YFValue Exploit Found

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Value DeFi

In this issue, YFValue (precursor to Value DeFi) almost loses access to a very large portion of liquid funds on the platform.

They upgrade to a new platform, but some people still insist on using the old one. Some of those individuals who had their funds at threat, decide to extort the project in an attempt to recover the funds. The project finds that there is a way to access the funds and reimburse affected users, so nothing is lost.

This is a global/international case not involving a specific country.

About Value DeFi

"YFValue launched in August 2020 as a DeFi yield aggregator that focuses on bringing a decentralized experience to truly everyone, including smaller and bigger investors. The goal was to completely transfer the project’s ownership and decision-making process to the community, backed by YFV as its governance token."

"YFValue was launched anonymously and fairly, meaning the team also didn’t start farming earlier than everyone else. It was announced in a Medium post titled “YFV: Bring True Value to Yield Farming” on Aug 16. The project was launched sometime after that." "YFV is the governance token of YFValue protocol. The project aims to bring the true value of yield farming finance accessible to all users, regardless of whether you are a big whale or small minnow, via its unique features, namely the voting of the inflationary rate of the supply and a referral system with automatic burning done fully on-chain."

"On Monday, August 24th, the team identified an exploit for the YFV staking pool that enables malicious actors to individually reset timers for staked YFV. This attack is not economically sustainable in the long run due to gas fees, but hackers could still delay YFV claims and inconvenience members of the community who have staked their YFV. A malicious actor is currently attempting to extort the team by threatening this tactic."

"To those who were unaware, there was an incident in our initial deployment of the seed (stablecoin) pool, which we’ve titled “Pool 0” (contract address). We owe you a complete explanation of what happened and our decision-making process."

"On our initial launch day of YFValue (Monday 17/8/2020 08:00:00 GMT+0) we made a human error by clicking on the wrong tx confirmation when trying to remove our control of the pool. For the more technically aware, the steps that needed to be taken were to set governance to “0x0” to revoke ownership. Unfortunately, we accidentally clicked the “revoke ownership tx” out of order, and the transaction settled so that we could not set governance anymore. The risk would be us calling the notifyRewards function to lock down the ability to withdraw funds (which obviously we would never do)."

"As communicated by the team of YFV protocol, a fork of yearn finance, one of the pools of the DeFi project has been badly configured and this has created great concern in the community. For this reason, the team is working with Arcadia Group to audit the code and eliminate the present anomalies that could also lead to a loss of funds."

"We are very pleased that the Audit of YFV Staking Pool v2 has been completed successfully by The Arcadia Group. The audit was carried out by Arcadia’s engineer Minh Khai Do with summaries by Rasikh Morani and Joel Farris."

"Realizing this error and in the spirit of true decentralization, we decided to relaunch the next day by opening another seed pool (Pool v2) while penalizing ourselves by burning the equivalent amount of tokens from our dev fund. The extra YFV generated by pool 0 for its epoch was 0.3% of 21M YFV, and having burned that amount we had considered the matter concluded."

"Despite this problem, which led to the creation of Pool v2 and the burning of the team’s tokens, some users continued to use this pool." "However, clever members of the community noticed our mistake and took advantage of it by continuing to farm in pool 0 despite our warnings, despite our removal of the frontend UI. As there was no way we could stop this activity, we made the decision to burn the minter key. This key burn would cause tx failure at checkNextEpoch (08/24/2020 @ 7:52am (UTC), an event which we hoped would serve as a deterrent."

"Despite our best efforts, nonetheless we are aware that there is a possibility that some miners in the pool may forget to remove their funds before this critical deadline. As a consequence, their staked capital would be lost forever. While we are not particularly sympathetic to this “selfish mining”, the discovery of vUSD and vETH minting keys have given us a more elegant solution to this issue."

"Inform all stakers to stop staking YFV in the current staking pool and to remove their funds as soon as their timers allow. We have removed the staking option on the frontend UI for this purpose."

"And this is where the team had to make the drastic decision to destroy the minter key and then lock the pool’s funds." "But the problems did not end there, because due to an exploit it would still be possible to recover the minter key and allow the team to recover the users’ funds that were locked." "So, the team decided to split these keys into a multi-signature in order to share the risk and to have at least the majority of signatures to access these keys and perform the token recovery transaction."

"Compensate any community members (if any) affected by timer reset attacks who for whatever reason did not benefit from the rescue plan. We will draw upon our Dev fund (~300K YFV) to make affected community members whole."

"Nonetheless, we are committed to providing complete transparency, protect staked funds, and do whatever necessary to preserve and improve the community’s trust in the YFV project now and going forward. Thank you for your time and for contributing to the YFV ecosystem. Please anticipate an update and better news as the situation unfolds."

"In the upcoming weeks, we will update our marketing literature and online presence with this new branding. Meanwhile, we invite our business partners to contact us for the latest descriptions and links for updates if applicable."

"[W]e would like to thank the YFV community for your interest and trust in this project. Furthermore, thank you for your understanding and patience as we do our best to unwind and deliver fair solutions to these development oversights. Overall, the YFV community remains strong, and we look forward to delivering additional products and exciting announcements in the days ahead."

"By October, the developer team decided to rebrand to Value DeFi in an effort to distance itself from its yearn-like theme. It is also worth noting that the platform suffered a hack a couple of months earlier, which is probably one of the major reasons why the rebranding has occurred."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - YFValue Exploit Found

Date	Event	Description
August 24th, 2020	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

One of the key recommendations is for all customer funds to be kept in offline multi-signature wallets. As part of multi-signature, redundancy is created through extra signatures and individual holders having secure backups, which prevents the complete loss of funds.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.