Harvest Finance admit “engineering error” led to $24M theft

The post-mortem report promised affected users would be remediated

Harvest Finance is a DeFi yield aggregator that allows users to earn maximum yields by implementing investment strategies on DeFi projects. However, yield farming is still experimental and smart contracts carry risks, as evidenced yesterday.

The hack took place on October 26 at 02:53:31 UTC when the attacker stole a total of $24 million from Harvest Finance’s USDC and USDT vaults by manipulating the value of assets inside the Y pool of Curve.fi. The attacker exploited an arbitrage and impermanent loss using a large flash loan.

Harvest Finance’s post-mortem report, released late last night, detailed how the attacker used market trades with a large volume to decrease the share price of fUSDC by approximately 1%. However, as the arbitrage check inside Harvest’s strategy did not exceed the 3% threshold, it did not revert the transaction.

After 17 attack transactions on the USDC vault, the attacker repeated the process for the USDT vault, taking a total of seven minutes, though they then sent back almost $2.5 million to the Harvest deployer.

The hack caused the share price of the USDC vault to fall by 13.8% and that of the USDT vault to fall by 13.7%. Harvest Finance estimated a 3.2% loss of the total value locked in the protocol, and  CoinGecko data show that FARM, the native token of Harvest Finance, dropped 58% from $232.78 to $96.90 in the three hours following the attack.

In response, Harvest Finance have taken responsibility for the engineering error that allowed the attack to take place and are making remediation for affected users a top priority. They are also delaying the smart contract improvements, scheduled to be released today, until their security has been reassessed.

The team are now looking into mitigation strategies for the future, such as a stricter threshold for the arbitrage check — using oracles to determine asset price — and the implementation of a commit-and-reveal mechanism for deposits, which would mean users could no longer perform deposits and withdrawals within a single transaction.

Harvest Finance said they had no interest in doxxing the attacker but offered a $100,000 bounty for the first person or team to help return the funds, or a $400,000 bounty if the return takes place in the next 36 hours.

However, some in the crypto community think that the Harvest Finance developers may actually be involved in the attack. DeFi analyst Chris Blec pointed out on Sunday that Harvest Finance was run by an anonymous team with one admin key that could potentially be used to drain funds.