{"id":1682,"date":"2020-11-10T15:43:06","date_gmt":"2020-11-10T15:43:06","guid":{"rendered":"https:\/\/de.fi\/blog\/?p=1682"},"modified":"2023-09-17T10:54:02","modified_gmt":"2023-09-17T10:54:02","slug":"the-yffs-saga-how-a-yield-farming-project-was-compelled-to-fix-its-code-6c5ee77816bb","status":"publish","type":"post","link":"https:\/\/de.fi\/blog\/the-yffs-saga-how-a-yield-farming-project-was-compelled-to-fix-its-code-6c5ee77816bb","title":{"rendered":"The YFFS Saga: How a Yield Farming Project Was Compelled to Fix Its Code and then Rugpooled"},"content":{"rendered":"

Yield farming provides asset-holders with the opportunity to earn tokens through locking into smart contracts for a certain duration. But it also raises the possibility of loss of funds, due to smart contract error or impermanent loss when liquidity pooling, which can occur as a result of dramatic price movement or operator malfeasance. As a result, it\u2019s vital that farmers inspect the code of any project they\u2019re considering staking in.<\/p>\n

Performing some basic checks to the integrity of the code can potentially save thousands in losses, not to mention the time wasted on staking in futile projects, when the capital could have been better used elsewhere. De.Fi.info periodically inspects the code of new yield farms to detect anomalies and provide feedback to the community and project team on underlying risks.<\/p>\n

Recently, I audited the YFFS project and published the post on the 6th of November.<\/p>\n


\n
\nDe.Fi \ud83d\udc68\u200d\ud83c\udf3e\ud83d\ude9c on Twitter: “1\/ Today on my surgeon\u2019s table: @\u2026
\narchived 9 Nov 2020 16:15:36 UTC
\n<\/a><\/p>\n

In essence, the project raised lots of questions. Primarily because its implementation could not be called decentralized.<\/p>\n

The trouble was that the owner had a lot of permissions to manipulate the staking process and users\u2019 staced assets, which, consequently, jeopardized users\u2019 funds. For instance, there was a function called YFFSDeflationStake that stopped staking and transferred all staked tokens to the hardcoded EOA address 0x489B689850999F751760a38d03693Bd979C4A690.<\/p>\n


\n
\nDe.Fi \ud83d\udc68\u200d\ud83c\udf3e\ud83d\ude9c on Twitter: “2\/ There is a function that stops\u2026
\narchived 9 Nov 2020 16:19:47 UTC
\n<\/a><\/p>\n

These alarming facts made me rate the scam probability as high.<\/p>\n

The team\u2019s answer was as follows:<\/p>\n


\n
\nyffs.finance on Twitter: “We have covered this issue in the article “\u2026
\narchived 9 Nov 2020 16:24:22 UTC
\n<\/a><\/p>\n

I failed to locate any such article addressing this matter.<\/p>\n

Also, they tried to deflect and whitewash themself by providing doubtful theses.<\/p>\n


\n
\nyffs.finance on Twitter: “1. There are many projects that fail and fr\u2026
\narchived 9 Nov 2020 16:35:54 UTC
\n<\/a><\/p>\n

However, I couldn\u2019t resist responding and suggested that the YFFS team perform some vital changes for the project to become safer. I proposed adding either a timelock or governance to prevent centralized project control.<\/p>\n


\n
\nDe.Fi \ud83d\udc68\u200d\ud83c\udf3e\ud83d\ude9c on Twitter: “3. That’s could be much better an\u2026
\narchived 9 Nov 2020 16:48:01 UTC
\n<\/a><\/p>\n

My next suggestion was about how to implement the necessary changes to renounce contract ownership.<\/p>\n


\n
\nDe.Fi \ud83d\udc68\u200d\ud83c\udf3e\ud83d\ude9c on Twitter: “You can solve this issue asap, ju\u2026
\narchived 9 Nov 2020 16:54:03 UTC
\n<\/a><\/p>\n

Consequently, the YFFS team answered, stating that the changes would take place the same day.<\/p>\n


\n
\nyffs.finance on Twitter: “Ok. If that’s what the community wants, we \u2026
\narchived 9 Nov 2020 16:57:21 UTC
\n<\/a><\/p>\n

A bit later, the YFFS team informed the community that the Admin key had been burnt. Indeed, they called the transferOwnerShip & setGovernanceAddress functions and specified the 0x000 address as a parameter to transfer the YFFSDeflationStake\u2019s contract ownership to. This way they completely got rid of the ability to invoke these functions.<\/p>\n


\n
\nyffs.finance on Twitter: “\ud83d\udd25 Burned Admin Key of $YFFS Deflation Stak\u2026
\narchived 9 Nov 2020 16:59:45 UTC
\n<\/a><\/p>\n

On November 8, the YYFS team posted a tweet<\/a> thanking De.Fi.info for auditing its code.<\/p>\n


\n
\nyffs.finance on Twitter: “\u2705 Thanks to @defiyield_info for Auditing YF\u2026
\narchived 9 Nov 2020 17:02:49 UTC
\n<\/a><\/p>\n

Conclusion<\/strong><\/p>\n

To summarize, I revealed unacceptable functionality in the YYFS finance project, outlined that in the report, and informed the community along with the YFFS team. In its turn, after hot discussions with the YFFS team and providing irrefutable facts, the team decided to implement the changes I recommended. This transformed the project for the better.<\/p>\n

One more project has improved and become much more trustable, safe, and decentralized. That\u2019s exactly what the community wants.<\/p>\n

Together we are heading in the right direction to refine yield farming.<\/p>\n

Don\u2019t trust: verify. Always.<\/p>\n

Update 25 of December<\/h2>\n

Eventually, YFFS rug pulled.<\/p>\n

The team tried to seem pretty cooperative as they agreed to edit the problematic code as I insisted.<\/p>\n

But this step was just a part of the deception. The intentions to steal the user funds did not disappear. The team just pretended being disturbed and interested in security improvements. YFFS made changes to the code only for demonstrative purposes. In fact, the scammers continued to pursue their initial strategy and managed to steal the funds through interactions with FECORE and YFFC tokens.<\/p>\n

Check out other articles from the Saga series:<\/p>\n