Soft Yearn Finance Hack

The protocol did not handle the rebase event correctly. It enabled a user to start Uniswap sell transaction immediately following the modification of wallet balances, but before any price change in the token was registered.

The rebase event functioned wrong. Because the YFI to SYFI conversion rate was incorrectly entered, an erroneous balance change was started. Together, these two errors permitted a transaction to be initiated that would basically remove the pool's aggregate cash.

The transaction, where the external address buys 2 SYFI using 0.5 ETH on the Uniswap:

https://etherscan.io/tx/0xed33e727…c4e59a

15 minutes later, the same external address sells 15,551 SYFI for 747 ETH after the positive rebase event:

https://etherscan.io/tx/0xbb45a3aa…64ea83