On Tuesday, a user of YO Protocol received $112,000 instead of $3.73 million during a token swap. The transaction involved swapping Aave‘s stkGHO for Circle‘s USDC and failed due to inadequate slippage protections.
YO’s automated harvesting system traded the vault’s entire stkGHO balance at a very poor price. The error caused extreme slippage and a much lower payout than expected.
In a statement, YO Protocol said that “slippage protections were insufficient, and the trade proceeded when it should have been blocked.” The protocol said it immediately fixed the issue and added new safeguards.
Yehor Rudytsia, head of forensics at cybersecurity firm Hacken, called the problem common on yield farming systems. He said “The root cause of the incident is typical for yield farming protocols which do perform capital rotation or re-allocation.”
The project reported no user funds were lost and that the affected user used a claim system designed for small rewards. (Ed. note: the protocol confirmed users were not financially harmed.) According to DeFiLlama, YO Protocol holds about $61.8 million locked.
