Briefing
A critical vulnerability in a legacy yETH stableswap pool contract resulted in a $9 million theft of liquid staking assets. The exploit leveraged a flaw in the token’s minting logic, enabling the attacker to create an unlimited supply of synthetic yETH. This inflated token supply was then used to systematically drain the underlying ETH and liquid staking tokens from the associated Balancer and Curve pools. The incident highlights the persistent risk posed by deprecated or custom-coded smart contracts, with approximately $3 million of the stolen funds immediately laundered through a crypto mixer.
Context
The affected contract was a custom implementation of a popular stableswap mechanism, designed to aggregate liquid staking tokens. Despite the protocol’s migration to newer, audited V2 and V3 vaults, this older, isolated contract remained operational with significant Total Value Locked. This architecture created a vulnerable perimeter → a single, legacy smart contract with an inherent mathematical error was left exposed, circumventing the security posture of the main protocol.
Analysis
The attacker executed a multi-step transaction by first targeting the yETH token’s mint function. The underlying logic contained a mathematical error that failed to correctly account for the value of the deposited collateral, allowing the minting of an estimated 235 trillion yETH tokens without adequate backing. The attacker then used this massively inflated supply of synthetic yETH to swap for and drain the real assets (wstETH, rETH, cbETH) from the linked Balancer and Curve liquidity pools in a single, atomic transaction. The success was due to the pools treating the newly minted yETH as valid collateral, effectively turning a token logic flaw into a total pool drain.
Parameters
- Total Loss Valuation → ~$9 Million USD (Total assets drained from the affected pools).
- Minted Token Count → 235 Trillion yETH (Synthetic tokens created in the exploit).
- Laundered Funds → ~$3 Million USD (Amount immediately sent to Tornado Cash).
- Affected Asset Type → Liquid Staking Tokens (The underlying collateral drained, including wstETH and rETH).
Outlook
Protocols must immediately conduct a comprehensive audit of all legacy, custom, or deprecated contracts, especially those with non-standard token accounting or pool logic. Users must migrate funds from older, non-core pools to V3 vaults or similar, actively maintained products. This incident establishes a new best practice → all contracts, regardless of their operational status, must be formally decommissioned or subjected to the same rigorous, ongoing security monitoring as core systems to prevent systemic risk from perimeter flaws.
Verdict
The exploit of a legacy contract via an infinite minting flaw confirms that perimeter security vulnerabilities in deprecated DeFi infrastructure pose an existential threat to user capital.
