Briefing
The Yearn Finance legacy yETH product was compromised via an economic exploit that leveraged a logic flaw in its underlying stableswap pool contract. The primary consequence was the unauthorized minting of a near-infinite supply of yETH tokens, allowing the attacker to drain the pool of its underlying liquid staking assets. This incident, isolated to the older product, resulted in a total financial loss of approximately $9 million in various Ethereum-based tokens.
Context
This exploit highlights the persistent risk associated with maintaining legacy smart contracts, especially those integrated with complex, custom-built financial primitives like stableswap logic. The prevailing attack surface remains in bespoke contract code where subtle mathematical or rounding errors can be weaponized into full economic exploits. The incident was isolated to the yETH product, which had not been updated to the latest security standards of the V3 vaults.
Analysis
The attack vector exploited a flaw within the custom stable-swap pool’s internal calculation logic, specifically the function responsible for determining the value of yETH. The attacker first manipulated the pool’s state by exploiting this logic, enabling them to mint an arbitrarily large amount of yETH tokens in a single transaction. With this inflated balance, the attacker then withdrew a disproportionate amount of the pool’s real underlying assets, including wstETH and rETH, effectively draining the liquidity. The exploit was a targeted economic manipulation, not a simple private key compromise or administrative failure.
Parameters
- Total Funds Drained → $9 million → The total value of liquid staking tokens and ETH removed from the affected pools.
- Vulnerability Type → Infinite Mint Logic Flaw → A bug in the stableswap contract allowed for arbitrary token creation.
- Affected Product → Legacy yETH Stableswap Pool → The exploit was isolated to the older version of the product.
- Mitigation Status → Router Paused, V1.1 Contract Deployed → The protocol immediately paused the affected router and deployed a patched contract.
- Reimbursement Plan → Governance proposal passed to reimburse $3.2M from treasury → A commitment to cover user losses from corporate reserves.
Outlook
Protocols must immediately establish and enforce clear deprecation policies for all legacy contracts to minimize the long-tail risk of unaudited or outdated code. For users, the immediate mitigation is to withdraw all assets from any V1 or legacy pools that are not explicitly marked as secure and migrated to V3 architecture. This event will likely set a new precedent for auditing standards, requiring dedicated scrutiny on custom mathematical functions within stableswap and other automated market maker contracts to prevent similar precision-based economic exploits.
Verdict
This $9 million exploit serves as a definitive operational mandate that the greatest systemic risk in DeFi is the persistent, unmitigated threat posed by legacy smart contract infrastructure.
