Single-line software bug causes fledgling YAM cryptocurrency to implode just two days after launch
- Reference: 1597349086
- News link: https://www.theregister.co.uk/2020/08/13/yam_cryptocurrency_bug_governance/
- Source link:
"At approximately 6PM UTC, on Wednesday, August 12, we discovered a bug in the YAM rebasing contract that would mint far more YAM than intended to sell to the Uniswap YAM/yCRV pool, sending a large amount of excess YAM to the protocol reserve," the YAM project explained in [1]a post on Thursday.
"Given YAM’s governance module, this bug would render it impossible to reach quorum, meaning no governance action would be possible and funds in the treasury would be locked."
The bug followed from this line of code... totalSupply = initSupply.mul(yamsScalingFactor);
...which was supposed to be… totalSupply = initSupply.mul(yamsScalingFactor).div(BASE);
YAM, a decentralized finance experiment, implements a [2]governance system (for making protocol changes) based on supposed smart contracts that allocates votes based on assets.
"A bug in the distribution logic caused the contracts to mint far far more tokens than intended," explained James Prestwich, founder of crypto biz [3]Summa , in an email to The Register .
"These tokens were owned by the governance contract itself, and therefore couldn't vote. Because they exist and can't vote, it's impossible to ever meet the minimum voter participation. This means governance is permanently disabled, and all other tokens held by the governance contracts are permanently locked."
The code flaw locked up about $750,000 worth of Curve (yCRV) tokens in the YAM treasury, assets intended to serve as a reserve currency to support the value of YAM tokens.
YAM's creators insist the bug didn't directly affect YAM balances or assets in so-called staking contracts, which involve locking cryptocurrencies for a time in exchange for some reward.
Nonetheless, after efforts to regain control of the YAM treasury failed, Yam Finance co-founder Brock Elmore tweeted an apology.
i’m sorry everyone. i’ve failed. thank you for the insane support today. i’m sick with grief — belmore🍠 (@brockjelmore) [4]August 13, 2020
Absent any hope of retaking control of YAM's regulatory system, its tokens, which reached [5]a theoretical value of $183.44 on Wednesday, plummeted to $1.04.
With close to 29 million YAM tokens in circulation, the project had a market capitalization of about $525m at one point yesterday. It still appears to have about $29m in value, if you can find any YAM buyers.
It's not as if cryptocurrency investors couldn't have seen this coming. The project's GitHub repo states explicitly that there's been no audit of the code.
Software bug in Bombardier airliner made planes turn the wrong way [6]READ MORE
"Contributors have given their best efforts to ensure the security of these contracts, but make no guarantees," the project's [7]README.md file explains. "It has been spot checked by just a few pairs of eyes. It is a probability – not just a possibility – that there are bugs."
The associated website, [8]yam.finance , also loads a pop-up warning when visited.
"This bug would likely have been caught by in-depth outside review or audit," said Prestwich, who observed that the project attracted interest because its creators leveraged relationships with influencers in the crypto community. "It would certainly have been caught by industry-standard testing practices."
Undeterred by its initial failure, YAM Finance aims to try again.
"We will be setting up a Gitcoin grant to coordinate a community-funded audit of the YAM contracts," the crypto outfit [9]said Thursday in a post-mortem post. "If the funding goal is reached, upon the completion of the audit, we plan to support the launch of YAM 2.0 via migration contract from YAM." ®
Get our [10]Tech Resources
[1] https://medium.com/@yamfinance/yam-post-rescue-attempt-update-c9c90c05953f
[2] https://compound.finance/docs/governance
[3] https://summa.one/
[4] https://twitter.com/brockjelmore/status/1293820056682377216?ref_src=twsrc%5Etfw
[5] https://coinmarketcap.com/currencies/yam/historical-data/?start=20200713&end=20200813
[6] https://www.theregister.com/2020/05/29/bombardier_missed_approach_bug/
[7] https://github.com/yam-finance/yam-protocol
[8] https://yam.finance/
[9] https://medium.com/@yamfinance/yam-post-rescue-attempt-update-c9c90c05953f
[10] https://whitepapers.theregister.com/
Re: Who didn't bother to test their code?
Move fast and break things, baby!
Unless one of those things is the backbone of your whole project... maybe don't break that.
???
"something something something, something something something, something something something" the YAM project explained.
I take issue with the use of the word 'explained'. I mean, I guess maybe 4 people understood that?
Re: ???
People: We don't trust banks, we want to entrust our money to rules set out in a computer program, which are impossible to bypass. Normally the rules would be impossible to change, but the computer program we're using has this amazing new feature: a software update routine! If the majority of people using this computer program agree, we can upgrade it to a new computer program with different rules!
Later: Oh no! The computer program had a bug in it's software update routine, now we can't update it! Whoever would have thought that a computer program that hadn't been reviewed or properly tested would have a bug in it?!!!
I'm shocked! Shocked I tell you!
That "garbage in, garbage out" still holds.
Re: I'm shocked! Shocked I tell you!
This time it was more a case of garbage in, feck all out.
Re: I'm shocked! Shocked I tell you!
Or was it money in, garbage out?
Of course that's been going on a long time as well.
Bah,
these kids can't even build a decent pyramid these days.
oh noes
those poor, poor crypto speculators who lost a ton of money..
And being zero-sum, the guy who discovered and/or was responsible for the bug probably ran away with most of it!
Grammar as Intelligence Measure
I may be old fashioned, but I like my sentences with uppercase letters, and punctuation.
"i’m sorry everyone. i’ve failed. thank you for the insane support today. i’m sick with grief"
Communicating like that never fills me with confidence in u. (See what I did there? That one pisses me off to no end.)
So how much money did these charlatans make by discovering this intentional bug? A simple unit test or a code review should have caught it.
Smart contracts... they are only as smart as the dumbass that wrote the code.
Who didn't bother to test their code?
Because, you know, that's BORING, and besides, I'm too cool to make mistakes.