Yearn Finance Treasury Loses $1.4M Due to Script Error

Critical Script Flaw

Yearn Finance, a key player in yield farming, recently encountered a significant setback. A critical error in their multi-signature script led to a massive unintended transaction. This mistake cost the company approximately $1.4 million.

Routine Procedure Goes Awry

The error occurred during a standard fee token conversion for the treasury. Due to a flawed script, nearly 3.8 million lp-yCRVv2 tokens were mistakenly swapped for about 780,000 yvDAI tokens. The script transferred the entire treasury balance of lp-yCRVv2 tokens, far exceeding the intended amount, due to a lack of output checks and a logical flaw.

Market Disruption

This unplanned trade significantly disrupted the market, although prices soon returned to normal. Yearn Finance has asked users who profited from this incident to return a fair amount to their main multisig wallet. Before any returns, the loss stands at around 2% of the total treasury.

Steps for Improvement

In response, Yearn Finance is implementing corrective measures. These include segregating POL funds, enhancing script readability, and setting stricter price impact thresholds. These actions are aimed at preventing similar incidents in the future.

Previous Security Issues

Yearn Finance has faced security challenges before. An exploit earlier this year led to an $11.6 million loss. In February, another breach resulted in the theft of $11 million in cryptocurrencies from a vault.

DeFi Space Vulnerabilities Highlighted

Although user funds were not directly affected, this incident highlights the security and operational challenges in the decentralized finance (DeFi) sector.

Yearn Finance's Proactive Approach

Despite these challenges, Yearn Finance's commitment to system improvement and adaptability showcases their resilience in the DeFi landscape.

While Yearn Finance's proactive measures are commendable, this incident reveals a concerning pattern of security vulnerabilities within their system.