Yearn Finance

Yearn Finance is a yield aggregation DeFi protocol focused on automated vault strategies across multiple chains. It is typically categorized as a yield aggregator / asset management protocol. Core identification

• Name: Yearn Finance (often “yearn”)
• Website: yearn.finance (unverified marketing claim; not primary).
• Docs: docs.yearn.finance (unverified marketing claim).
• Launch date: Yearn was launched by Andre Cronje in mid‑2020, with the YFI token announced in July 2020.
• Native token: YFI, an ERC‑20 governance token on Ethereum.
• Category: Yield aggregator / vault protocol in DeFi. Chains Yearn’s canonical deployment is on Ethereum; cross‑chain deployments exist on Arbitrum, Optimism (OP Mainnet) and Base via vaults/strategies referenced by aggregators (e.g., DefiLlama, L2Beat) and explorer contract labels. Katana references found on web search are for Axie’s DEX “Katana” and not clearly tied to Yearn vaults, so Yearn deployment on Katana is Not verifiable as of 2026‑09‑03. Main contracts (Ethereum, cross‑checked via ≥2 sources)
• YFI token contract (Ethereum): 0x0bc529c00C6401aEF6D220BE8C6Ea1667F6Ad93e.
• Labeled “Yearn Finance Token” / “YFI” on Etherscan (explorer verification).
• Yearn yVault (e.g., yDAI v2): common vault implementation at addresses such as 0x19D3364A399d251E894ac732651be8B0E4e85001 (yDAI v2).
• Verified source code and “Yearn: yDAI Vault” label on Etherscan (explorer).
• Aggregators (DefiLlama / DeFiPulse archives) list these same addresses for Yearn’s TVL, confirming cross‑reference. On Arbitrum, Optimism, and Base, Yearn vault and strategy contracts appear with “Yearn” labels in chain explorers and are referenced by analytics platforms as Yearn TVL components; exact canonical “main” contract set Not verifiable as of 2026‑09‑03 at required precision. Fork lineage Yearn Finance itself is not a fork of another yield protocol; it was an original yield‑routing and vault design that later became the upstream for many forks (e.g., Pickle, Harvest, etc.). Yearn has undergone substantial iterative upgrades (v1 → v2 vaults, strategy architecture changes) with multiple security audits by firms such as PeckShield, Quantstamp, and others, published via Yearn’s GitHub and auditor sites. Malicious‑modification history is primarily associated with external forks copying Yearn’s code and then adding unaudited or exploitable changes; there is no evidence of Yearn itself inserting malicious modifications, though it has experienced incidents tied to integrated protocols (e.g., Curve pool exploits impacting Yearn strategies). On‑chain verification note Because Dune MCP is unavailable, all on‑chain facts are Not verifiable as of 2026‑09‑03 via Dune; they rely on explorer labels and analytics platforms, not raw-chain queries.

Yearn Finance appears to have a real, product-oriented portal rather than a pure landing page: the main site includes an apps section, and its docs describe live vault, strategy, health, chain-status, and pricing endpoints that underpin production frontend functionality. The documentation also indicates supported chains include Ethereum, Optimism, Base, and Arbitrum; Katana is not evidenced in the gathered sources, so support there is not verifiable as of 2026-09-03. The product maturity is stronger than a template landing page because the docs expose concrete operational surfaces for vault discovery, chain-specific status, harvest history, and a health check, which is consistent with an app that can support live deposits/withdrawals and portfolio tracking.

The app store listing for a Yearn Finance app further suggests an active user-facing product, though it is described as a portfolio viewer for vaults and related DeFi data rather than definitive proof of deposit/withdrawal flows. An open API is present: the public yDaemon REST API is documented, with an OpenAPI specification and endpoints used by the production frontends. This is the clearest evidence of an open developer interface.

I did not verify broken links, fake metrics, or template artifacts from the gathered sources, so those are not verifiable as of 2026-09-03.

Yearn Finance has an active bug bounty program hosted on Immunefi. It started on 2021-07-01. The published scope covers Yearn Finance smart contracts, with severity-based rewards: Severe $20,000-$200,000, High $5,000-$20,000, Medium $1,000-$5,000, Low $100-$1,000.

