BarnBridge SMART Yield Protocol Hit by $776K Governance Attack on Ethereum

The BarnBridge SMART Yield (cUSDC) protocol was attacked on Ethereum, resulting in a loss of approximately $776,000, according to ChainCatcher. The incident is suspected to be a governance attack. According to ChainCatcher, the attacker first gained DAO governance permissions and then upgraded the SmartYield/controller proxy to a malicious implementation contract. This contract subsequently called the _takeUnderlying privileged function of CompoundProvider, exploiting pre-existing USDC approvals from 50 user accounts to transfer aggregated funds to the attacker via transferFees.