Briefing
The Yearn Finance legacy yETH StableSwap pool was exploited for approximately $9 million via a sophisticated token minting attack. The attack leveraged a critical flaw in the pool’s custom accounting logic, allowing the malicious actor to mint an astronomical supply of yETH tokens and drain the underlying liquid staking assets. This incident is notable because the attacker successfully minted 235 septillion yETH with a minimal 16 wei deposit, highlighting an extreme capital-efficiency vector.
Context
The prevailing attack surface in DeFi is increasingly shifting toward technical debt vulnerabilities within custom or legacy contracts running alongside newer, more secure versions. This incident specifically leveraged an older yETH pool, which operated on a separate code path from the protocol’s main V2 and V3 vaults. The core risk was a critical, unhandled state in the contract’s accounting introduced by gas-optimization techniques.
Analysis
The compromise targeted a Cached Storage Flaw within the pool’s internal accounting, which used packed_vbs variables to cache virtual balances for gas efficiency. The attacker first executed multiple deposit-and-withdrawal cycles using flash-loaned funds, deliberately accumulating residual, non-zero values in this storage cache. Upon the final withdrawal, the main supply counter correctly reset to zero, but the cached storage values remained populated, or “stale.” A subsequent minimal deposit of 16 wei triggered the contract’s “first-ever deposit” logic, which incorrectly read the stale, inflated cache values, allowing the attacker to mint a near-infinite token supply to drain the pool’s assets.
Parameters
- Total Loss Estimate → $9,000,000 – Total value of liquid staking tokens and WETH drained from the pools.
- Exploited Token Supply → 235 Septillion yETH – The astronomical number of tokens minted from a dust deposit.
- Initial Deposit Cost → 16 Wei – The minimal amount of capital required to trigger the exploit logic.
- Recovered Funds → $2.4 Million – Assets successfully recovered through coordinated efforts with DeFi partners.
Outlook
Protocols must now prioritize aggressive and complete deprecation of legacy contracts, as the risk from technical debt is clearly quantifiable. Immediate mitigation for all DeFi protocols involves a systematic review of gas-optimization logic, specifically focusing on state variables that are cached and not fully reset to zero during complete liquidity withdrawals. This event reinforces the need for formal verification tools that specifically model and test for edge-case state transitions, especially those involving arithmetic after a pool has been fully drained.
Verdict
The exploit serves as a definitive case study that legacy smart contract arithmetic flaws and stale state variables represent a systemic, high-leverage attack vector against even the most established DeFi pioneers.