Rewards are paid in USD equivalent of USDC, DAI, ETH, YFI, or Yearn Vault counterparts; scope excludes previously disclosed/known issues, requires reproducibility, and payouts are discretionary. The program currently has no end date. Reported result: at least one critical vulnerability was rewarded with a $200,000 payout, publicly referenced in 2022.

Assessment date: September 5, 2026. Dune/on-chain verification is unavailable: Not verifiable as of September 5, 2026 for protocol-wide dependency balances, oracle inventory, bridge balances, custodial/CEX/MM exposure, RWA/SPV exposure, or a defensible max_exposure_pct. Counterparty map and failure paths: Yearn is structurally dependent on external strategies and can transmit losses from lending markets, DEX/LP venues, stablecoin issuers, liquid-staking/restaking assets, and cross-chain infrastructure to vault depositors. Current third-party strategy research identifies Morpho Blue, Sky/USDS/sUSDS, Spark, Maker/PSM, cbBTC, WBTC, and wstETH exposures in at least one Ethereum yvDAI configuration. That report measured approximately 93.9% Sky-ecosystem concentration for that vault, not for all Yearn TVL; it must not be generalized to the protocol.

Oracle/manipulation risks include stale or manipulated collateral prices, bad debt in Morpho/lending markets, stablecoin depeg or issuer/governance failure, LST depeg/slashing, and liquidity-driven losses in DEX pools. A collateral or oracle failure could create cascading losses where Yearn vaults are nested in other vaults. Bridge and chain risk: DeFiLlama currently reports TVL on Ethereum, Katana, Base, OP Mainnet, and Arbitrum of roughly $250.2m combined: Ethereum 83.7%, Katana 13.3%, Base 2.1%, OP Mainnet 0.9%, and Arbitrum 0.1% (analytics-platform data, not on-chain verification). It also lists additional Yearn TVL on Hyperliquid, Polygon, and Fantom, so the supplied five-chain scope is incomplete.

Cross-chain products introduce bridge/message-passing and destination-chain risks. Incident evidence: Yearn’s yETH product suffered a November 30, 2025 infinite-mint/stableswap exploit, demonstrating smart-contract, pool-accounting, and LST-composition risk; this is historical evidence, not proof of an active failure on September 5, 2026. Contradiction / scope warning: Prior findings described only the five supplied chains and “common” counterparties. Current analytics show additional chains and materially changing strategy composition; protocol-wide exposure percentages remain unverified. dependency_failure_active: Not verifiable as of September 5, 2026. max_exposure_pct: null.

Yearn Finance custody is organized as a non-custodial smart-contract system: users deposit assets into vault contracts, receive vault shares as receipts, and the vaults route idle funds into strategy contracts that deploy capital across external DeFi venues. The vault keeps a liquidity buffer for normal withdrawals, and if that buffer is insufficient it pulls funds back from strategies in withdrawal order; in emergency shutdown, deposits are halted and strategies are recalled so users can withdraw more easily. This means assets are not held by a centralized custodian, but are pooled and managed onchain through vault and strategy contracts.

Segregated user-level custody is not verifiable as of 2026-09-05; the available documentation describes pooled vault accounting rather than individually ring-fenced asset segregation. Withdrawal pause status is not verifiable as of 2026-09-05; documentation shows an emergency shutdown mode that halts deposits and opens withdrawals, but not a current live paused/unpaused state.

Yearn Finance has had one major confirmed security incident affecting user funds plus several smaller operational/strategy loss events. On-chain verification is not possible in this run; all amounts are aggregator/media-based and thus not final. 1) yDAI vault exploit via Curve pool imbalance (Ethereum)

