The Exploit Mechanics
On January 1, 2021, blockchain developer Nour Haridy discovered a critical vulnerability in the yCredit DeFi protocol, a project launched by André Cronje, creator of yEarn.Finance. The exploit allows an economic attack that can drain all user funds from the smart contract. Haridy described the vulnerability as capable of causing “loss of all user funds” and immediately warned users who had deposited into the contract using Etherscan or bought yCredit on Sushiswap to withdraw or sell their positions immediately.
Affected Systems
The yCredit platform, which had been unveiled just days earlier on December 31, 2021, allows users to deposit ERC-20 tokens and borrow yCredit coins equivalent to 99.5% of the deposited amount. With Bitcoin trading at $29,374.15 and Ethereum at $730.37 on January 1, 2021, the potential value at risk was substantial. The vulnerability specifically targets the economic mechanisms within the smart contract rather than traditional code exploits, making it particularly dangerous as it could be executed by anyone who understands the financial incentives.
The Mitigation Strategy
Haridy’s warning was straightforward and urgent: “I’ll publish the exploit after all funds are withdrawn.” The discovery was shared with developer Ivan Martinez, who confirmed the exploit’s functionality. Martinez also noted that someone had already exploited a different attack vector against yCredit, suggesting multiple vulnerabilities in the system. The protocol was in an “experimental stage” according to Cronje, but users were participating with real funds worth millions of dollars at current market prices.
Lessons Learned
This incident highlights several critical lessons for the DeFi space in early 2021. First, even established developers like André Cronje can deploy experimental code with significant flaws. Second, the pressure to innovate quickly in DeFi often leads to insufficient testing and auditing. Third, users must remain vigilant and understand that experimental protocols carry inherent risks, even when created by reputable developers. The total cryptocurrency market cap was approximately $546 billion for Bitcoin and $83 billion for Ethereum alone on this date, making the stakes exceptionally high.
User Action Required
Users who had interacted with yCredit were advised to immediately withdraw their funds or sell their yCredit tokens on secondary markets. The vulnerability represented a systemic risk that could be exploited at any time. Haridy’s decision to publish the full exploit details only after all funds were withdrawn was an ethical compromise aimed at protecting users while maintaining transparency about the protocol’s weaknesses. This incident served as an early warning about the dangers of economic attacks in DeFi protocols, a threat vector that would become increasingly prominent throughout 2021.
Despite the warnings, the yCredit project continued as an experimental protocol, underscoring the Wild West nature of early DeFi development where user funds were often treated as playtest capital rather than protected assets.
cronye launching yCredit on dec 31 and someone finding a total drain bug by jan 1. man does not sleep between shipping and auditing
andre cronje launches something on new years eve and by jan 1 its already drainable. degen speedrunning at this point
andre launching on new years eve is the most degen timeline. dude literally couldnt wait 24 hours to push untested code to mainnet
Andrei P. andre literally announced yCredit on twitter then went silent for hours while deposits kept flowing. the cronje cult was unreal
bro haridy found it within hours of launch. imagine if he wasnt whitehatting
The 99.5% collateralization ratio was the red flag. No sane protocol lets you borrow that close to the deposit value without asking for trouble.
right, even Aave caps at like 80% on stablecoins. 99.5% on volatile assets is just asking for cascading liquidations
Even MakerDAO with years of battle testing caps at lower ratios. This was a governance failure before it was a code failure.
exactly. who approved 99.5% LTV in governance? thats the real question nobody is asking
chain_safety_net 99.5% LTV on volatile assets approved by governance. every voter on that proposal should be held accountable
99.5% LTV is basically a gift to anyone who understands liquidation mechanics. haridy flagged it immediately but the governance voters approved it anyway. accountability is zero
borrowing 99.5% of collateral value in a fresh token on a brand new contract. what could possibly go wrong
Olu A. borrowing 99.5% means a 0.5% price move liquidates you. the system was designed to fail on any market volatility
borrowing 99.5% of deposited value. who approved that ratio lol
andre dropping yCredit on new years eve with zero audits is the most 2021 thing possible. the whole era was ship first, audit never
nour haridy finding this hours after launch and andre cronje not responding for almost a full day was terrifying. people were depositing the whole time
99.5 percent borrow against your own deposit is not a feature its a trap. one oracle wick and the whole thing cascades
launching unaudited code on new years eve that lets you borrow 99.5% of your deposit. peak degen finance
Launching unaudited code on New Year’s Eve with 99.5% LTV? That’s peak degen finance and the exact kind of recipe for cascading liquidations.
security_hawk is right. Even MakerDAO with years of battle testing caps at lower ratios. This was governance failure before it was code failure.
haridy found it by reading the contract, not by getting tipped off. dude was just browsing etherscan and noticed the 99.5% LTV ratio was basically a free flash loan target
Theodora V. the 99.5% collateral ratio was the smoking gun. anyone with basic defi literacy could see the economic exploit path from there
andre deployed like 12 protocols in december 2020 alone. yCredit was rushed even by his standards. the whole yearn ecosystem was held together with sushi incentives and hope