DeFi security issues have once again garnered attention: the YFI protocol has suffered a flash loan attack.
At the beginning of 2021, the once DeFi king Yearn Finance protocol suffered a flash loan attack, with losses reaching tens of millions of dollars. This incident once again raised concerns in the industry about DeFi security issues.
According to the analysis of a security company, the attacker exploited a vulnerability in the DAI strategy pool of the YFI protocol. The attacker borrowed a large amount of funds through Flash Loans, manipulated the asset ratio of the Curve liquidity pool, and then used the deposit and withdrawal mechanism of the YFI protocol to arbitrage, ultimately resulting in significant losses for YFI.
This attack exposed the vulnerabilities in the price mechanism design of DeFi protocols. The combination between YFI and Curve uses LP shares to determine the price, and this mechanism is easily manipulated. Essentially, this is a price manipulation issue, rather than a problem with Flash Loans themselves.
Currently, many De