Briefing
The Yearn Finance yETH stableswap pool was compromised via a critical logic flaw in its legacy smart contract, resulting in a total loss and systemic imbalance across the Liquid Staking Token (LST) ecosystem. The primary consequence is the immediate and unrecoverable draining of assets from the pool, impacting users and creating volatility for related LSTs. The attack leveraged a stale storage cache to enable an infinite token mint, a highly capital-efficient exploit that netted the attacker approximately $9 million in total economic damage.
Context
The prevailing risk factor was the continued operational reliance on legacy smart contracts that predated modern auditing standards and security best practices. Specifically, the yETH pool utilized a stableswap design that employed a cached value for gas optimization, a known anti-pattern that introduces significant state-management risk if the reset function is not rigorously enforced. This architecture created an unaddressed attack surface for state manipulation exploits, which was eventually leveraged.
Analysis
The attacker exploited a flaw where the pool’s internal accounting variable, a cached value intended to optimize gas costs, was not correctly cleared or updated after the pool was fully emptied. By depositing a minimal amount (16 wei) into the contract, the attacker triggered the minting function, which incorrectly referenced the stale, high-value cached state. This allowed the malicious actor to mint an astronomical quantity of yETH tokens, which were then immediately redeemed for the pool’s underlying assets, effectively draining the entire liquidity. The use of self-destructing smart contracts further obfuscated the on-chain forensic trail, demonstrating a high level of threat actor sophistication.
Parameters
- Total Economic Loss → $9,000,000 – The estimated total financial impact and asset loss from the exploited pool.
- Attack Vector → Infinite Token Minting – The specific smart contract logic flaw enabling the creation of 235 septillion tokens from minimal input.
- Stolen Assets Laundered → 1,000 ETH – The approximate value of assets immediately transferred to a mixing service (Tornado Cash) for obfuscation.
- Vulnerable Component → Legacy Stableswap Contract – The specific, older version of the yETH liquidity pool logic containing the unreset cache flaw.
Outlook
Immediate mitigation for users involved with similar legacy pools is to withdraw assets and revoke all token approvals until a full contract audit and redeployment is completed. The contagion risk is moderate, primarily affecting other protocols utilizing similar older stableswap contract forks or those relying on the compromised pool’s liquidity as an internal price feed. This incident mandates a new security best practice → the immediate deprecation and migration of all legacy contracts using gas-optimization patterns that rely on state-caching without formal verification of reset mechanisms.
Verdict
This exploit serves as a definitive operational mandate that all legacy DeFi infrastructure must be retired immediately, as the technical debt of outdated smart contract logic is now an unacceptable systemic risk to capital.
