CertiK: Analysis of Yam Finance Smart Contract Vulnerability Event Once Falling into the Cloud​

Sweet potatoes have just been planted, so they have to be dug out?

A magical event happened again in the DeFi field today. As soon as the highly popular Sweet Potato project was launched, liquidity miners began to pour in frantically. In just 8 hours, the total value locked in Yam Finance exceeded 200 million US dollars. COMP mining drove the DeFi industry out of the circle, and YAM directly drove the collective rise of the top DeFi projects, which can be called "flying into the sky".

However, in just 36 hours, it saw tall buildings rise and collapse. Hundreds of millions of dollars disappeared because of a small loophole. I thought I lost 100 million because I was unresponsive, but I didn't expect to keep my five dollars.

event background

event background

On August 12, YAM Finance officially announced that they had discovered a smart contract loophole, saying that the loophole would generate more YAM tokens than the initially set amount. In this case, a large number of reserved tokens would create an excessive amount of tokens required for governance operations. This means that the community will not have enough tokens to perform any governance operations in the future.

Where Do Smart Contract Vulnerabilities Occur?

Image Source:

Image Source:https://github.com/yam-finance/

The rebase function in the image above should perform a rebase in order to maintain a stable price. However, there is one line of code (marked in blue) that gives an incorrect result when calculating totalSupply, which causes the system to reserve too many tokens.

The correct code/equation form of calculation for this line of code should be similar to the following code/equation:

totalSupply =initSupply.mul(yamsScalingFactor).div(BASE);

So is it possible to fix this vulnerability through governance actions before the deadline?

The second adjustment is at 4:00AM ET on August 13th.

YAM Finance publicly announced that they need about 160,000 YAM delegation requests before 3:00 am EST to submit governance proposals. The proposal would allow users to transfer or deposit YAM themselves into the reserve pool if more than 400,000 YAM were delegated during the voting window.

secondary title

Current status of YAM

YAM Finance has currently lost its governance capabilities, and 75% of its liquidity has been moved from the YAM/yCRV unallocated fund pool. However, the rest of the liquidity will be removed from the reserve pool.

secondary title

How to avoid it?

The CertiK security team strongly recommends:

All blockchain projects not only need to use strict software testing tools to verify the code security of the project before the official release, but also should invite multiple third-party blockchain security teams to do a good job of verifying the code in the blockchain project Audit work and re-audit after every code update. Thereby designing a better project management system to prepare for the need for urgent project updates.