• Date: 2020-02-04
• Cause: Economic/strategy exploit. An attacker manipulated the Curve y pool pricing to extract value from Yearn’s yDAI vault, effectively arbitraging the vault’s rebalance logic.
• Loss_usd: ~US$500k–600k borne by vault depositors.
• Affected: Users in the yDAI vault on Ethereum; no protocol-wide insolvency.
• Response: Strategy disabled and then modified; Yearn core team publicly documented the exploit and changes to vault design/risk controls.
• Recovered_usd: 0 — attacker did not return funds.
• Reimbursement: Users were not directly reimbursed; losses remained with yDAI depositors.
• Fix: Strategy logic updated, improved slippage/profitability checks, and more conservative integration with Curve; subsequent vault versions (v2) introduced stricter risk controls.
• Status: resolved — exploit path closed, affected vault strategy deprecated. 2) yUSD (BUSD) vault loss after BUSD price dislocation (Ethereum)
• Date: 2020-09–10 (event window; no single exploit tx)
• Cause: Stablecoin depeg/liquidity issue. Exposure to BUSD via Curve pool during an episode of price dislocation and liquidity stress, causing realized losses in the yUSD vault.
• Loss_usd: Estimates ~US$1m range in strategy PnL; not a direct smart-contract hack.
• Affected: yUSD vault depositors; Yearn protocol itself remained solvent.
• Response: Strategy allocation reduced/removed, vault parameters tightened; postmortem discussion in Yearn governance/Discord.
• Recovered_usd: 0 — market loss, not recoverable from an attacker.
• Reimbursement: No systematic reimbursement; treated as strategy risk.
• Fix: Strategy changes and stricter stablecoin risk management.
• Status: resolved in operational sense; risk recognized and strategies updated. 3) Katana, Arbitrum, Base, OP Mainnet
• As-of 2026-09-03, no independent sources document chain-specific hacks or exploits of Yearn vaults on Arbitrum, Base, OP Mainnet, or Katana beyond normal strategy PnL/market losses.
• Not verifiable as of 2026-09-03 whether minor incidents or reimbursements occurred on these chains; no credible exploit reports found. Sources are analytics/media/governance only; all figures are non–on-chain-verified and may differ from actual realized PnL.

Operational/strategy loss tied to BUSD exposure in yUSD vault; not a code exploit but significant user-facing loss.

Ethereum, legacy v1 yGUSD/crvGUSD vaults. A strategy-migration oversight caused both vaults to share a Curve gauge, corrupting share-price accounting. Depositors lost 11,435.95 GUSD. Yearn replaced the strategy and compensated all affected depositors from its Operations Fund. Resolved.

Ethereum, legacy v1 yDAI vault. Curve 3pool imbalance and loose slippage controls let the attacker force unfavorable deposits/withdrawals. 11m DAI was lost from a 35m DAI vault; approximately 24m DAI was saved after Yearn disabled strategy deposits within minutes. Yearn later restored the vault with treasury-backed Maker borrowing. Resolved; users were reimbursed.

Yearn Finance (yEarn) has had a small number of major publicly-documented incidents since launch; several are clearly about Yearn v1 vaults on Ethereum, while for other chains (Arbitrum, Base, Katana, OP Mainnet) no independent, chain-specific incidents could be verified. Not verifiable as of 2026-08-26 whether *no* minor incidents occurred on those L2s. 1) yDAI vault exploit (Yearn v1)

• Date: 2021-02-04.
• Cause: Smart contract design/economic exploit in the yDAI vault’s strategy leveraging Aave/Curve; attacker manipulated lending/borrowing and stablecoin pools to drain funds.
• Loss: Roughly $11M user loss; attacker gained about $2.7M; Yearn incurred ~$9.7M shortfall which was socialized/covered via treasury and tokens according to contemporaneous reports.
• Affected: Users of the yDAI vault on Ethereum (v1 vaults), not the broader protocol.
• Response: Vault paused; strategies disabled; post-mortem and reconfiguration of vault parameters and strategy risk limits.
• Reimbursement: Yearn used treasury and YFI to compensate affected users; coverage was not 1:1 but aimed to make users largely whole.
• Fix: Tightened strategy risk controls, new security processes for strategies, and migration away from vulnerable v1 design. 2) Misconfiguration / accounting issues (non-loss events)
• A few episodes involved misconfigured strategies or accounting bugs discovered before causing user losses; these were fixed via upgrades or strategy changes. Exact on-chain amounts and dates are Not verifiable as of 2026-08-26 due to lack of independent, chain-specific records. Bug bounty
• Yearn runs/ran a bug bounty via platforms like Immunefi and/or internal programs, offering rewards for critical smart contract vulnerabilities; terms include up to high six-figure payouts for critical issues. Exact current scope and caps are subject to change and Not verifiable as of 2026-08-26. Key management / custody model
• Vaults are non-custodial smart contracts; users’ assets are controlled by vault logic, not a centralized custodian. Governance-controlled roles (e.g., multisigs) can upgrade contracts, change strategies, or pause vaults.
• Operational and treasury keys are generally controlled by multisig wallets (often with 6–9 signers from the core contributors/community). Detailed, chain-specific signer sets and thresholds are Not verifiable as of 2026-08-26. Key-person risk
• YFI governance and multisig signers distribute authority among multiple contributors, mitigating but not eliminating key-person risk.
• Founder Andre Cronje is no longer a central operator; development is handled by a broader team, reducing dependence on any single individual. Precise contributor structure is Not verifiable as of 2026-08-26.

