# Yield Protocol: logic error in strategy vault drains 181K

Yield Protocol strategy vault had a logic error allowing an attacker to mint and burn tokens to inflate value and steal 181K USDC via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: Yield
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-30
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/Yield_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240430-yield
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:business-logic vuln:flash-loan

**Target:** YieldStrategy contract on Arbitrum
**Root cause:** The strategy vault's mint and burn functions incorrectly accounted for donated pool tokens, allowing an attacker to manipulate the share price and extract funds.
**Steps:**
1. Flash loan 400,000 USDC from Balancer.
2. Transfer 308,000 USDC to YieldStrategy_1 and call mintDivested to receive pool tokens.
3. Transfer half of pool tokens to YieldStrategy_2 and call mint to receive strategy tokens.
4. Transfer remaining pool tokens to YieldStrategy_2 (donation) and call burn to redeem strategy tokens for pool tokens.
5. Call mint again to recover donated pool tokens, then burn.
6. Burn remaining pool tokens via burnDivested to receive USDC.
7. Repay flash loan and keep profit.
**Exploitation:** Attacker used a Balancer flash loan to obtain 400K USDC, then interacted with YieldStrategy contracts to mint and burn tokens in a sequence that exploited a logic error, inflating the value of their holdings and allowing them to withdraw more USDC than deposited, netting 181K profit.
**Insight:** When a vault accepts donations (direct token transfers), check if mint/burn logic uses total assets including donations, which can be manipulated to inflate share price.