Yearn yBOLD — Deposit after loss report free-rides collateral recovery

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 57687-h-2-attacker-can-deposit-after-the-keeper-reports-a-loss-but. Standalone Foundry PoC and full write-up: 57687-h-2-attacker-can-deposit-after-the-keeper-reports-a-loss-but_exp in the evm-hack-registry mirror.

Vulnerability classes: frontrun-exposure · direct-drain · liquidation-logic

Reproduction: self-contained Foundry PoC with only forge-std — no fork. Full trace: output.txt. PoC: test/57687-h-2-attacker-can-deposit-after-the-keeper-reports-a-loss-but_exp.sol.

Key info#

TL;DR#

1. Victim deposits into the strategy.
2. Stability Pool liquidation burns BOLD; collateral gains are unrealized.
3. Keeper report() books a loss (PPS drops) because harvest only counts free BOLD.
4. Attacker deposits at the depressed PPS (mints excess shares).
5. tend auctions coll → BOLD; next report books profit; attacker redeems more than deposited.

The vulnerable code#

function report() external returns (uint256 profit, uint256 loss) {
    // @> VULN: free BOLD only — unrealized coll gains ignored → temporary loss
    uint256 newTotalAssets = harvestAndReport();
    // FIX: mark coll to market, or delay loss until auction settles
    ...
}

Management can disable health checks / set a high loss limit so the temporary loss is accepted.

Root cause#

Strategy accounting is BOLD-only between liquidation and collateral auction. A report in that window socializes an unrealized loss into PPS. Late depositors mint cheap shares that claim the recovery when coll is sold.

Preconditions#

• Prior depositors in the strategy.
• A Stability Pool liquidation that reduces BOLD while leaving coll gains.
• Management allows the loss to report (setDoHealthCheck(false) or non-zero loss limit).
• Attacker can deposit after the loss report and before tend/report of the recovery.

Attack walkthrough#

1. Victim deposits 100e18.
2. Simulate liquidation: −50e18 BOLD, +50e18 unrealized coll value.
3. report() → totalAssets = 50e18 (loss booked).
4. Attacker deposits 100e18 → mints 200e18 shares at half PPS.
5. tend + report restore 50e18; attacker redeems ~133e18 → +33e18 profit, victim −33e18.

Diagrams#

Impact#

Prior depositors permanently lose a large fraction of assets to a well-timed deposit between loss report and collateral realization. Finding PoC shows >30% theft of a depositor's funds.

Taxonomy#

• genome: frontrun-exposure, direct-drain, liquidation-logic
• severity/high · sector/vault · sector/yield-aggregator · platform/sherlock

Sources#

• AuditVault finding #57687
• Sherlock judging issue #155
• Vulnerable source: sherlock-audit/2025-05-yearn-ybold → yv3-liquityv2-sp-strategy Strategy harvest/report path vs Liquity SP coll gains

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 57687-h-2-attacker-can-deposit-after-the-keeper-reports-a-loss-but_exp (evm-hack-registry mirror).
• AuditVault finding: 57687-h-2-attacker-can-deposit-after-the-keeper-reports-a-loss-but.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.