Image default

How $150m in Ethereum & DAI was used to steal $7m from a Yearn.finance competitor

It may seem like a broken record at this point but yet another decentralized finance (DeFi) protocol was recently exploited.

And, once again, the exploit took place on a competitor of Yearn.finance (YFI).

Here’s more about what happened, and what DeFi users can do to prevent their funds from being attacked moving forward.

Yearn.finance fork ValueDeFi hacked for $7 million

In August and September, forking Yearn.finance was all the rage. Yearn.finance had rapidly become the crypto industry’s darling, with $1 billion in deposits and its native token YFI sporting a matching $1 billion market capitalization.

Forks upon forks were released.

One fork that gained traction was YF Value (YFV), which, like Yearn.finance, was marketed as a place for users to deposit cryptocurrencies and earn a steady and safe return. While extremely similar in concept to Yearn.finance, the marketing strategy worked: at its peak in early September, YFV had a market capitalization just shy of $150 million.

Unfortunately, YFV isn’t as safe as first thought.

On Saturday morning, users began to take notice of a large Ethereum transaction that involved Aave, Curve, Uniswap, and YF Value (now known as Value DeFi).

In that transaction, a user had withdrawn 80,000 ETH from Aave in a flash loan, along with another $116 million in DAI from Uniswap.

Those funds were subsequently traded to manipulate the price of stablecoins on Curve. This manipulation meant that the attacker was able to obtain Value deposit tokens worth more than the actual value of the stablecoins that underlie those tokens.

In total, $7.5 million worth of DAI was drained from Value, though $2 million was returned to the protocol by the pseudonymous attacker.

Although unfortunate for depositors, literal hours before the attack, Value called itself the “most secured and advanced piece of technology in the DeFi space,” claiming its developers accounted for well-known flaws in Ethereum smart contracts.

The exploit of Value comes after similar attacks took place with Akropolis and with Harvest Finance.

Avoiding protocols with bad oracle integration

At the core of many of these exploits and potential attack vectors are the lack of proper oracle integrations. An oracle is software that supplies data outside a system to that system; in DeFi, oracles are most often used by protocols that need to know the price of a cryptocurrency.

“Honest” oracles use a variety of metrics, such as using an index or taking a snapshot, to mitigate the risk of price manipulation attacks.

The protocols that were exploited by flash loan attacks did not use properly integrate oracles, allowing the inter-block prices of stablecoins to be manipulated to the advantage of exploiters.

Like what you see? Subscribe for daily updates.


Credit: Source link

Related posts

Ethereum’s uptrend may be overheating as investor profitability reaches historic highs

cwnadmin

Ethereum Just Broke $135 and Primed To Test $150: Here’s Why

cwnadmin

Here’s why a top VC thinks Ethereum could rally over 3,000% in the next bull run

cwnadmin