# \[IIP-17\] IdleTokens upgrade to remove flash loans

**URL:** <https://gov.pareto.credit/t/iip-17-idletokens-upgrade-to-remove-flash-loans/738>\
**Category:** ⛓ IIPs\
**Created:** [November 19, 2021, 6:12pm UTC](https://gov.pareto.credit/t/iip-17-idletokens-upgrade-to-remove-flash-loans/738 "2021-11-19T18:12:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![william](https://yyz1.discourse-cdn.com/flex031/user_avatar/gov.pareto.credit/william/32/10_2.png) [@william](https://gov.pareto.credit/u/william)\
**Post date:** [November 19, 2021, 6:12pm UTC](https://gov.pareto.credit/t/iip-17-idletokens-upgrade-to-remove-flash-loans/738/1 "2021-11-19T18:12:27Z")

</div>

### Authors

Treasury League and Dev League

### Summary

This proposal disables the `flashLoan` functionality from Idle Protocol.

### Rationale

Idle Leagues were notified regarding a potential vulnerability that was affecting partners’ integration with Idle Protocol.

The vulnerability was discovered and **mitigated within 1 hour**. All funds are safe and no action is required by partners or users. **Deposits in Idle protocol have always been safe**.

To dampen any possible malicious outcome on the partners’ side, Leagues activated [the Pause Guardian procedure](https://docs.idle.finance/advanced/admin-powers). The `deposit` and `rebalance` functions have been temporarily paused on Ethereum, while `redeem` is still available. This IIP does not involve Polygon strategies, which have been already updated.

IIP-17 will finalize the issue removal by changing the `flashLoan` method in a no-op, effectively disabling this functionality. After the on-chain execution of IIP-17, the protocol can be unpaused and `deposit` and `rebalance` functions activated again.

A more in-depth analysis will be made in the future on a possible fix that would allow flash loans to be offered in the Idle protocol without creating similar issues. A detailed description of the potential partners’ vulnerability is available in [this report](https://idlefinance.medium.com/potential-vulnerability-disclosure-2021-11-18-9bc0a2cdc0f2).

### Specifications

The new implementation is available [here](https://etherscan.io/address/0x577d963246d28dbe0dc579048adda421b054924a).

The code for the IIP is [here](https://github.com/Idle-Finance/idle-proposals/blob/main/scripts/iip-17.ts).

With one action still available in IIP-17, Dev League proposes to also include a minor update related to idleFEI Best-Yield (proxyAdmin update). This update is not related to the potential vulnerability fix described above.

Actions:

- IdleToken update: 9 actions
- idleFEI Best-Yield proxyAdmin update: 1 action

### Next Step

We are going to leave this thread open for comments regarding these changes, and in about 24hrs, if there are no objections, we will proceed with the on-chain proposal and the voting phase.

---

<div class="post-metadata">

**Author:** ![Davide](https://yyz1.discourse-cdn.com/flex031/user_avatar/gov.pareto.credit/davide/32/3_2.png) [@Davide](https://gov.pareto.credit/u/Davide)\
**Post date:** [November 20, 2021, 6:20pm UTC](https://gov.pareto.credit/t/iip-17-idletokens-upgrade-to-remove-flash-loans/738/2 "2021-11-20T18:20:29Z")

</div>

### On-chain Voting Phase

✍ Cast your on-chain $IDLE vote here: [IIP-17](https://idle.finance/#/governance/proposals/17)  
🗓 End date: Nov 23th

✍ $IDLE stakers (stkIDLE holders) can vote here: [stkIDLE snapshot poll](https://snapshot.org/#/staking.idlefinance.eth/proposal/0x0e1e7fbf23a3e602dfe4fa8ba41043faeb06a3eff20b08bff0d3f024b48d2788)  
🗓 End date: Nov 22th

Threshold to make the off-chain poll valid (both metrics should be reached): 30% of circulating stkIDLE voting the poll (min. 87’857 stkIDLE) and at least 70% on the same option.  
The [stkIDLE voting calculator](https://docs.google.com/spreadsheets/d/1BnH9boRmBADuyquvDMh0AmQfF97Zj76sIENKtySLU8o/edit?usp=sharing) will be used to calculate the final results.

---

<div class="post-metadata">

**Author:** ![Davide](https://yyz1.discourse-cdn.com/flex031/user_avatar/gov.pareto.credit/davide/32/3_2.png) [@Davide](https://gov.pareto.credit/u/Davide)\
**Post date:** [November 25, 2021, 6:28pm UTC](https://gov.pareto.credit/t/iip-17-idletokens-upgrade-to-remove-flash-loans/738/3 "2021-11-25T18:28:44Z")

</div>

The proposal has been **executed** , with more than 786k votes! 💪