TLDR
Two notable DeFi pool exploits reported in the past week hit Yearn Finances yETH?linked pools and Balancers v2 Composable Stable Pools.
- Yearn Finance (YFI): yETH?related pools were exploited for about $9 million, including a custom stETH/rETH pool and a yETH?WETH stableswap pool on Curve, per a post?mortem summary here.
- Balancer (BAL): v2 Composable Stable Pools across Ethereum, Polygon, Base, and Arbitrum were hit, with an exploit tied to a rounding function; a reimbursement plan of $8 million recovered funds was proposed for affected LPs here.
- StakeWise recoveries: approximately $19.7 million in osETH/osGNO recovered separately via StakeWise governance for impacted positions here.
Deep Dive
1. Yearn yETH Pools
The Yearn Finance exploit centered on yETH and a custom stETH/rETH pool, with losses around $9 million and confirmed impact to a small yETH?WETH stableswap pool on Curve.
- Analysts noted a minting vulnerability that allowed attackers to create yETH without sufficient collateral and drain liquidity from a linked pool report.
- Follow?up coverage highlighted rapid laundering activity and contract self?destruct patterns, underscoring the sophistication of the attack summary.
If you provided liquidity or held yETH?linked positions, check project notices and snapshots to verify eligibility for any remediation and to assess residual risk.
2. Balancer v2 Pools
Balancers v2 Composable Stable Pools (CSPv5) were exploited via a precision/rounding function flaw combined with batched swaps across multiple networks.
- The attack drained pools on Ethereum, Polygon, Base, and Arbitrum. Balancer proposed an $8 million pro?rata reimbursement for directly recovered funds, paid in?kind to affected LPs plan.
- Community notes describe the flaw affecting EXACT_OUT swaps in stable pools and outline claim windows and whitehat bounties for rescued assets details.
LPs in affected Balancer pools should review the claim portal and pool?specific snapshots to confirm balances, token types, and any required steps for reimbursement.
3. StakeWise osETH/osGNO
StakeWise?linked positions impacted by the Balancer incident were handled via a separate governance process.
- Roughly $19.7 million in osETH and osGNO is set to be returned through StakeWise, separate from Balancers internal and whitehat recoveries governance track.
If your exposure involved osETH/osGNO via StakeWise integrations, follow StakeWise governance updates for timing and method of reimbursements.
Conclusion
The weeks exploit activity focused on Yearns yETH?linked pools and Balancers v2 stable pools, with remediation paths already outlined by each ecosystem. For LPs and vault users, the practical next step is to verify pool membership at snapshot blocks and follow the respective reimbursement or governance processes to recover funds and reassess risk exposure.
CoinsKid.Com