VALUE DEFI

DESCRIPTION OF EVENTS

"YFValue launched in August 2020 as a DeFi yield aggregator that focuses on bringing a decentralized experience to truly everyone, including smaller and bigger investors. The goal was to completely transfer the project’s ownership and decision-making process to the community, backed by YFV as its governance token."

"YFValue was launched anonymously and fairly, meaning the team also didn’t start farming earlier than everyone else. It was announced in a Medium post titled “YFV: Bring True Value to Yield Farming” on Aug 16. The project was launched sometime after that." "YFV is the governance token of YFValue protocol. The project aims to bring the true value of yield farming finance accessible to all users, regardless of whether you are a big whale or small minnow, via its unique features, namely the voting of the inflationary rate of the supply and a referral system with automatic burning done fully on-chain."

"On Monday, August 24th, the team identified an exploit for the YFV staking pool that enables malicious actors to individually reset timers for staked YFV. This attack is not economically sustainable in the long run due to gas fees, but hackers could still delay YFV claims and inconvenience members of the community who have staked their YFV. A malicious actor is currently attempting to extort the team by threatening this tactic."

"To those who were unaware, there was an incident in our initial deployment of the seed (stablecoin) pool, which we’ve titled “Pool 0” (contract address). We owe you a complete explanation of what happened and our decision-making process."

"On our initial launch day of YFValue (Monday 17/8/2020 08:00:00 GMT+0) we made a human error by clicking on the wrong tx confirmation when trying to remove our control of the pool. For the more technically aware, the steps that needed to be taken were to set governance to “0x0” to revoke ownership. Unfortunately, we accidentally clicked the “revoke ownership tx” out of order, and the transaction settled so that we could not set governance anymore. The risk would be us calling the notifyRewards function to lock down the ability to withdraw funds (which obviously we would never do)."

"As communicated by the team of YFV protocol, a fork of yearn finance, one of the pools of the DeFi project has been badly configured and this has created great concern in the community. For this reason, the team is working with Arcadia Group to audit the code and eliminate the present anomalies that could also lead to a loss of funds."

"We are very pleased that the Audit of YFV Staking Pool v2 has been completed successfully by The Arcadia Group. The audit was carried out by Arcadia’s engineer Minh Khai Do with summaries by Rasikh Morani and Joel Farris."

"Realizing this error and in the spirit of true decentralization, we decided to relaunch the next day by opening another seed pool (Pool v2) while penalizing ourselves by burning the equivalent amount of tokens from our dev fund. The extra YFV generated by pool 0 for its epoch was 0.3% of 21M YFV, and having burned that amount we had considered the matter concluded."

"Despite this problem, which led to the creation of Pool v2 and the burning of the team’s tokens, some users continued to use this pool." "However, clever members of the community noticed our mistake and took advantage of it by continuing to farm in pool 0 despite our warnings, despite our removal of the frontend UI. As there was no way we could stop this activity, we made the decision to burn the minter key. This key burn would cause tx failure at checkNextEpoch (08/24/2020 @ 7:52am (UTC), an event which we hoped would serve as a deterrent."

"Despite our best efforts, nonetheless we are aware that there is a possibility that some miners in the pool may forget to remove their funds before this critical deadline. As a consequence, their staked capital would be lost forever. While we are not particularly sympathetic to this “selfish mining”, the discovery of vUSD and vETH minting keys have given us a more elegant solution to this issue."

"Inform all stakers to stop staking YFV in the current staking pool and to remove their funds as soon as their timers allow. We have removed the staking option on the frontend UI for this purpose."

"And this is where the team had to make the drastic decision to destroy the minter key and then lock the pool’s funds." "But the problems did not end there, because due to an exploit it would still be possible to recover the minter key and allow the team to recover the users’ funds that were locked." "So, the team decided to split these keys into a multi-signature in order to share the risk and to have at least the majority of signatures to access these keys and perform the token recovery transaction."

"Compensate any community members (if any) affected by timer reset attacks who for whatever reason did not benefit from the rescue plan. We will draw upon our Dev fund (~300K YFV) to make affected community members whole."

"Nonetheless, we are committed to providing complete transparency, protect staked funds, and do whatever necessary to preserve and improve the community’s trust in the YFV project now and going forward. Thank you for your time and for contributing to the YFV ecosystem. Please anticipate an update and better news as the situation unfolds."

"In the upcoming weeks, we will update our marketing literature and online presence with this new branding. Meanwhile, we invite our business partners to contact us for the latest descriptions and links for updates if applicable."

"[W]e would like to thank the YFV community for your interest and trust in this project. Furthermore, thank you for your understanding and patience as we do our best to unwind and deliver fair solutions to these development oversights. Overall, the YFV community remains strong, and we look forward to delivering additional products and exciting announcements in the days ahead."

"By October, the developer team decided to rebrand to Value DeFi in an effort to distance itself from its yearn-like theme. It is also worth noting that the platform suffered a hack a couple of months earlier, which is probably one of the major reasons why the rebranding has occurred."

In this issue, YFValue (precursor to Value DeFi) almost loses access to a very large portion of liquid funds on the platform.

They upgrade to a new platform, but some people still insist on using the old one. Some of those individuals who had their funds at threat, decide to extort the project in an attempt to recover the funds. The project finds that there is a way to access the funds and reimburse affected users, so nothing is lost.

HOW COULD THIS HAVE BEEN PREVENTED?

One of the key recommendations is for all customer funds to be kept in offline multi-signature wallets. As part of multi-signature, redundancy is created through extra signatures and individual holders having secure backups, which prevents the complete loss of funds.

Check Our Framework For Safe Secure Exchange Platforms

What Is Value DeFi? (May 24)
Yfv Update Staking Pool Exploit (May 23)
YFValue Protocol: What is $YFV? - Asia Crypto Today (May 23)
Yfv Bringing True Value To Yield Farming (May 23)
Yfvalue Rebrands To Value Defi Protocol (May 24)
Yfv Update Pool 0 Minting Keys Community Governance (May 24)
DeFi: is the YFV protocol in danger? - The Cryptonomist (May 24)
Rebranding And Expansion (May 23)
SlowMist Hacked - SlowMist Zone (May 18)

More case studies

Ledger Upgrade Phishing
Success _Scorpic_

Coinbit
Seizure/Investigation