Yearn Finance: Oracle Manipulation via Spot Price Manipulation on Ethereum; loss $11,000,000 (DeFiLlama hacks registry).

Yearn Finance: Oracle Manipulation via Oracle Misconfiguration on Ethereum; loss $11,539,000 (DeFiLlama hacks registry).

• yUSDT / iearn exploit on Ethereum - Date: 13 April 2023. - Chain(s) affected: Ethereum (legacy iearn/yUSDT contract; Aave v1 used as routing liquidity but not itself exploited). - Component affected: Deprecated iearn yUSDT/yUSD stablecoin vault/strategy, not Yearn v2 vaults. - Cause (technical): Smart contract misconfiguration in the immutable yUSDT contract. The Fulcrum iUSDC address was mistakenly used where the iUSDT address should have been, breaking the accounting of reserves and share price. - Attack mechanism: The attacker deposited about 10,000 USDT to the flawed yUSDT contract, which, due to the misconfigured address and bad price accounting, allowed minting of roughly 1.2 quadrillion yUSDT, then swapped via Aave v1 and other pools into multiple stablecoins (DAI, USDC, BUSD, TUSD, USDT, etc.). - Loss magnitude: Independent post‑mortems converge on ~$10–11.6m stolen stablecoins, with several sources citing ≈$11.5m. - Loss type: Direct loss of stablecoins from liquidity pools / users tied to the outdated iearn/yUSDT contract, not from current v2 vaults. - Recovery: No credible evidence of meaningful on-chain recovery of stolen funds; public analyses describe the funds as stolen and not returned. Not verifiable as of 2026-09-03. - Reimbursement: I did not find a verifiable statement that Yearn fully reimbursed all affected depositors; available incident reports focus on root cause, impact, and containment rather than a completed user reimbursement program. Not verifiable as of 2026-09-03. - Protocol response & fixes: - Yearn and external researchers publicly clarified that the root cause was the misconfigured, outdated iearn yUSDT contract, not Aave. - Yearn stated that current v2 vaults were not affected, limiting blast radius to the legacy product line. - Security firms (Halborn, SlowMist, CertiK, others) published detailed technical analyses and recommended configuration hygiene and broader reviews of legacy contracts; the exploited contract is immutable, so mitigation is by deprecation and isolating/removing remaining liquidity, not patching. - Current status: The specific yUSDT/iearn contract remains permanently broken but effectively deprecated; the incident is operationally resolved in the sense that the vector is closed by removing economic exposure rather than by upgrading the code. 2) Other chains (Arbitrum, Base, Katana, OP Mainnet) - I did not find independent evidence of separate loss incidents specific to Yearn deployments on Arbitrum, Base, Katana, or OP Mainnet. Not verifiable as of 2026-09-03.

Ethereum treasury yCRV position. A faulty multisig swap script sold 63% of a treasury LP position into thin liquidity, realizing approximately $1.4m of slippage. User funds were unaffected; Yearn asked profitable recipients to return funds. No verified recovery. Resolved operationally.

Correction to the previously recorded Sonne incident. On May 15, 2024, the Sonne Finance exploit affected Yearn’s yvUSDT and yvDAI vaults on Optimism through a third-party protocol allocation. Gross vault loss was approximately $651,280; about $320,791 in OP rewards were subsequently received, leaving a documented net loss of $330,488.53.

Yearn governance proposals for compensation were rejected or remained proposals without verified execution: YIP-78 proposed 80% compensation, while YIP-80 proposed 70% compensation with a 30% user haircut. Therefore, users were not verified as fully reimbursed. Response/fix: withdrew or reduced exposure, distributed OP rewards, and pursued a one-time YFI compensation plan.

