github.com/yearn/yearn-se… Yearn's yvDAI vault Compound strategy had a vulnerability. "In the event of a successful exploit, an attacker would have been able to liquidate an affected strategy's entire debt position on Compound and potentially capture liquidation fees."
Fixed within 3 hours of disclosure of _xyzaudits_. This hero saved a lot of money today. IIRC compound liquidation penalty is about 5%? So the total amount at risk was about $15m? Not sure if I did my math correctly. @iearnfinance $YFI
To be fair, liquidation on Compound is a fair race, and there is no guarantee the exploiter would have been able to get the liquidation fee anyway, plus the attack needed to be carried out several times for the vault to be liquidated fully.
As a result, now 329m USDC sitting in Yearn's contract idle for over 1 day now. etherscan.io/address/0x5f18…
Correction: I believe up to 20% of the vaulted funds were vulnerable as the vault was using a leveraged compound strategy. I'm not clear how much funds were in compound.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
