TechFlow reports that Yearn Finance, a liquidity mining protocol, said an erroneous multisig script wiped out 63% of its treasury position (equivalent to $1.4 million), though no user funds were affected.
According to a disclosure post on Github, the incident occurred during "a routine fee token conversion representing Yearn's treasury." The faulty script caused 3,794,894 lp-yCRVv2 tokens to be swapped for 779,958 yvDAI tokens. The entire treasury balance of lp-yCRVv2 (POL plus fees) was mistakenly transferred into the transaction multisig, whereas only a much smaller fee portion was intended. The multisig used for token swaps lacked sufficient output checks and contained a logic flaw that failed to limit transaction size to reasonable amounts.
Currently, Yearn stated that communication channels are open and expects some funds to be returned. To prevent similar incidents in the future, protocol developers plan to separate POL funds into dedicated management contracts, introduce more user-friendly transaction script output messages, and enforce stricter price impact thresholds.
