Cryptocurrency [loss] $1M+

"Incident disclosure - 2023-12-11"

2023-12-11 [vendor] Yearn treasury swap [chain] ethereum
Primary Source ↗
Financial Loss $1.5M (1,495,600 USD)
Recovered $4,400
Blockchain(s) Ethereum

Incident Details

Periodically, Yearn Finance converts a small quantity of its treasury tokens into stablecoins to spend on operations. However, something went terribly wrong during this process when they went to perform the swap and erroneously converted the entire amount — nearly 3.8 million Ip-yCRVv2 tokens — into a stablecoin. According to one Yearn Finance employee, this pool of tokens comprised around 3% of the project’s treasury.Because there was not sufficient liquidity for such a large trade at the going price, the trade was ultimately fulfilled, but at a 63% loss. Before the trade, that quantity of tokens was priced at around $2.28 million; however, Yearn received only around $780,000 in stablecoins because of the slippage.Yearn quickly identified the issue and embarked on a campaign to ask nicely for the counterparties in the trade to please give some of their profits back. In on-chain messages, Yearn wrote: “one of yearns multisigs made a costly mistake last night that affected a critical source of yCRVs liquidity. we identified you as having made a profit off of this and are kindly requesting that you return as much as you see reasonable to yearns main multisig: ychad.eth. sorry we have to ask this, but hope you can understand.” Doesn’t hurt to ask, I guess. So far, only one wallet has taken them up on the offer, returning 2 ETH (~$4,400).

Total loss estimated at $1,495,600.

Technical Details

Initial Attack Vector
Software bug / unintentional loss
Vendor / Product
Yearn treasury swap

Timeline

  1. 2023-12-11 Breach occurred
  2. 2023-12-11 Publicly disclosed