Yearn Loses 63% of Treasury Due to Script Error

According to Blockworks, a script error has led to Yearn losing 63% of its treasury. The loss occurred when a malfunction in a multisig (multi-signature) script resulted in the unintended swap of Yearn’s treasury balance. The company clarified that the funds were strictly from Yearn’s treasury and not from any customer funds. On Dec. 11, a faulty multisig script caused Yearn’s entire treasury balance of 3,794,894 lp-yCRVv2 tokens to be swapped. This amount comprised a large portion of the Curve pool, incurring significant slippage which arbed back to the normal price by the market shortly after. When factoring in the 779,958 yvDAI tokens received from this trade, the total loss experienced by Yearn’s treasury comes out to about 63%. The DeFi protocol is asking anyone who profitably arbed this mistake to return an amount that they feel is reasonable to Yearn’s main multisig ychad.eth. Multiple oversights led to the faulty transfer, including the entire treasury balance being transferred to the trading multisig, which sent the transaction to CoW Swap for 30 or so orders. The high volume of trades involved in this single transaction significantly complicated the process of human review, leading to the oversight not being caught in time. Yearn has put new checks in place to prevent the same error from happening again. These include segregating protocol-owned liquidity (POL) funds into separate entities, enhancing trading scripts with more human-readable output messages, and imposing stricter price impact thresholds during trades. Earlier this year, Yearn was targeted in an attack where a vulnerability in a Yearn vault was exploited, allowing the attacker to access tether (USDT) deposits. The attacker minted 1.2 quadrillion yUSDT and swapped them for stablecoins using Curve Finance, making off with roughly $11 million in stablecoins.