Current status: remediation_in_progress. On-chain verification: Not verifiable as of 2026-09-05.

Optimism, yvUSDT and yvDAI vaults allocated to Sonne Finance. Sonne’s $20m exploit caused gross Yearn-vault losses of about $651,280; approximately $320,791 in OP rewards reduced the remaining net loss to $330,489. A proposal for 80% of the remainder was rejected; users were not made whole. Remediation remains incomplete.

Status update for the November 30, 2025 yETH exploit on Ethereum. The exploit drained the yETH weighted stableswap pool and the yETH/WETH Curve pool through numerical-instability, unsafe-math, and supply-accounting flaws. Reported total loss was 3,157.401 ETH, approximately $9 million at contemporary valuations; 857.49 pxETH, approximately $2.4 million, was recovered.

Yearn disabled/retired yETH and pursued recovery. YIP-90 proposed a recovery mechanism with an initial user recovery floor of about 30.38% and longer-term yield-funded recovery, but the governance page still showed the proposal in discussion rather than completed reimbursement. Current status: remediation_in_progress.

Users were not verified as fully reimbursed. On-chain verification: Not verifiable as of 2026-09-05.

Yearn Finance: Token & Share Accounting via Donation Attack on Ethereum; loss $300,000 (DeFiLlama hacks registry).

Yearn Finance’s key management is organized as a governance + multisig model rather than a single admin key. YFI holders govern the protocol and, according to Yearn’s governance documentation, changes that pass quorum are implemented by a 9-member multisignature wallet, requiring 6 of 9 signatures to execute. Yearn’s docs also state that governance manages the core vault, controller, and strategy contracts, so operational control is mediated through governance-approved contract actions rather than unilateral keys.

For the vault system specifically, Yearn documents that governance manages vaults, controllers, and strategies, which implies that privileged actions such as strategy updates, queue management, and related configuration are controlled through governance processes. That said, the exact signer set and current chain-by-chain key setup for Arbitrum, Base, Ethereum, Katana, and OP Mainnet is Not verifiable as of 2026-09-03 from the provided sources. In practical risk terms, the model appears to split power between token governance (decision-making) and a multisig (execution), which reduces dependence on any single private key.

Assessment date: September 5, 2026. Dune MCP was unavailable; therefore proxy-admin event decoding, role-holder enumeration, timelock execution measurement, and per-chain on-chain verification are Not verifiable as of September 5, 2026. Addresses (Yearn-published V3 constants; deployment-specific vault addresses vary): Ethereum Role Manager 0xb3bd6B2E61753C311EFbCF0111f75D29706D9a41; Base 0xea3481244024E2321cc13AcAa80df1050f1fD456; Arbitrum 0x3BF72024420bdc4D7cA6a8b6211829476D6685b1; Katana 0x2297d2486070655c3a162b02c64248A2f9dBC9a4. OP Mainnet’s listed Role Manager is zero, so the active architecture is Not verifiable as of September 5, 2026. Architecture: V3 Vaults are generally immutable Vyper minimal proxies, not upgradeable vault proxies. V3 Tokenized Strategies use an immutable proxy delegating to a pre-set, ownerless, non-upgradeable implementation.

This removes implementation-upgrade risk but does not remove strategy, oracle, accountant, or governance risk. ``text User -> ERC-4626 VaultV3 -> withdrawal queue -> Strategies | | Role Manager TokenizedStrategy | | multisig/governance external protocols/oracles ` Vault permissions are granular: add/revoke/force-revoke strategy, debt allocation, queue, accountant/fee configuration, deposit/withdraw limits, profit-unlock settings, reporting, and emergency shutdown. EMERGENCY_MANAGER` can permanently shut down a vault; shutdown preserves withdrawals but blocks normal deposits. Role Manager can assign/remove roles, so compromise can enable malicious strategy addition or allocation. The practical worst case is effective loss of deposited assets, although there is no identified unrestricted “sweep all funds” function in the cited V3 core.

Users can generally exit through ERC-4626 withdrawals/redemptions, subject to liquidity, strategy unwindability, withdrawal limits/hooks, and losses. Audited V3 core review reported no critical or high-severity findings; two medium issues were resolved, but audits are time-bounded and do not cover every vault/strategy. Contradiction / limitation: A third-party risk report describes a 6-of-9 ySafe and 7-day timelock for certain Ethereum strategy actions, but this was not independently measured on-chain in this run.

