Yearn is asking users who profited from the bug to return a "reasonable" amount to the protocol’s multisig.