CertiK: Yearn.Finance Exploded Vulnerabilities, Total Loss About 71 Million RMB

Original title: "CertiK: Yearn.Finance's shocking vulnerability, DeFi hit again, this article takes you to find out the whole story"

Original source: CertiK

On February 5th, according to DeBank data, the real lock-up volume of DeFi exceeded 47 billion US dollars, a record high. At the time of writing this article, it was 47.83 billion US dollars. It is approximately equal to RMB 309.5 billion.

2020 is called "the first year of DeFi". DeFi has achieved a historic explosion driven by the "liquidity mining" pioneered by Compound, but its security risks remain high. In the early hours of February 5th, Beijing time, the CertiK security technology team discovered an attack on the DeFi project Yearn.Finance. The total loss of the attack was as high as about 71 million yuan, and the hackers made a profit of about 18 million yuan. Hackers obtained attack start-up funds through flash loans, and used the Yearn project code loopholes to complete the entire attack.

Screenshot of the attacker’s profits

The attack included 11 profit-making transactions and 3 token conversion transactions. The transaction list is as follows:

Except for 3 token conversion transactions, the remaining The 11 profit-making transactions all target the same vulnerability and use the same attack method to complete the profit. The general flow chart of the attack is as follows:

The specific steps are as follows :

-Use flash loans to raise the initial funds needed for the attack.

-Using the loopholes in the Yearn.Finance contract, repeatedly deposit and withdraw DAI and  USDT  from 3crv in order to obtain more 3Crv Token. These tokens were then converted to USDT and DAI stablecoins in 3 subsequent token conversion transactions. After completing 5 repeated DAI and USDT deposit and withdrawal operations from 3crv, repay the flash loan.

-The CertiK security technical team is currently reviewing the vulnerabilities in Yearn.Finance, and more details of the vulnerabilities will be explained in subsequent analysis.

Summary

Interaction in the encrypted world is often accompanied by certain risks, and investing in Safe projects will receive more long-term returns.

And high returns must be accompanied by high risks. The outbreak of this vulnerability is also a warning in the DeFi field.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia