What happened
On January 12, 2026, YO Protocol's automated harvesting system swapped about $3.84 million of stkGHO held by its yoUSD vault for only about 112,000 USDC. The loss was roughly $3.7 million, about 97% of the position. No attacker or smart contract vulnerability was involved.
BlockSec and YO's post-mortem trace it to the swap parameters. The estimated-output value submitted with the swap was wrong, so the slippage check had no effect. The route also ran through low-liquidity pools with extreme fee tiers, so the value went to those pools' liquidity providers.
YO said the harvester ran without the guardrails used by its other trading systems. The team repurchased about $3.71 million of GHO through CoW Swap from its multisig and redeposited it, paused the Pendle yoUSD market, and left an on-chain message asking the LPs to return 90% and keep 10% as a bounty. Swap tx: 0x6aff59e800dc219ff0d1614b3dc512e7a07159197b2a6a26969a9ca25c3e33b4.
How it happened
- YO's Rewards Harvester called
manage()on the yoUSD vault to rebalance about 3.84 million stkGHO into USDC (block 24218806, 13:02:59 UTC on January 12, 2026). - The swap was submitted with an incorrect estimated output. Because the slippage check measured drift from that estimate rather than whether the quote was reasonable, it did not block a near-total loss.
- The route was split across Uniswap V4 and V3, Curve, Balancer V3, Fluid and Bancor, including pools with very thin liquidity and fee tiers reported at 85-88%.
- The vault received about 112,036 USDC. Most of the value went to liquidity providers in those pools.
- YO's multisig bought back about $3.71 million of GHO via CoW Swap and redeposited it. The team paused the Pendle yoUSD market, asked the LPs on-chain to return 90% of the proceeds, and published a post-mortem.
Protocol details
Evidence
- report PeckShield YO swap alert x.com
- report Report phemex.com
- report Yo Protocol's Slippage Bomb - Rekt News rekt.news
- transaction Etherscan: tx 0x6aff59e8... etherscan.io
- transaction YO Protocol suffers abnormal swap transaction, approximately $3.84 million worth of stkGHO exchanged for only $122,000 USDC bitget.com
- analysis DeFiLlama defillama.com
- analysis The Defiant: YO unintended stablecoin swap thedefiant.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
