Accidentally stepping on a DeFi lego

Summary: The initial release of yVault, launched by yEarn on July 25th 2020, contained price-computation logic for yUSDC that an attacker could manipulate to drain most or all of the pool's assets. Developer Andre disabled the faulty code quickly, securing the approximately 400,000 USD held at the time, after users had deposited around 400,000 USDC within an hour of release.
What's compelling: The exploit worked through a temporary spike in BPT valuation mid-transaction - buying yUSDC before a bad trade and selling before the good trade - showing that roughly 400,000 USD hinged on a pricing flaw that only appeared between two swaps.

Read the original at Trail of Bits Blog ↗