On December 13, we launched an updated Yupana.Finance contracts and asked users to migrate their positions from the old protocol to the new one. In this publication, we’ll disclose the reasons for these changes.
So, What Happened?
We discovered a vulnerability in the Yupana Protocol, which was reported anonymously via Cryptonio. This flaw allowed for the liquidation of some user debts secured by multiple collaterals only, even when the health factor appeared satisfactory. It didn’t concern the users who provided only one collateral or had no debt.
The issue originated from miscalculating the collateral’s dollar value when multiple collaterals were involved. In response, we swiftly implemented a fix, redeployed contracts, and introduced a new front-end. You can check out the fix here.
At the moment when migration was requested, users with multiple collaterals had opened $520,000 in debts, but only 2 of them were at risk. If they were liquidated, their maximum losses would be $500.
“Only two users were at risk. Their maximum losses would not exceed $500.”
However, since our users’ safety is our priority, we decided to proceed with the migration, and the bug wasn’t exploited in these positions.
What about QuipuSwap – Yupana pools?
Additionally, we took measures with Quipuswap stableswap + Yupana pool. The positions were not affected by the issue but started to remove liquidity from Yupana gradually. We decided not to do it immediately to prevent high interest rates and allow other liquidity providers to migrate first. Once all liquidity is withdrawn by Quipuswap stableswap + Yupana pool, it will be placed in the new Yupana version. No actions are required from Quipuswap’s liquidity providers.
We extend our deepest appreciation to the anonymous individual who reported this issue, aiding us in upholding the security of the Yupana Protocol. We appreciate your understanding and thank you for your support.
How to migrate your positions?
If you haven’t migrated to the updated Yupana protocol from the old one, here is a guide.
- Go to the old version of Yupana.Finance using this link: https://old.yupana.finance/lending and connect your wallet.
- Start with repaying borrow positions if you have such ones. (If you don’t have free assets to repay loans and need liquidity withdrawal, try to complete these actions gradually, operating with a small amount.).
- When you close borrow positions, withdraw your collaterals.
- Go to the updated Yupana version https://app.yupana.finance/lending and connect your wallet.
- Deposit your collaterals.
- Toggle collaterals.
- Proceed with your borrows.
That’s all!
If you have questions or need assistance, join our Telegram and Discord communities and follow Yupana.Finance on Twitter.
