DeFi strikes again: YAM protocol bug leads to $750,000 loss

Getting your Trinity Audio player ready...

Since the very first DeFi exploit took place in February, we have been warning the world about the risks associated with DeFi protocols. Hopefully, you heeded those warnings and avoided the most recent DeFi disaster—this time involving the YAM protocol.

Yam Protocol was a DeFi protocol announced via Medium on August 11. The YAM token, which was supposed to keep parity with the U.S. dollar as well as be used for on-chain governance, was released just two hours after the YAM Finance team published the Medium post.

The YAM team explicitly says that they created the YAM Protocol in just 10 days from start to finish. The team also warned the audience that no formal audit had been conducted on the Yam protocol. Regardless of their warnings, within one hour of launch, $76 million was invested in YAM protocol. By early morning August 12, nearly $300 million was invested in YAM. The YAM token, which is supposed to be equal to $1 at all times, hit an all-time high of $167.72 that same day.

1 hour later…

Shortly after YAM hit its all-time high, the YAM finance team found a significant bug in the YAM protocol. 

The initial rebase has occurred adding approximately $500k worth of yCRV to the YAM treasury.

If governance is unable to submit a bug-fix proposal prior to the second rebase, no further governance actions will be possible.

— Yam DAO (@YamFinance) August 12, 2020

There will be so much YAM printed that quorum will be impossible.

🚨 If this happens, the YAM treasury will become ungovernable and these funds will be lost 🚨

This will happen on the next rebase at 8AM UTC, unless a proposal is submitted prior.

— Yam DAO (@YamFinance) August 12, 2020

The bug over-mints tokens, instead of minting a supply that would keep the YAM token equal to US$1, which would invalidate on-chain governance since the number of tokens minted would make it impossible for any proposal to reach quorum given the amount of YAM in circulation. At the time, the YAM team published the official announcement for the bug, they informed their ecosystem that they had just 7 hours until the bug would come into effect.

The solution

Thank you for your support. Help us hit our stretch goal for added safety.

It's not over yet. The proposal will be submitted sometime after 7am UTC and before 8am UTC.

Please hold your $YAM in your wallet for the duration of the voting period. pic.twitter.com/O2PYnsbmnn

— Yam DAO (@YamFinance) August 13, 2020

The YAM team said that if the YAM community locked up 160,000 YAM in a governance proposal smart contract, that the vote would allow them to execute a bug fix. 

Governance proposal submitted (0x1d64875b24732bc2e8880cd0870ea8e301ddde683ce81fea418e9ab4feea90bb)

🚨 we are urgently investigating a potential flaw that would prevent proposal execution.

We strongly advise exiting the Uniswap YAM/yCRV pool prior to rebase at 8am UTC (35 mins)

— Yam DAO (@YamFinance) August 13, 2020

However, after raising the 160,000 YAM to execute the proposal, the YAM team said they discovered that the smart contract that would fix the bug was faulty and that there was no way to fix the over-mint problem.

Early in the morning on August 13, the YAM Finance team announced that the project was dead—putting YAM’s lifespan to less than 48 hours. The team said their community can no longer make governance decisions due to the bug, but that the YAM protocol would live on as long as Ethereum continues to operate. 

Subsequently, the YAM token dropped to $0.81, a 99.4% decrease from its all-time high. 

DeFi is a scam

Although the YAM finance team had good intentions, YAM protocol is a good case study for DeFi and provides a broad overview of what most projects in the DeFi space look like: a group of inexperienced software developers that were looking to make a quick buck so they threw together a sloppy protocol that rocketed far beyond the value it was supposed to have because investors were money hungry and did not care that it had not been audited because they knew it would bring them exponential returns.

That being said, and like we have said before, DeFi projects are the new ICO. As you can see with YAM token, ideas in DeFi don’t need to have utility, create real value in the world, or even need to make sense. There is a money-hungry group of investors that are waiting to snap up DeFi governance tokens, regardless of whether the protocol behind them works or not. 

wrong. staked assets are fine. yCRV in reserves are the losses. 750k.

— brock (@brockjelmore) August 13, 2020

According to YAM co-founder Brock Elmore, the bug resulted in $750,000 in losses. And with the popularity, yet sloppy nature of DeFi, you can expect more blunders and DeFi exploits to happen in the future.