Yield Basis disclosed a fee extraction vulnerability and proposed a $WETH policy with Pyth-linked swap fees to address it, pending governance approval.
DeFi & Yields ·
Yield Basis disclosed on October 28, 2026 a deposit-and-withdraw route allowing traders to extract pool value without paying required fees, and proposed a governance-dependent fix using Pyth-signed market prices to set swap fees. The protocol's proposal 60, scheduled for a governance vote ending October 29, pairs the fee constraint with a new YBOraclizedPolicy contract that uses external $ETH/USD price feeds to adjust fees between 0.50% and 1.75% based on whether trades move the pool toward or away from market prices. The Curve emergency DAO retains ability to disable the policy, and full technical details remain withheld until deployment reaches all pools.