YCredit Finance Minting Vulnerability - Revision history

Azoundria at 18:48, 2 May 2023

2023-05-02T18:48:20Z

← Older revision		Revision as of 12:48, 2 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/ycreditfinancemintingvulnerability.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/ycreditfinancemintingvulnerability.php}}
	{{Unattributed ~~Citations~~}}		{{Unattributed Sources}}

	[[File:Ycreditfinance.jpg\|thumb\|yCredit Finance]]YCredit Finance was launched as a test smart contract, where word quickly spread, even though it was not announced in any official channels.		[[File:Ycreditfinance.jpg\|thumb\|yCredit Finance]]YCredit Finance was launched as a test smart contract, where word quickly spread, even though it was not announced in any official channels.
Line 8:		Line 8:
	The contract was ultimately redeployed in the future, however those affected do not appear to have received any consideration.		The contract was ultimately redeployed in the future, however those affected do not appear to have received any consideration.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="openblocksecgithub-2342" /><ref name="blocksecteammedium-3055" /><ref name="banteggithub-3056" /><ref name="ycreditfinance-3057" /><ref name="youtube-3058" /><ref name="rektnews-3059" /><ref name="0xdeadf4cetwitter-3060" /><ref name="etherscan-3061" /><ref name="etherscan-3062" />
	<ref name="openblocksecgithub-2342" /><ref name="blocksecteammedium-3055" /><ref name="banteggithub-3056" /><ref name="ycreditfinance-3057" /><ref name="youtube-3058" /><ref name="rektnews-3059" /><ref name="0xdeadf4cetwitter-3060" /><ref name="etherscan-3061" /><ref name="etherscan-3062" />

	== About YCredit Finance ==		== About YCredit Finance ==
Line 67:		Line 66:
	!Description		!Description
	\|-		\|-
	\|January 1st, 2021 ~~12:00:00 AM~~		\|January 1st, 2021
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 75:		Line 74:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 94:		Line 96:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	~~Which policies could have prevented this event from happening?~~

	== References ==		== References ==
	<references><ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10, 2021)</ref>		<references><ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 11, 2021)</ref>

	<ref name="blocksecteammedium-3055">[https://blocksecteam.medium.com/deposit-less-get-more-ycredit-attack-details-f589f71674c3 Deposit Less Get More Ycredit Attack Details] (Aug 10, 2021)</ref>		<ref name="blocksecteammedium-3055">[https://blocksecteam.medium.com/deposit-less-get-more-ycredit-attack-details-f589f71674c3 Deposit Less Get More Ycredit Attack Details] (Aug 11, 2021)</ref>

	<ref name="banteggithub-3056">[https://github.com/banteg/exploit-ycredit GitHub - banteg/exploit-ycredit] (Aug 10, 2021)</ref>		<ref name="banteggithub-3056">[https://github.com/banteg/exploit-ycredit GitHub - banteg/exploit-ycredit] (Aug 11, 2021)</ref>

	<ref name="ycreditfinance-3057">[https://ycredit.finance/ ycredit] (Aug 20, 2021)</ref>		<ref name="ycreditfinance-3057">[https://ycredit.finance/ ycredit] (Aug 21, 2021)</ref>

	<ref name="youtube-3058">[https://www.youtube.com/watch?v=QyN0mSfgkeo Staking $100 in yCredit.Finance. What Are the Risks? \| QDeFi - YouTube] (Sep 17, 2021)</ref>		<ref name="youtube-3058">[https://www.youtube.com/watch?v=QyN0mSfgkeo Staking $100 in yCredit.Finance. What Are the Risks? \| QDeFi - YouTube] (Sep 18, 2021)</ref>

	<ref name="rektnews-3059">[https://rekt.news/ycredit-the-ape/ Rekt - yCredit the Ape] (Sep 17, 2021)</ref>		<ref name="rektnews-3059">[https://rekt.news/ycredit-the-ape/ Rekt - yCredit the Ape] (Sep 18, 2021)</ref>

	<ref name="0xdeadf4cetwitter-3060">[https://twitter.com/0xdeadf4ce/status/1345388627694661632 @0xdeadf4ce Twitter] (Sep 17, 2021)</ref>		<ref name="0xdeadf4cetwitter-3060">[https://twitter.com/0xdeadf4ce/status/1345388627694661632 @0xdeadf4ce Twitter] (Sep 18, 2021)</ref>

	<ref name="etherscan-3061">[https://etherscan.io/address/0xe0839f9b9688a77924208ad509e29952dc660261 StableYieldCredit \| 0xe0839f9b9688a77924208ad509e29952dc660261] (Sep 17, 2021)</ref>		<ref name="etherscan-3061">[https://etherscan.io/address/0xe0839f9b9688a77924208ad509e29952dc660261 StableYieldCredit \| 0xe0839f9b9688a77924208ad509e29952dc660261] (Sep 18, 2021)</ref>

