YF Value DeFi Danger: $130 Million At Risk Of Being Locked

There are potential $130 million at risk of being locked in the YF value of the YFV protocol by a single user until the team transfers the keys to a multisig wallet. This only highlights the importance of careful due diligence before investing in DeFi as we are reading further into the altcoin news.

Announced back in August, YF value protocol was intended to deliver the true value of yield farming finance accessible for all users irrespective of their investment size. A while ago it turned out that over $170 million worth of crypto is at risk of being locked by one single contract owner. Money continues to pour into the field into DeFi as the total value locked in protocol approaches $7 billion.

BoxDAO vote. Should I help sign the $YFV multi-sig contract?

— Boxmining (@boxmining) August 24, 2020

The new protocols are coming out every day and investors are racing to be among the first to stake to benefit from the high yield rates. One such project is YFValue which was launched on August 16^th and in less than ten days the protocol saw more than $120 million staked. Now it seems that the funds are at risk of being locked out by one contract owner. One user brought up the issue on Twitter and outlined some of the challenges. Besides the mining of the token, farmers are mining 2 additional tokens that are introduced by YFV, vETH token, and vUSD token. Both of the tokens have minters that are only modifiable by the owner.

Vote for Governance Multisig Signershttps://t.co/Sx4q9Q3H8b

* Pls note that the current list is proposed by the community, and subject to the person acceptance.

— yfv.finance (@FinanceYfv) August 24, 2020

While commenting on the technicalities, the user concluded that “this means $170 million worth of funds is at the risk of being locked by one EOA.” The value locked in the protocol has dropped to $130 million at the time of writing. In a detailed post by the YFValue team, the issue was confirmed and addressed. Over the past 24 hours, the community members identified one minting key oversight and exploit that was related to vUSD and vETH which could enable locking funds after completing the current epoch.

The ownership of the keys in question will be kept by the team until they manage to recover the funds that the users could have lost. The team decided to transfer ownership of the keys to a multisig wallet for more flexibility in future governance decisions. For this to happen, the team has to transfer ownership of the YFV under their control to the multisig address as they are looking for reputable people to do so.