What happened
YZY DAO was a yield-farming token on Ethereum whose transfers pay a tax, 2% at launch, into a vault contract. The token owner can change that tax with setTaxFee, which has no upper limit: at 100% a recipient gets nothing, and above 100% every taxed transfer reverts. The owner can also point the tax at a different vault with setVault.
On 9 February 2021 the deployer transferred ownership of the vault contract to 0xf01a9074…585302. According to De.Fi's listing, the vault treated that address as its _daoTreasury, it received tokens from the fees and sold them, and it removed liquidity several times. Two of those removals, on 4 April and 23 April 2021, returned about 6.77 ETH and 1.42 ETH.
De.Fi puts the loss at $106,315.
How it happened
- Every
transferortransferFromnot sent by the vault or the three launch wallets paysamount.mul(uint256(_taxFee)).div(10000)to_vaultand callsIYZYVault(_vault).addTaxFee(taxAmount). The fee check uses_msgSender(), so buys through the pair and sells through the router are both taxed. - The owner can set the tax to any
uint16value withfunction setTaxFee(uint16 fee) external onlyOwner { _taxFee = fee; ... }. At 10000 the recipient receives nothing; above 10000amount.sub(taxAmount)reverts, freezing every taxed transfer. - The owner can redirect the tax to any contract with
setVault, whose only check isrequire(vault != address(0), ...). - On 9 February 2021 the deployer called
transferOwnershipon the vault contract, making 0xf01a9074…585302 its owner. According to De.Fi's listing, the vault treated this address as_daoTreasury, it received fee tokens, and it sold them. - The same address removed YZY/ETH liquidity through the Uniswap router, including 252.09 YZY and 6.77 ETH on 4 April 2021 and 106.25 YZY and 1.42 ETH on 23 April 2021.
Protocol details
Evidence
- transaction Etherscan transaction 0x5742ab0e29917b1078e64aa6ab1def4ae061e9f9dbd42a49b0afa83133a089cb (vault transferOwnership) etherscan.io
- transaction Etherscan transaction 0xe481e83b262764d0e19931bcda83d666ca9804e7d17f78d0dc6c0aa2394951c0 (liquidity removal) etherscan.io
- transaction Etherscan transaction 0x6d64293c7966da2fba71ffe12949953b72f3d185cd2cadcba31fa43519e7f9c9 (liquidity removal) etherscan.io
- transaction etherscan.io transaction 0x59f3…319d etherscan.io
- address YZY DAO (YZY) verified source code on Etherscan etherscan.io
- address etherscan.io address 0x0a5a…ract etherscan.io
- analysis yzy.finance (seed URL) yzy.finance
- analysis Sourcify match for 0x6ca2cc52bb2cb67dd952e73b8786eb3a368b484c on Ethereum repo.sourcify.dev
- analysis etherscan.io page txsInternal etherscan.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