	<ref name="etherscan-3062">[https://etherscan.io/address/0x71b6296174c5f07d37cafd6e9b72ab5bb3f14fac StableYieldCredit \| 0x71b6296174c5f07d37cafd6e9b72ab5bb3f14fac] (Sep 17, 2021)</ref></references>		<ref name="etherscan-3062">[https://etherscan.io/address/0x71b6296174c5f07d37cafd6e9b72ab5bb3f14fac StableYieldCredit \| 0x71b6296174c5f07d37cafd6e9b72ab5bb3f14fac] (Sep 18, 2021)</ref></references>

Azoundria at 17:33, 17 February 2023

2023-02-17T17:33:32Z

← Older revision		Revision as of 11:33, 17 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/ycreditfinancemintingvulnerability.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/ycreditfinancemintingvulnerability.php}}
			{{Unattributed Citations}}

	[[File:Ycreditfinance.jpg\|thumb\|~~YCredit~~ Finance]]YCredit Finance was launched as a test smart contract, where word quickly spread, even though it was not announced in any official channels.		[[File:Ycreditfinance.jpg\|thumb\|yCredit Finance]]YCredit Finance was launched as a test smart contract, where word quickly spread, even though it was not announced in any official channels.

	The smart contract had an exploit which allowed the effective minting of additional tokens, causing a massive price drop.		The smart contract had an exploit which allowed the effective minting of additional tokens, causing a massive price drop.
Line 8:		Line 9:

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="openblocksecgithub-2342" /><ref name="blocksecteammedium-3055" /><ref name="banteggithub-3056" /><ref name="ycreditfinance-3057" /><ref name="youtube-3058" /><ref name="rektnews-3059" /><ref name="0xdeadf4cetwitter-3060" /><ref name="etherscan-3061" /><ref name="etherscan-3062" />

	== About YCredit Finance ==		== About YCredit Finance ==
Line 45:		Line 47:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 67:		Line 68:
	\|-		\|-
	\|January 1st, 2021 12:00:00 AM		\|January 1st, 2021 12:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 80:		Line 77:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $11,000,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 91:		Line 88:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 99:		Line 96:

	== Prevention Policies ==		== Prevention Policies ==
			Which policies could have prevented this event from happening?

	== References ==		== References ==
	[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10)		<references><ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10, 2021)</ref>

	[https://blocksecteam.medium.com/deposit-less-get-more-ycredit-attack-details-f589f71674c3 Deposit Less Get More Ycredit Attack Details] (Aug 10)		<ref name="blocksecteammedium-3055">[https://blocksecteam.medium.com/deposit-less-get-more-ycredit-attack-details-f589f71674c3 Deposit Less Get More Ycredit Attack Details] (Aug 10, 2021)</ref>

	[https://github.com/banteg/exploit-ycredit GitHub - banteg/exploit-ycredit] (Aug 10)		<ref name="banteggithub-3056">[https://github.com/banteg/exploit-ycredit GitHub - banteg/exploit-ycredit] (Aug 10, 2021)</ref>

	[https://ycredit.finance/ ycredit] (Aug 20)		<ref name="ycreditfinance-3057">[https://ycredit.finance/ ycredit] (Aug 20, 2021)</ref>

	[https://www.youtube.com/watch?v=QyN0mSfgkeo Staking $100 in yCredit.Finance. What Are the Risks? \| QDeFi - YouTube] (Sep 17)		<ref name="youtube-3058">[https://www.youtube.com/watch?v=QyN0mSfgkeo Staking $100 in yCredit.Finance. What Are the Risks? \| QDeFi - YouTube] (Sep 17, 2021)</ref>

	[https://rekt.news/ycredit-the-ape/ Rekt - yCredit the Ape] (Sep 17)		<ref name="rektnews-3059">[https://rekt.news/ycredit-the-ape/ Rekt - yCredit the Ape] (Sep 17, 2021)</ref>

	[https://twitter.com/0xdeadf4ce/status/1345388627694661632 @0xdeadf4ce Twitter] (Sep 17)		<ref name="0xdeadf4cetwitter-3060">[https://twitter.com/0xdeadf4ce/status/1345388627694661632 @0xdeadf4ce Twitter] (Sep 17, 2021)</ref>

	[https://etherscan.io/address/0xe0839f9b9688a77924208ad509e29952dc660261 StableYieldCredit \| 0xe0839f9b9688a77924208ad509e29952dc660261] (Sep 17)		<ref name="etherscan-3061">[https://etherscan.io/address/0xe0839f9b9688a77924208ad509e29952dc660261 StableYieldCredit \| 0xe0839f9b9688a77924208ad509e29952dc660261] (Sep 17, 2021)</ref>

	[https://etherscan.io/address/0x71b6296174c5f07d37cafd6e9b72ab5bb3f14fac StableYieldCredit \| 0x71b6296174c5f07d37cafd6e9b72ab5bb3f14fac] (Sep 17)		<ref name="etherscan-3062">[https://etherscan.io/address/0x71b6296174c5f07d37cafd6e9b72ab5bb3f14fac StableYieldCredit \| 0x71b6296174c5f07d37cafd6e9b72ab5bb3f14fac] (Sep 17, 2021)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/ycreditfinancemintingvulnerability.php}} YCredit FinanceYCredit Finance was launched as a test smart contract, where word quickly spread, even though it was not announced in any official channels. The smart contract had an exploit which allowed the effective minting of additional tokens, causing a massive price drop. The contract was ultimately redeployed in the..."

