Legacy Staking Pool Exploited via Synthetic Token Inflation Logic → Security

A geometrically faceted Ethereum symbol, resembling a crystal, is partially submerged in a dynamic, icy blue liquid, set against a futuristic dark gray and blue digital display. The screen beneath the liquid exhibits illuminated circuit board pathways and abstract data visualizations in various shades of blue

A large, faceted, translucent blue object, resembling a sculpted gem, is prominently displayed, with a smaller, dark blue, round gem embedded on its surface. A second, dark blue, faceted gem is blurred in the background

Briefing

A critical vulnerability in a legacy yETH stableswap pool contract resulted in a $9 million theft of liquid staking assets. The exploit leveraged a flaw in the token’s minting logic, enabling the attacker to create an unlimited supply of synthetic yETH. This inflated token supply was then used to systematically drain the underlying ETH and liquid staking tokens from the associated Balancer and Curve pools. The incident highlights the persistent risk posed by deprecated or custom-coded smart contracts, with approximately $3 million of the stolen funds immediately laundered through a crypto mixer.

A detailed view shows an intricate, silver-toned mechanical or electronic component partially submerged in a vibrant, translucent blue liquid, adorned with numerous white bubbles. The metallic structure features precise geometric patterns and exposed internal elements, suggesting advanced engineering

Context

The affected contract was a custom implementation of a popular stableswap mechanism, designed to aggregate liquid staking tokens. Despite the protocol’s migration to newer, audited V2 and V3 vaults, this older, isolated contract remained operational with significant Total Value Locked. This architecture created a vulnerable perimeter → a single, legacy smart contract with an inherent mathematical error was left exposed, circumventing the security posture of the main protocol.

A modern office workspace, characterized by a sleek white desk, ergonomic chairs, and dual computer monitors, is dramatically transformed by a powerful, cloud-like wave and icy mountain formations. This dynamic scene flows into a reflective water surface, with concentric metallic rings forming a tunnel-like structure in the background

Analysis

The attacker executed a multi-step transaction by first targeting the yETH token’s mint function. The underlying logic contained a mathematical error that failed to correctly account for the value of the deposited collateral, allowing the minting of an estimated 235 trillion yETH tokens without adequate backing. The attacker then used this massively inflated supply of synthetic yETH to swap for and drain the real assets (wstETH, rETH, cbETH) from the linked Balancer and Curve liquidity pools in a single, atomic transaction. The success was due to the pools treating the newly minted yETH as valid collateral, effectively turning a token logic flaw into a total pool drain.

The image displays a close-up, high-fidelity rendering of an intricate mechanical or digital component. It features concentric layers of white and blue textured materials surrounding a central array of radiating white bristles, all encased within metallic and white structural elements

Parameters

Total Loss Valuation → ~$9 Million USD (Total assets drained from the affected pools).
Minted Token Count → 235 Trillion yETH (Synthetic tokens created in the exploit).
Laundered Funds → ~$3 Million USD (Amount immediately sent to Tornado Cash).
Affected Asset Type → Liquid Staking Tokens (The underlying collateral drained, including wstETH and rETH).

Intricate metallic structures are visibly submerged within a luminous, effervescent blue fluid, forming the operational heart of a sophisticated mechanism. Cylindrical components and precise gearing elements are partially visible in the background, hinting at complex internal dynamics

Outlook

Protocols must immediately conduct a comprehensive audit of all legacy, custom, or deprecated contracts, especially those with non-standard token accounting or pool logic. Users must migrate funds from older, non-core pools to V3 vaults or similar, actively maintained products. This incident establishes a new best practice → all contracts, regardless of their operational status, must be formally decommissioned or subjected to the same rigorous, ongoing security monitoring as core systems to prevent systemic risk from perimeter flaws.

A close-up view captures a highly detailed, intricate mechanical assembly, partially submerged or encased in a translucent, flowing blue material. The metallic components exhibit precision engineering, featuring a prominent central lens-like element, geared structures, and interconnected rods, all gleaming under precise lighting

Verdict

The exploit of a legacy contract via an infinite minting flaw confirms that perimeter security vulnerabilities in deprecated DeFi infrastructure pose an existential threat to user capital.

smart contract flaw, infinite minting, synthetic asset, stableswap pool, token inflation, legacy contract, liquid staking, pool drain, asset theft, defi security, onchain exploit, custom logic, token accounting, perimeter risk, smart contract audit Signal Acquired from → dlnews.com