IBase/YFFS Founders Leave

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

YFFS Homepage

I was unable to find any evidence of any smart contract vulnerability being exploited by the team. It appears to be more the case that they launched and then decided to cash out and abandon the project.

Based on CoinGecko, it looks like $260k worth of YFFS token market cap was lost in total on the "rug pull" day. The project appears to still exist with a token price above $1, although the official website, Twitter, and Telegram group are all unusable at present.

About YFFS

"YFFS [was] a fork of yearn.finance. Conceived in the knowledge that the DeFi sphere’s complex jargon and technology excludes many investors; YFFS’s product-rich platform is built with a focus on simplicity and accessibility – aiming to be inclusive of even the newest crypto enthusiasts. In the world of blockchain, actions speak loudest, and the consistent and impressive actions of YFFS developers demonstrate the team’s unflinching commitment to building with conviction and innovation, while being uniquely receptive to the community’s needs."

The YFFS platform had 6 features: (1) "Swap Move tokens between blockchains effortlessly without relying on a central custodian. Best new Technology in transaction — YFFS uses the latest in multi-party computing (MPC) and threshold signature cryptography (TSS) research." (2) "Hold on to your Tokens to earn rewards for each swap transaction you help to co-sign with the open-source node code. Staking your asset using the Staking portal. Anyone can become a validator on mainnet and share the non-inflationary network rewards, supporting the next wave of adoption!" (3) "APR is a table that shows you the current APR for some yearn — supported tokens across lending platforms. The highest APR for each coin is the provider that Earn is lending these coins to at the moment." (4) "A Vault takes a more active approach than simply lending out coins for the highest APY (Annual Percentage Yield). Via strategies, it can farm coins to higher profits than simple lending. Yield is achieved by providing the asset for lending, LP, or farming strategies. These are opportunities that exist in DeFi. Vaults automate these processes and provide the highest (risk-adjusted) yield available." (5) "Yearn Improvement Proposal is how features are added to the yearn ecosystem. Users start a proposal on the forum, discuss it, and gauge the sentiment of if the proposal will be accepted. If a lot of users agree with it, then it can be posted on-chain for everyone to vote on." (6) "Stake your YFFS and then you can cast your vote that is on-chain on the voting dashboard."

"The YFFS launch was fair, meaning the team didn’t start farming miles ahead of everyone else. Announced in a Medium post on September 1; the project’s planned features were outlined along with token distribution and proof of locked liquidity. The project was launched just 24 hours later, with only limited farming available and less than a day later had already seen in excess of $2,000,000 in transactions."

"While many DeFi projects have chosen not to audit, at times with disastrous consequences for investors, the YFFS team have chosen to engage professional auditors. The audit is currently ongoing and the results are eagerly awaited. It is worth noting that a number of community members have reviewed the contracts themselves and none have reported any major concerns." "DefiYield.info, a respected auditor on Twitter has also reviewed the project and code and had only positive things to say."

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - iBase/YFFS Founders Leave

Date	Event	Description
December 11th, 2020 4:28:35 PM MST	Liquidity Removal Transaction	A transaction removes liquidity from the iBase smart contract.
December 14th, 2020 1:32:08 AM MST	DC Forecasts Article	DC Forecasts reports that investors in the Ethereum DeFi space faced three "rug-pull" scams that resulted in losses of $1.2 million. These scams involved conducting "pre-sales" for projects, where investors' ETH was collected and then the funds were drained to external wallets and sold. The projects affected included DeTrade Fund, DeFib, and iBase/YFFS. A Twitter user named "Artura$" identified the operators of DeTrade Fund as being from Lithuania. Investors affected by these scams pressured the operators to return the stolen funds. After a tweet exposing the scammers, addresses affiliated with them returned about 70% of the stolen funds to pre-sale participants, with the remaining funds to be returned via Tornado Cash. A similar approach was used to pressure scammers of other projects. The status of the funds involved in the iBase/YFFS scam remains uncertain.
December 14th, 2020 8:54:55 AM MST	Real Cryptocurrency Hub Article	Real Cryptocurrency Hub reports that a series of scams in the Ethereum space resulted in losses of around $1.2 million for investors. Exploiting weak security systems, scammers conducted "pre-sales" for projects including DeFiB, iBase/YFFS, and DeTrade Fund, but instead of releasing the purchased coins, they diverted them to external wallets. Investors pressured DeTrade Fund and DeFiB to return stolen Ethereum, with the DeTrade Fund scam being the most significant, stealing 1,400 ETH (worth about $1 million). Crypto analyst "Artura$" used social media to identify the scammers as Lithuanians and threatened them, prompting the return of some funds. DeFiB's operators offered a partial refund to investors, with approximately 70% of stolen funds being returned. The iBase/YFFS scam remains unresolved. These incidents underscore the challenges facing the cryptocurrency space, potentially impacting its credibility. Despite this, efforts to track down scammers could lead to the return of stolen funds.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

A transaction removes liquidity from the iBase smart contract.

"Remove 253,877.725167383 iBASE And 417.06231029978257777 Ether Liquidity From Uniswap V2"

Total Amount Lost

The total amount lost has been estimated at $260,000 USD.

"Remove 253,877.725167383 iBASE And 417.06231029978257777 Ether Liquidity From Uniswap V2"

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

"The thousands of dollars worth of ETH involved iBase/YFFS is still at large." "It is worthy to note that the hundreds of thousands of dollars worth of Ethereum involved in iBase/YFFS, have yet to be returned and the scam is yet to be uncovered."

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.