Briefing
A sophisticated attacker exploited a critical logic flaw in the Yearn Finance legacy yETH token contract, enabling the unauthorized minting of a near-infinite token supply. This supply manipulation allowed the attacker to drain associated Balancer and Curve liquidity pools by swapping the fake tokens for real assets. The primary consequence is an immediate capital loss and a systemic failure of trust in the deprecated contract’s security posture. Forensic analysis confirms a total loss of approximately $9 million, with a portion immediately routed through a privacy mixer.
Context
The prevailing risk factor in this incident was the continued existence of a legacy smart contract that was no longer actively maintained but still held significant user liquidity. This outdated architecture, specifically a custom stableswap implementation, created a vulnerable attack surface separate from the protocol’s modern, audited V2 and V3 vaults. The known class of vulnerability leveraged here is a token minting logic error, a high-severity flaw that grants complete control over asset supply when triggered.
Analysis
The attacker compromised the yETH token contract, which contained a flaw in its custom stableswap logic that governs the token’s minting function. This logic error allowed the creation of an astronomical number of yETH tokens → estimated at 235 trillion → in a single transaction. The chain of effect began with the attacker leveraging this newly minted, worthless supply to exchange it for valuable, liquid assets (ETH and LSTs) from the paired Balancer and Curve liquidity pools.
The success of the exploit was due to the external pools trusting the inflated, fake yETH balance as valid collateral for a swap, thereby draining the real assets. The rapid execution and immediate laundering of approximately $3 million in ETH through a privacy protocol confirm a high level of operational security from the threat actor.
Parameters
- Total Funds Lost → $9 Million (The combined approximate loss from the yETH stableswap pool and the yETH-WETH Curve pool).
- Exploit Vector → Infinite Token Minting Flaw (A logic error in the custom yETH stableswap contract).
- Laundered Amount → 1,000 ETH (Approximately $3 million, sent to Tornado Cash to obscure the trail).
- Vulnerable Component → Legacy yETH Stableswap Pool (The specific contract containing the minting logic flaw, isolated from V2/V3 vaults).
Outlook
Immediate mitigation for users involved in similar legacy systems is to withdraw all capital from any deprecated or unmaintained contracts, regardless of past audit history. The second-order effect is a heightened contagion risk for other protocols that rely on custom stableswap code or maintain similar legacy infrastructure, mandating immediate, comprehensive code review. This incident establishes a new security best practice → the implementation of mandatory, irreversible contract decommissioning to prevent future exploitation of dormant, yet funded, attack vectors.
Verdict
The Yearn legacy exploit is a definitive case study proving that unmaintained, funded smart contracts represent an unacceptable, systemic liability that must be zeroed out to secure the digital asset ecosystem.
