Briefing
The Yearn Finance protocol suffered a critical economic exploit on its legacy yETH stable-swap pool, resulting in a loss of approximately $9 million in various liquid staking tokens (LSTs). The primary consequence was the complete depletion of the affected pool’s liquidity, directly impacting users who had deposited assets into the older yETH product. Forensic analysis confirms the attack vector was a logic flaw that allowed the malicious minting of a near-infinite number of fake yETH tokens, enabling the attacker to withdraw real underlying assets in a single, complex transaction. This incident underscores the disproportionate risk presented by deprecated smart contracts within mature DeFi ecosystems.
Context
The security posture of many multi-vault DeFi protocols remains exposed to risks within legacy or custom-built contracts that were not subjected to the same rigorous, post-flash-loan-era auditing standards. This vulnerability class is often found in bespoke token logic, where the internal accounting or minting function of a stable-swap pool is not sufficiently protected against an adversarial input. The incident confirms that a protocol’s main, active vaults can be 100% secure while older, un-migrated contracts represent a critical, unaddressed attack surface.
Analysis
The attacker compromised a custom stable-swap pool by exploiting a flaw in its internal minting logic related to the yETH token. The core mechanism involved supplying a minimal amount of collateral to the pool, then manipulating the contract’s internal state to trick it into calculating an arbitrarily large, near-infinite amount of new yETH tokens for the attacker. With these newly minted, valueless tokens, the attacker then withdrew the pool’s real, valuable collateral → primarily wstETH, rETH, and cbETH → before quickly bridging and laundering a significant portion of the stolen funds via a privacy mixer. The success of the exploit hinged on the contract’s failure to properly validate the input and output amounts during the token minting process.
Parameters
- Total Loss → $9 Million – The approximate total value of assets drained from the legacy yETH pools.
- Vulnerability Type → Infinite Mint Logic Flaw – A critical bug in the stable-swap contract’s accounting for new token issuance.
- Affected Product → Legacy yETH Pool – The specific, older version of the yETH product that was compromised.
- Laundered Funds → $3 Million – The approximate amount of stolen ETH moved to a privacy mixer.
Outlook
Protocols utilizing custom or legacy smart contract logic, especially those involving token minting and liquid staking tokens (LSTs), must immediately initiate a comprehensive, third-party audit of all non-standard functions. For users, the immediate action is to migrate funds out of any deprecated or legacy pools, as these represent a disproportionate attack surface. This exploit will likely set a new best practice for LST pool design, mandating formal verification of all minting and withdrawal logic to prevent similar economic attacks and contain contagion risk to other DeFi protocols with similar contract architectures.
Verdict
This $9 million exploit serves as a definitive operational warning that the greatest systemic risk in mature DeFi protocols often resides within un-migrated, unaudited legacy contracts.
