Value DeFi On Sale Again

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Value DeFi

ValueDeFi was previously breached in November 2020, which was actually their second issue, since they had another issue where funds were at risk in August 2020.

Their solution was to mint additional tokens, which would obviously devalue the tokens. They plan to offset that by minting more tokens.

This is a global/international case not involving a specific country.

About Value DeFi

"Before rebranding, the DeFi space knew Value DeFi as YFValue (YFV). The project was inspired by the Yearn Finance protocol, a platform designed exclusively to cater to yield farmers."

"Value DeFi is a compilation of products and services for the decentralized finance sector that brings innovation and fairness to the community. This project’s main goals are to increase accessibility to yield farming, provide on-chain governance voting, reward stakeholders with flexible yield strategies, and protect user funds through insurance treasuries."

"The Value DeFi suite contains five unique products and services." "vStake is an additional level to Value DeFi’s vSwap, designed as a massive improvement to conventional staking pools. vStake pools are actually active liquidity, while your standard single asset staking pools are dead liquidity. This may appear similar to vFarm, but all vStake pools are created to be 98/2 ratio, which should be noted that other AMMs are not capable of doing. This 98/2 ratio limits any potential impermanent loss to almost nothing. Even with 98/2 pools, vStake is still subjected to all the benefits of vSwap’s with the best exchange rates and slippages. Also, vStake is designed to be the perfect product to farm with your vBSWAP tokens and/or rewards. vBSWAP is a part of the Value DeFi BSC ecosystem, created to serve as a profit-share and incentive token."

"On May 5th 2021, 3:22 AM UTC, the exploiter re-initialized the pool and set the operator role to himself and _stakeToken to HACKEDMONEY. By doing so, the exploiter took control of the pool and called the method governanceRecoverUnsupported() and drained the original stake token (vBWAP/BUSD LP)."\

"The affected pool contract had an initialize() function that should have been activated after deployment."

"The line: initialized = true; is missing from the function."

"This meant anyone could re-initialize the pool and set themself as owner, thereby taking full control. As owner, the exploiter used the governanceRecoverUnsupported(), which is used for recovering pool funds in the event of a bug or undesired event."

"During set up of the profit-sharing vStake pool, the code was not written from scratch but migrated from the old implementation of the Value DeFi Reserve Fund, which had the correct setting. When merging the code, the line was not included."

"Then, the exploiter removed 10,839.16 vBWAP/BUSD LP, then removed liquidity and received 7342.75 vBSWAP and 205,659.22 BUSD."

"The exploiter then sold all 7342.75 vBSWAP for 8790.77 BNB at 1inch. Then, the exploiter used both BNB and BUSD to buy renBTC and use renBridge to move the funds back to BTC, which is laundered to the address 1Cm6WGvXQ9EgvvWX5dRsBxE2NvxFjfbcVF."

"In the end, the hacker was the only one who got their value for their money, a ten million dollar prize without even taking out a loan."

"We will make the community whole again by voting as a collective on the best resolution."

"Option 1: Mint 4540 vBSWAP to compensate all affected users immediately." "After the mint, the subsequent vBSWAP accumulated by the Reserve Fund will be burned over the next 6 months. At which point the extra 4540 vBSWAP will be completely burned, reducing the supply back to normal."

"From our pace of innovation on the bleeding edge of cross-chain DeFi, unfortunately by definition there will always be an element of risk with new deployments. Nonetheless, as laid out in our Missions and Values along with our track record in the space, the community can rest assured that we continue to work tirelessly with our community’s economic benefit and well-being in mind."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Value DeFi On Sale Again

Date	Event	Description
May 5th, 2021	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $10,000,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

Decentralized finance is extremely complicated, and these smart contracts function as immutable hot wallets.

In this case, the team failed to copy code correctly, and the contract was exploited. It's yet more evidence that a project, despite a previous audit and despite being hacked before, is still not secure.

The only secure storage of funds is in an offline multi-signature wallet. It would also be recommended that any customer funds only be handle by trained and background checked individuals.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.