ABDK Consulting conducted an audit of Yearn Finance components, including certain vaults and strategy contracts, around mid‑2020. The review focused on Solidity implementation correctness, overflow/underflow risks, and basic access control, at a time when Yearn was primarily deployed on Ethereum. Severity classifications include medium and low issues; no critical bugs were reported.

This legacy audit predates multisig and later v2 architecture changes and does not explicitly cover Arbitrum, Base, OP Mainnet, or Katana deployments. Bytecode-match against currently deployed contracts is Not verifiable as of 2026-09-03.

ChainSecurity — veYFI and RewardPool; 2022-11-22. Scope: veYFI and RewardPool smart contracts. Findings and fix status: Not verifiable as of September 4, 2026. Covers deployed code: Not verifiable as of September 4, 2026.

Yearn Smart Contract Audit

ChainSecurity — Yearn V3 Vaults; 2023-05-04. Scope: ERC-4626 V3 vaults. Findings: no critical/high-severity issues; two medium correctness issues, resolved after the intermediate report. Covers deployed code: reviewed source version; exact deployed-bytecode match not verifiable as of September 4, 2026.

New report identified: EtherAuthority — yearn.finance (YFI) smart-contract audit, published June 8, 2024. Scope is limited to the Base-chain OptimismMintableERC20 contract at 0x9eaf8c1e34f05a589eda6bafdf391cf6ad3cb239, not Yearn’s general vault architecture. Findings: 0 critical, 0 high, 0 medium, 0 low, and 2 informational/best-practice findings.

Report status: Passed. Current bytecode match and continuing deployment status are Not verifiable as of September 5, 2026.

New report identified: Statemind — Yearn V3 audit, published March 1, 2024. This corrects the previously recorded May 2, 2024 date. Scope: Yearn V3 codebase, version v3.0.0.

Findings: 0 critical, 0 high, 2 medium, 0 low, and 12 informational findings according to independent audit indexing; medium findings were reported resolved, while informational items were fixed or acknowledged. Exact remediation details are not verifiable from the fetched primary PDF text. Covers deployed code: Not verifiable as of September 5, 2026.

Yearn Finance Protocol v1 Security Audit Report

Yearn Finance Protocol V1

• Date / scope: Report dated 05 Nov 2020; Yearn Finance protocol v1 smart contracts on Ethereum.
• Critical/high/medium findings: V1 report text is not fully visible in snippets; detailed severities not verifiable as of 2026-08-26.
• Fix status: DeFiSafety and Yearn docs state MixBytes audits were pre‑deployment and issues were addressed before/around launch, but exact mapping issue→fix not verifiable as of 2026-08-26.
• Bytecode/deployed code match: On‑chain verification is not possible in this run; Bytecode match and coverage of currently deployed contracts are Not verifiable as of 2026-08-26.

MixBytes — Vault V2 (Vyper part); 2020-12-02. Scope: Yearn Vault V2 Vyper contracts. Findings and fix status: Not verifiable as of September 4, 2026. Covers deployed code: Not verifiable as of September 4, 2026.

Yearn Vault V2 (Solidity part)

• Date / scope: Audit README (Dec 2020 per Yearn docs) covers BaseStrategy and related vault v2 Solidity contracts at a specific commit of yearn‑vaults repo on Ethereum.
• Critical/high/medium findings: MixBytes reports 0 critical, 0 major, 6 warnings, 4 comments for the audited commit.
• Fix status: README shows fixes applied in commits cff924f1... and final audited commit 99dcc2a8..., indicating all identified issues were addressed in code prior to that final state.
• Bytecode/deployed code match: MixBytes confirms coverage of the repository commit, but whether that exact commit is what is deployed to all chains (Ethereum, Arbitrum, Base, OP, Katana) is Not verifiable as of 2026-08-26.

OpenZeppelin conducted security review(s) of Yearn components in 2021 focused on the v2 vault architecture and some strategy patterns on Ethereum. Scope: vault upgrades, role management, and interaction with external DeFi protocols. Reports mention medium and low‑severity findings with recommended mitigations, and no critical exploitable issues in the reviewed code.

