Aug 5 - CREAM, YFI Whale, yVault Bugs

With DeFi the layers keep going on and on.

A new protocol called $CREAM launched this week by Jeffrey Huang. It's unclear whether Huang got the okay with Wu-Tang.

$CREAM is a Compound Fork (p2p lending) that offers support for governance tokens like $YFI and $COMP.

We believe this is the first time it has been done, further lending credibility to our view that valueless governance tokens are actually not valueless and do much more than governance.

Is $CREAM Credible?

That's up for you to decide.

But here's where things get very very interesting.

15% of all the $YFI in the world is currently locked into the $CREAM protocol.

From @bambouclub (private twitter):

"Fucking mysterious. The whale locked a LOT of $yCRV into @iearnfinance really early, 18/19 July, and earned enormous sum of $YFI and also bought some. And then deposited $YFI liquidity to $CREAM (COMP knock-off), and deposited into $CREAM Uniswap pool. Also $WIFEY."

What's $WIFEY?

Just another in a long line of $YFI clones with direct ties to $CREAM.

From Decrypt.co

Here’s how WIFEY distribution works: Users stake funds to the Curve yCRV pool and receive yCRV tokens in exchange. Then they supply their yCRV to C.R.E.A.M and receive crYCRV tokens in exchange. Finally, users stake their crYCRV tokens at Pool 1 in wifey.finance and, well, get WIFEY rewards for providing liquidity.

So either Jeffrey Huang is the YFI_Whale made famous by this early forum post or he is likely in direct contact with the group.

Good, bad, bullish, bearish?

We're not sure, but it's a lot of fun to think about and distracting to say the least.

This experiment is moving faster than anyone can keep up with.

yVAULT Security Review + Upgrade

Testing in prod is great for releasing the best innovative DeFi products, but will be horrible if / when an exploit occurs. This is a major concern for the community and until it's further addressed, Yearn will never reach its full potential.

Andre has been open, transparent and working with the best members of the cryptocurrency community to take immediate action on securing your funds.

As Jun-You Liu tweeted today: "Your WAIFU is SAFU".

Someone should print it on a shirt.

The samczsun $USDC yVault bug

The community has been waiting for a review and here it is:

The initial release of yVault contained logic for computing the price of yUSDC that could be manipulated by an attacker to drain most (if not all) of the pool’s assets.

Fortunately, Andre, the developer, reacted incredibly quickly and disabled the faulty code, securing the approximately 400,000 USD held at the time.

Continue reading at Trailofbits.com

The yCRV yVault Code bug

In YearnV2, when users deposit funds with vault tokens, they would get some shares. As users withdraw, they would burn the shares and supposedly get their tokens and profits back. Thus, we looked into the functions that are related to share calculation.

We identified 4 issues. One of which is valid but it only affects new vaults. Others are related to the fact that the implementation of the yCurve yVault/Strategy pair does not consider the case if Vault Token is not Want Token.

Continue reading at hackmd.io

The community coming together to support Yearn and $YFI as we push forward into democratizing DeFi for everyone is incredible. We are happy to be a very small part of it.

As expected YIP-33 has passed with a stunning 3,069.4360 votes for (whoever voted with that last .16 ruined a great meme) to 16.3954 votes against.

The running joke is who knew Zeus Capital had 16 YFI.

The official Yearn twitter account said to expect a deployment in 3-4 days, so that could be as early as Friday or Saturday.

We like to think $YFI is Mia and $LINK is Vincent Vega. Let's get this dance party started.

@learn2yearn