What happened
Yearnspace (YFS) is an ERC20 on Ethereum whose mint function has no supply cap and is open to any address that the deployer, as governance, adds to the minters list. De.Fi's REKT database lists the incident as an exit scam / rug pull in which the deployer added itself as a minter, minted 15,000 YFS in two calls, swapped the tokens for ETH in 38 transactions to take 58 ETH, split that ETH among external wallets, and then took down the website and deleted the Twitter account. Etherscan confirms the deployer address 0xaC0bA8FA…c8Dd0D called addMinter at 14:11:21 UTC on 2020-11-14 (transaction 0xb3b88155…e4583f), twelve minutes after deploying the token, and minted 10,000 YFS to itself at 14:12:53 UTC the same day (0x95aac0cc…b34183) and a further 5,000 YFS at 18:11:28 UTC on 2020-12-04 (0xaa5b1712…d29eeb).
How it happened
- The constructor makes the deployer the governor:
constructor () public ERC20Detailed("Yearnspace", "YFS", 18) { governance = msg.sender; }. - Governance controls the minter list:
function addMinter(address _minter) public { require(msg.sender == governance, "!governance"); minters[_minter] = true; }.setGovernancecan hand that role to any address, and no function limits who is added. - Any listed minter can create tokens without limit:
function mint(address account, uint amount) public { require(minters[msg.sender], "!minter"); _mint(account, amount); }, and_mintsimply does_totalSupply = _totalSupply.add(amount); _balances[account] = _balances[account].add(amount);with no cap. Minted tokens do not debit any holder's balance; they add new, unbacked tokens that dilute everyone else's share. - What happened, per Etherscan: 12 minutes after deployment the deployer called
addMinter, and a mint of 10,000 YFS to the deployer address succeeded about 90 seconds later. Becausemintrequiresminters[msg.sender], the successful call shows the deployer was a minter. A second mint of 5,000 YFS to the deployer followed on 2020-12-04. - According to De.Fi's REKT database, the deployer then exchanged the YFS for ETH in 38 transactions, took 58 ETH, and split it among external wallets; the website went down and the Twitter account was deleted. The opened sources do not include those swap transactions.
Protocol details
Evidence
- transaction Etherscan transaction 0xb3b88155...c4583f (addMinter) etherscan.io
- transaction Etherscan transaction 0x95aac0cc...34183 (mint, 2020-11-14) etherscan.io
- transaction Etherscan transaction 0xaa5b1712...79d29eeb (mint, 2020-12-04) etherscan.io
- address YFS (Yearnspace) verified source on Etherscan etherscan.io
- analysis De.Fi REKT database listing for YFS (proof link archive.ph/wJdWM, not fetchable) archive.ph
- analysis de.fi Analysis t.me
- analysis Web Archive web.archive.org
- analysis Sourcify match for 0x93a8b61c4707efe76a88cae8dc226d9bf77e9405 repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
