeFi investment and activities such as yield farming for the broader investor sector" and "aspires to be the gateway to a bevy of yield-generating products in the Ethereum ecosystem." "Yearn.finance is an aggregator service for decentralized finance (DeFi) investors, using automation to allow them to maximize profits from yield farming. Its goal is to simplify the ever-expanding DeFi space for investors who are not technically minded or who wish to interact in a less committal manner than serious traders. Launched in February 2020, the service, formerly known as iEarn, has seen huge growth in recent months as new products debuted and developers released in-house token YFI."

"In its first month of operation, the yearn.finance platform attracted nearly $800 million in assets, making it one of the fastest-growing DeFi projects to date." "[A]ssets under total value locked [were] just over $1 billion as of the end of September 2020. The platform makes use of various bespoke tools to act as an aggregator for DeFi protocols such as Curve, Compound and Aave, bringing those who stake cryptocurrency the highest possible yield. New features continue to be rolled out, these aiming, among other things, to help preserve the long-term value of the platform." "But given that Yearn has several different elements, the platform is one of the harder ones for novice investors to understand. Some $650 million has poured into DeFi’s Yearn.Finance since mid-August. DeFi is driving most of the excitement in crypto right now, and Yearn and its YFI token are central to the latest buzz."

"yearn.finance is a group of protocols running on the Ethereum blockchain that allow users to optimize their earnings on crypto assets through lending and trading services." "The yearn.finance platform consists of several independent products, including APY – A data table that shows interest rates across different lending protocols. Earn – Which identifies the highest interest rates users can earn lending an asset. Vaults – A collection of investment strategies designed to generate the highest returns from other DeFi projects. Zap – Which bundles several trades in one click, saving on costs and labor. Users earn YFI tokens by locking cryptocurrencies in yearn.finance contracts running on the Balancer and Curve DeFi trading platforms, using the yearn.finance platform." "yearn.finance capitalizes on a practice commonly called “yield farming,” in which users lock up crypto assets in a DeFi protocol in order to earn more cryptocurrency. The more assets users lock in a platform, the more tokens they are awarded by the protocols."

"Yearn.finance makes a profit by charging withdrawal fees, currently 0.5% at the end of September 2020, as well as 5% gas subsidization fees. Due to its governance model, these can technically be changed by consensus at any time. The target market for yearn.finance is investors who do not have the time to study the increasingly complex DeFi phenomenon from scratch, or who wish to optimize their returns. Users of yearn.finance earn YFI through providing liquidity, while token holdings dictate governance privileges." "One of a number of emerging decentralized finance (DeFi) projects, yearn.finance provides its services using only code, removing the need for a financial intermediary like a bank or custodian. To do this, it has built a system of automated incentives around its YFI cryptocurrency."

"Yearn.finance users can face a high risk of losing money thanks to market conditions changing rapidly and opportunistic entities attempting to profit from less-experienced participants. Cronje himself has sought to maintain transparency about the platform’s provenance, noting that even after code audits, yearn.finance could not be guaranteed to be 100% safe — DeFi involves inherent risk."

"A blue-chip project, Yea[r]n had over $4 billion in total value locked (TVL), as of writing, down from more than $5 billion in mid-June, as per DeFi Llama. In Q2 2021, the project enjoyed a jump of 138% in its TVL while its revenue grew by 233% to 18.3 million from $5.5 million. Yearn’s active wallet addresses are also seeing an increase of 31% to 21.5k."

At "June 29, 2021, 19:20 (UTC)", a "security researcher, xyzaudits, contacts Yearn's security team through its vulnerability disclosure process about a possible exploit that can lead to significant loss of user funds." "[A]n attack vector in the GenLevComp strategy type that is in use in two strategies in the yvDAI 0.3.0 vault was disclosed through Yearn's security process."

The "vulnerability could have liquidated GenLevComp strategy debt position." "In this leverage strategy, DAI is borrowed and lent repeatedly on Compound in order to farm Comp tokens which makes use of dYdX for flash loans. If successfully exploited, the attacker would have been able to liquidate an affected strategy's entire debt position on Compound and potentially capture liquidation fees. This would have led to a “significant loss of user funds.”" "If successfully exploited, the attacker would have been able to liquidate an affected strategy's entire debt position on Compound and potentially capture liquidation fees."

"DAI GenLevComp[1], a.k.a StrategyGenericLevCompFarm, is a leveraged strategy that borrows and lends DAI repeatedly on Compound in order to farm Comp tokens. To get into this highly leveraged position it uses dYdX for flash loans."

