The viral DeFi project Yam Finance's YAM token has lost more than 90% of its market capitalization within a few minutes as a "potential flaw" gets uncovered.
"We are urgently investigating a potential flaw...We strongly advise exiting the Uniswap YAM/yCRV pool prior to rebase at 8am UTC (35 mins)," Yam.Finance tweeted today. yCRV is a basket of yield-generating stablecoins on the Curve protocol.
Within minutes of this tweet, the market capitalization of YAM plunged to just about $19.5 million, from nearly $475 million earlier today. The price of YAM is currently trading at about $0.6 apiece.
James Prestwich, founder of blockchain project Summa, said there was a "severe bug" in the rebase logic of the Yam protocol. "Specifically, the rebase bug led to the minting of decillions of YAM to the governance vault. This YAM exists and does not vote. This means that no votes can pass, because they can never reach a quorum," he explained.
Prestwich advised users to withdraw Yam funds from Uniswap since governance of the tokens "CANNOT HAPPEN anymore" and "$750,000 in Curve y tokens are locked in the governance," meaning these funds are now lost.
Brock Elmore, a creator of the Yam protocol, tweeted: "I'm sorry everyone. i've failed. thank you for the insane support today. i'm sick with grief."
The bug details
After the publication of this story, the Yam Finance team posted a blog, describing the bug in detail. It said: "At approximately 6PM UTC, on Wed August 12, we discovered a bug in the YAM rebasing contract that would mint far more YAM than intended to sell to the Uniswap YAM/yCRV pool, sending a large amount of excess YAM to the protocol reserve. Given YAM's governance module, this bug would render it impossible to reach quorum, meaning no governance action would be possible and funds in the treasury would be locked."
Yam Finance went on to say that it believed achieving quorum for a bug-fix proposal would allow it to "save the protocol," and "quickly rallied the community to delegate their votes towards this end."
However, "shortly thereafter, with help from security experts, we concluded that the rebaser bug would interact with the governance module and prevent this proposal from succeeding."
As a result, YAM token will now live on as long as Ethereum continues to operate with support for the contract as written, said Yam Finance. "It can no longer be modified by governance, so on a technical level, it will behave in a similar fashion to other rebasing assets such as AMPL."
"The YAM / yCRV Uniswap V2 pool will remain unsafe in perpetuity," said Yam Finance, adding that the YAM community managed to get 75% of liquidity out of the pool before the second rebase, and that any remaining liquidity "should be removed ASAP."
The Yam project became instantly famous after its launch on Tuesday and at one point had surpassed around $600 million in total value locked (TVL. The current TVL is about $371 million, according to Yam.Zippo.
Similar to Ampleforth protocol's AMPL token, Yam protocol's YAM token is price elastic, meaning its supply is adjusted based on price movement. When its price is above $1, the token's supply is increased until the desired price equilibrium of $1 is reached. If the price of goes below $1, the supply is decreased until the price parity has been restored. Accordingly, the market capitalization of such tokens fluctuates sharply based on their prices.
The sudden drop in YAM's market capitalization appears to have also affected prices of other tokens that were available to stake within the protocol, including WETH, LINK, YFI, AAVE, SNX, MKR and COMP. The price of ether (ETH) is also down at the time of writing.
As for what's next for YAM, the project team said in the blog post that they would set up a Gitcoin grant to coordinate a community-funded audit of the YAM contracts. The project was unaudited and barely had a working site at launch. "If the funding goal is reached, upon the completion of the audit, we plan to support the launch of YAM 2.0 via migration contract from YAM," the team concluded.
Update: This story has been updated to include additional details from Yam Finance
© 2023 The Block Crypto, Inc. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.