Yearn Finance Hack

Reported loss $11.5M

Apr 13, 2023 Ethereum

Flash-loan-assisted vault share-price manipulation through a misconfigured yUSDT underlying asset

What happened

On April 13, 2023, an attacker exploited the legacy iEarn yUSDT contract on Ethereum. A deployment misconfiguration let the attacker distort the vault's accounting, mint an enormous amount of yUSDT from minimal capital, and swap the unbacked shares for stablecoins from Curve pools. Yearn said the immutable iEarn contract had been deprecated in 2020; current Yearn v2 Vaults were not affected.

Technical root cause

A legacy yUSDT deployment was misconfigured to use Fulcrum iUSDC where it should have used Fulcrum iUSDT. The incompatible asset accounting enabled the attacker to manipulate the vault balance used in the share-mint calculation, collapse the value per share, and mint unbacked yUSDT. This is a deployment/configuration and share-accounting flaw, not an external price-oracle manipulation.

How it happened

The attacker used Balancer flash loans of 5 million DAI, 5 million USDC, and 2 million USDT. They manipulated the legacy yUSDT contract's reserve and accounting path, including minting and transferring bZx iUSDC to the yUSDT contract, causing the share value to fall to zero after rebalance. After sending 1 wei of USDT, the attacker could mint a massive amount of yUSDT, swap it through Curve for stablecoins, and repay the flash loans.

The exploit affected the deprecated pre-YFI contract, not current Yearn vaults or Aave. Published estimates vary with the valuation time, so the $11.54 million figure is approximate.

Protocol details

Classification Protocol Logic / Legacy Contract Misconfiguration / Yield Aggregator

Protocol Type Yield Aggregator

Affected asset / contract YFI

Implementation language Solidity

Protocol links Website @iearnfinance

Attacker Address 0x5baC20BEef31d0ECCb369A33514831eD8e9cdfE0

Exploit Transaction 0xd55e43c1602b28d4fd…759ecda95d

Security review history

MixBytes 2020-12-03 No public report
Trail of Bits 2021-04-30 No public report
Quantstamp View report
PeckShield View report

Evidence

report @osec_io incident report twitter.com
report @beosinalert incident report twitter.com
report OpenZeppelin Security Report: April to June 2023 openzeppelin.com
transaction Yearn Legacy Exploit Transaction etherscan.io
analysis Website reference theblock.co
analysis Blog reference blog.solidityscan.com
analysis DeFiLlama defillama.com
analysis Earnings Misconfigured: Yearn.finance Exploit Explained certik.com
analysis Yearn Finance Exploit Points to Dangers of Old Smart Contracts blockworks.com

Understand the attack patterns

Compare incidents →

Flash Loan Attacks Oracle Manipulation & Price Manipulation

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes