Yam DAO Hack

The bug is in the rebase function of smart contract YAM.sol in the YAM project:

https://github.com/yam-finance/yam-protocol/blob/767e3a4a6918b6fb6100ad6bb356164408f5d82f/contracts/token/YAM.sol#L340

The rebase function was built to keep the token at a stable price. However, the line in the code mistakenly calculates the totalSupply wrong, which would reserve too many minted tokens. The correct code/calculation equation for the line of code should be:

totalSupply = initSupply.mul(yamsScalingFactor).div(BASE);

The rebase bug led to the minting of decillions of YAM to the governance vault. As a result, a larger supply diluted the intended price. YAM token has lost more than 90% of its market capitalization. The bug resulted in a loss of funds worth $750,000.