A new yield farming decentralized finance project has seen users lock over $500 million worth of cryptoassets on it before a bug was discovered, and plans for a second version of the project were created.
The Yam.Finance DeFi project combines a number of decentralized finance applications, including an elastic supply inspired by Ampleforth, a fair distribution similar to Yearn.Finance, and on-chain governance comparable to that of Compound Finance.
On a blog post, the team that developed the Yam protocol described it as an experimental one that mashes up some of the “most exciting innovations in programmable money and governance.” The post details that the governance of the project is determined by YAM token holders, and that the token itself “holds zero inherent value; any value which might accrue would be an entirely emergent property of the community that takes control.”
YAM holders determine and update the protocol’s functionality, oracle usage, rebase functionality, inflation, treasury, and more, the post adds. Demand for the project skyrocketed right after launch, with users locking over $170 million worth of cryptoassets on it in the first six hours, and over $500 million before things went wrong.
The hype surrounding the project saw BitMEX founder Arthur Hayes tweeted out he has been farming YAM tokens, adding “long live the defi bull market.” Other crypto observers joined in on the hype, while critics pointed out the project’s codebase was unaudited.
Indeed, entering Yam.Finance’s website users are met with a message warning that the developers strongly urge caution to those engaging with its smart contracts, pointing out the project has not been audited. The message reads:
While the initial creators of the Yam protocol have made reasonable efforts to attempt to ensure the security of the contracts, including forking much of the codebase from existing well-audited projects and soliciting review from friends, nothing approaching the rigor of a formal audit has been conducted at this time.
Things went wrong for the project, however, after a bug in its smart contract was found affecting the rebasing contract. The team behind the project announced the bug was found on Twitter and mobilized the decentralized finance community to achieve quorum for a bug-fix proposal that could save the protocol.
The bug would essentially mint more YAM than intended to sell on the YAM/yCRV pool on the decentralized exchange Uniswap, making it impossible for the community to reach quorum as far too many tokens were attributed to the reserve.
After the bug-fix proposal had sufficient votes, the team discovered that the “rebaser bug would interact with the governance model and prevent this proposal from succeeding.” This seemingly means the bug cannot be fixed, although “YAM will live on as long as Ethereum continues to operate with support for the contract as written,” although governance is now impossible.
Reacting to the news YAM token holders quickly sold off their tokens. Data from Uniswap shows that the tokens hit a $200 high before moving back down to $100 amid the initial hype. As users realized governance was impossible, its price plummeted to $0.9 at press time.
In a blog post addressing the situation, YAM’s developers clarified the YAM/yCRV Uniswap pool will “remain unsafe in perpetuity.” They are now planning the launch of YAM 2.0, a second version of the protocol that will have its code audited.
The audit will be funded after a Gitcoin grant is set up to coordinate the crowdfunding effort. The team then plans to “support the launch of YAM 2.0 via migration contract from YAM.”
Featured image by Louis Hansel @shotsoflouis on Unsplash.
