Yearn Finance Hack

Reported loss $300K
Ethereum
misconfigured Fulcrum sUSD strategy

What happened

The legacy iEarn yTUSD vault was exploited through a misconfigured Fulcrum adapter and fragile share accounting. Its adapter referenced an sUSD market although the vault paid withdrawals in TUSD. The attacker manipulated the recorded pool value and inflated the supply of yTUSD used in Curve's yPool.

Technical root cause

The Fulcrum adapter referenced iSUSD rather than a TUSD lender. Accounting included the donated lending token but ignored redeemed sUSD, allowing the recorded pool value to collapse and the share-minting formula to issue excessive yTUSD.

How it happened

  1. Flash-loaned liquidity established positions in the affected vault and pools.
  2. Donating iSUSD inflated the TUSD vault's reported value, enabling excess TUSD redemption.
  3. Rebalancing converted iSUSD to sUSD that the accounting ignored. With recorded pool value reduced to dust, a small TUSD deposit minted an enormous number of yTUSD shares.
  4. The attacker exchanged those shares through Curve's yPool and unwound the flash loan.

Protocol details

Classification Protocol Logic / Yield Aggregator / Token & Share Accounting
Protocol Type Yield Aggregator
Implementation language Solidity
Protocol links Website @yearnfi

Market Context at Time of Hack

Token Price at Hack $3,389.59
Market Cap at Hack $118.9M
Reported loss / token market cap 0.25%
Token Categories
DeFi DAO Ethereum Ecosystem Yield Farming Yield Aggregator Yearn Partnerships Three Arrows Capital Portfolio Polychain Capital Portfolio
Protocol Links
GitHub Discord Reddit Telegram

Security review history

Evidence

Understand the attack patterns

Compare incidents →
Flash Loan Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes