An exploit occurred this morning in the Yearn Finance protocols due to vulnerabilities in the legacy yUSDT token contract. This issue was found in several versions leading to the draining of various Curve pools (y, busd, pax). As Yearn mentioned in an earlier tweet, currently their Yearn v2 Vaults are unaffected. The attack came to light when the technical testing unit at Peckshield found a suspicious transaction involving Yearn Finance and Aave. It was discovered to be a flash loan assault on Yearn with money obtained from Aave. Although there are concerns that Aave may fall victim to any odd actions made in relation to the loan product, Repay transactions were found that repay to the Core V1 pool, putting those worries to rest. Reports also reveal that around $10 million were removed from Yearn Finance and placed in a wallet with the address of "0x16A...74A5". The YFI token dropped briefly to a low of below $9,000 at the time of the attack, but has since been adjusted back to its original level. It is important to note that this exploit was isolated in the legacy yUSDT contract and any current Yearn protocols or contracts have not been affected. Even still, it's important to do your own research before investing.



Other News from Today