"To receive the flashloan, dYdX sends DAI to GenLevComp and then calls the function callFunction. After the logic is complete, dYdX needs to receive back more DAI than was sent otherwise the transaction reverts."

"GenLevComp lends out the amount borrowed to Compound and borrows the repayAmount (calculated as amount+2) which it then returns to dYdX. The logic flow is that amount and repayAmount are passed to dYdX. dYdX send the DAI equivalent of amount to the contract and executes callFunction with input of amount and repayAmount. After callFunction dYdX pulls the repayAmount and verifies it has more funds than it started with."

"If GenLevComp does not receive the expected amount from the loan, or if callFunction is called by anyone other than dYdX's SOLO contract, or if dYdX does not receive its funds back, the transaction reverts. It was believed that the combination of these three safety features made the function safe."

"The security researcher was able to effectively initiate a flashLoan of 0 amount and inject their own value to repayAmount. Because of this there was no loan, so dYdX did not expect any repayment and therefore did not revert. dYdX SOLO contract still called the callFunction. And the function received the correct amount: zero. Bypassing the three safety checks."

"Then a loan of the injected repayAmount was taken out from Compound. By calculating an exact number the exploiter would be able to force the strategy to borrow right up until it was 1 block away from liquidation. On the next block, liquidators would be able to liquidate the strategy and claim liquidation fees. By repeating this process again and again an exploiter would be able to completely liquidate the contract."

“No funds were lost,” assured the team. "A check was added to callFunction to make sure that only itself could initiate the dYdX call. Thereby stopping a third party from being able to intiate the flash loan. The calculation for repayAmount was moved from function doDyDxFlashLoan to function callFunction. Thereby removing the opportunity to inject a false number."

"Yearn Finance awarded a maximum bounty of $200,000 to a security researcher xyzaudits after they revealed a vulnerability in the leveraged COMP farming strategies that have since been mitigated." "Yearn awarded [the] bounty for a "[T]he vulnerable strategies have been successfully wound down, and a fix has been committed and tested."

"As per Yearn's security process document, the project does not currently have any established bilateral disclosure agreements. However, in this case, due to the critical nature of the vulnerability, a disclosure was made to "Gro Protocol" prior to this publication."

Yearn Finance offers a large variety of tools, including a leveraged strategy referred to as "GenLevComp". That strategy, and a few others, had funds stored in smart contract hot wallets for leverage.

The funds were removed from the contracts into a safe vault, and the vulnerabilities were fixed. A bounty of $200k was paid.

HOW COULD THIS HAVE BEEN PREVENTED?

No funds were lost due to the responsible disclosure.

While smart contract hot wallets cannot be guaranteed, bug bounty programs such as this and professional security audits can reduce the risk greatly. The most secure form of protection is an offline multi-signature wallet, so perhaps there is a solution where the majority of funds reside there and are only accessed when large adjustments need to be made.

Check Our Framework For Safe Secure Exchange Platforms

No Title (Jul 24)
yearn-security/2021-06-29.md at master · yearn/yearn-security · GitHub (Jul 24)
yearn.finance price today, YFI to USD live, marketcap and chart | CoinMarketCap (Aug 22)
What Is Yearn Finance? The DeFi Gateway Everyone Is Talking About (Aug 22)
What is yearn.finance? (YFI) (Aug 22)
DeFi Yearn Finance Fixes a Critical Vulnerability in the Leveraged COMP Farming Strategy (Aug 30)
Strategy | 0x55ec3771376b6E1E4cA88D0eEa5e42A448f51C7F (Aug 30)
refact · Grandthrax/YearnV2-Generic-Lev-Comp-Farm@a726df8 · GitHub (Aug 30)
Strategy | 0x77b7CD137Dd9d94e7056f78308D7F65D2Ce68910 (Aug 30)
Strategy | 0x339dc96a37Dba86008126B3391Db77af93cC0Bd9 (Aug 30)
Strategy | 0xE68A8565B4F837BDa10e2e917BFAaa562e1cD143 (Aug 30)
yearn-security/SECURITY.md at master · yearn/yearn-security · GitHub (Aug 30)
DeFi Yearn Finance Fixes a Critical Vulnerability in the Leveraged COMP Farming Strategy (Aug 30)
YFI (yearn finance) reports security vulnerability : CryptoCurrency (Feb 8)
https://www.blockthreat.io/p/blockthreat-week-26-2021 (Feb 8)

More case studies

ThorChain ETH
Bifrost Exploit

DDEX XDX Swap
Backdoor