2023-01-25T19:29:24Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/ycreditfinancemintingvulnerability.php}} thumb|YCredit FinanceYCredit Finance was launched as a test smart contract, where word quickly spread, even though it was not announced in any official channels. The smart contract had an exploit which allowed the effective minting of additional tokens, causing a massive price drop. The contract was ultimately redeployed in the..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/ycreditfinancemintingvulnerability.php}}

[[File:Ycreditfinance.jpg|thumb|YCredit Finance]]YCredit Finance was launched as a test smart contract, where word quickly spread, even though it was not announced in any official channels.

The smart contract had an exploit which allowed the effective minting of additional tokens, causing a massive price drop.

The contract was ultimately redeployed in the future, however those affected do not appear to have received any consideration.

This is a global/international case not involving a specific country.

== About YCredit Finance ==
"At the end of 2020, Andre Cronje, a DeFi Architect and creator of Yearn Finance, presented a new experimental DeFi project called yCredit.Finance." "On the 1st January, Cronje announced the launch of tokenised yield credit via yCredit. As he no longer uses Twitter, this announcement was made with little fuss via a Medium post."

"This project is in beta. Use at your own risk."

"When Nour Haridy made a public announcement on Twitter, warning people to withdraw from the contracts, he was accused of clout chasing, and abandoning responsible disclosure in exchange for self-promotion."

"On January 2, 2021 (Beijing Time 07:25am), [the BlockSec team] monitoring system ThunderForecast reported a series of suspicious transactions towards the yCREDIT smart contract."

"The attack is due to the number of tokens minted is inconsistent with the intended one. As such, the attacker can get more numbers of yCREDIT tokens with lower price. Then these tokens can be sold to gain profits." "The vulnerable function is in the _deposit function of the StableYieldCredit contract."

"The attacker first transferred 1e-8 WBTC and 331.335 yCredit tokens to the WBTC-yCREDIT Pair pool. Then the attacker deposited 0.5 WBTC to the StableYieldCredit contract to launch the attack."

"Specifically, the _value is calculated using the amount (0.5) of the token (0x2260fac5e5542a773aa44fbcfedf7c193bc2c599 - WBTC) based on the price oracle provider ChainLink (line 480, _value is 1466786010075). The intention is to calculate the value of the deposited WBTC in USD. Then the contract will transfer the number of yCREDIT tokens (_value - fee) to the one who deposited the WBTC (the attacker). That's because the value of yCREDIT equals one USD (as designed by the system). Everything is fine except the attacker loses a small amount of fee."

"Moreover, the contract will add the deposited WBTC to the WBTC-yCREDIT Pair pool. That’s because if the deposited WBTC is locked into the contract, it will lose liquidity. As such, it first calculated the value of the token pair (WBTC to yCREDIT) that will be put into the pool. This value is calculated using the function _addLiquidity. Basically, it is calculated based on the existing reserves inside the pool. Since the pool only has 1e-8 WBTC and 331.335 yCREDIT tokens, the amountA calculated is 44 (amountB is 1466786010075). That means the attacker only spends 44e-8 WBTC (line 485) and gets 14667.86010075 - fee = 14594.52080025 yCREDIT tokens (line 493). At the same time, there is a small number of WBTC ( 1e-8 + 44e-8) and ( 331.335 + 14667.86010075) yCREDIT tokens leaving in the pool."

"To get profits, the attacker can simply trade the gained 14594.52080025 yCREDIT tokens in exchanges. Interestingly, the process to gain profits in this transaction is far more complicated than necessary. We have also observed a clever attacking strategy in other transactions."

"The contract has been redeployed, clout and cash has been redistributed, and we move on." "There is an new smart contract that fixes the vulnerability."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - yCredit Finance Minting Vulnerability
!Date
!Event
!Description
|-
|January 1st, 2021 12:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==

== References ==
[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10)

[https://blocksecteam.medium.com/deposit-less-get-more-ycredit-attack-details-f589f71674c3 Deposit Less Get More Ycredit Attack Details] (Aug 10)

[https://github.com/banteg/exploit-ycredit GitHub - banteg/exploit-ycredit] (Aug 10)

[https://ycredit.finance/ ycredit] (Aug 20)

[https://www.youtube.com/watch?v=QyN0mSfgkeo Staking $100 in yCredit.Finance. What Are the Risks? | QDeFi - YouTube] (Sep 17)

[https://rekt.news/ycredit-the-ape/ Rekt - yCredit the Ape] (Sep 17)

[https://twitter.com/0xdeadf4ce/status/1345388627694661632 @0xdeadf4ce Twitter] (Sep 17)

[https://etherscan.io/address/0xe0839f9b9688a77924208ad509e29952dc660261 StableYieldCredit | 0xe0839f9b9688a77924208ad509e29952dc660261] (Sep 17)

[https://etherscan.io/address/0x71b6296174c5f07d37cafd6e9b72ab5bb3f14fac StableYieldCredit | 0x71b6296174c5f07d37cafd6e9b72ab5bb3f14fac] (Sep 17)