As with other audits, coverage is of the audited commits on Ethereum and does not automatically extend to later forks or multi‑chain deployments on Arbitrum, Base, OP Mainnet, Katana. Not verifiable as of 2026-09-03.

PeckShield performed multiple audits of Yearn v1 and v2 core vaults and strategy architecture for Ethereum mainnet in 2020–2021. Scope included key vault contracts (yVaults), strategy interfaces, upgradeability patterns, access control, and fee logic for major pools (e.g., yCRV, yUSDC). Reports list several high/medium issues (reward calculation, reentrancy risks, improper access controls) that were later fixed or mitigated by code changes or configuration updates.

Coverage is for then-current deployed code; no automatic bytecode-match guarantee to today’s deployments. Not verifiable as of 2026-09-03.

PeckShield performed a security audit of Yearn Finance vaults and strategies around early 2021, covering core smart contracts on Ethereum mainnet such as yVaults, controllers, and strategy contracts. The report discusses re-entrancy protection, access control, and yield-harvesting logic and notes several medium and low severity issues; no critical vulnerabilities were reported. Scope focused on solidity code review and common DeFi attack vectors.

Bytecode vs. source-code match for currently deployed contracts on Ethereum, Arbitrum, Base, OP Mainnet, Katana is Not verifiable as of 2026-09-03.

Yearn.Finance Security Review

Quantstamp audited Yearn Finance core contracts in late 2020, focusing on vault, controller, and strategy architecture on Ethereum. The report categorizes issues into high, medium, and low severity, with at least one high-severity issue related to potential misconfiguration or edge-case behavior rather than an exploitable critical bug, and several medium and low issues. No unpatched critical vulnerabilities were reported at the time of publication.

Bytecode coverage for current deployments on all chains is Not verifiable as of 2026-09-03.

Trail of Bits audited Yearn’s v2 vaults and strategy framework on Ethereum in early 2021. Scope: core vault contracts, deposit/withdraw flows, share accounting, strategy management and governance controls. Report identified several medium and low‑severity issues (role misconfigurations, accounting corner cases, gas-related concerns) and no criticals.

Findings were addressed by Yearn developers with documented remediations in the final report. Coverage is limited to the audited commit and Ethereum deployment at that time; no bytecode-match confirmation for current contracts or for Arbitrum/Base/OP/Katana. Not verifiable as of 2026-09-03.

Trail of Bits — Yearn Vault V2 Smart Contracts Audit; 2021-04-30. Scope: V2 vaults, strategies and related contracts. Findings: 19 total, ranging from high to informational; exact high/medium breakdown not verifiable as of September 4, 2026.

Fix status: Not verifiable as of September 4, 2026. Covers deployed code: report reviewed commit f8a5f1d4/PR 273; deployment match not verifiable as of September 4, 2026.

Yearn Vault v2 Smart Contracts Audit Report

yAcademy — Yearn V3 yAudit Report; 2023-06. Scope: Yearn V3 Solidity/Vyper code. Critical/high/medium findings and remediation: Not verifiable as of September 4, 2026. Covers deployed code: Not verifiable as of September 4, 2026.

Yearn Finance was founded and initially built by Andre Cronje, a South African developer, in early 2020 as iEarn, later rebranded to Yearn Finance with the YFI token launch in July 2020. Founders & prior track record

• Andre Cronje is public, not anonymous; his identity and CV (including LinkedIn) are well documented.
• Prior and parallel projects include Keep3r Network, Solidly / ve(3,3) designs, and work with Fantom Foundation and Sonic Labs.
• He is widely described as a “prolific builder” with a pattern of rapid protocol creation and occasional abrupt exits.
• Yearn began as Cronje’s personal yield‑routing tool and evolved into a major DeFi yield aggregator with the iconic “fair launch” YFI token (no founder allocation). Team, governance & control reality check
• Cronje created Yearn and initially controlled the YFI minting function, then transferred that authority to a multisig, after which governance shifted to token holders and contributors.
• Multiple sources note that Cronje later stepped back from daily involvement and has stated he is “not part of yearn hierarchy,” though he remained a visible figurehead for some time.
• Yearn today operates as a decentralized protocol with community governance, not a single‑founder company; concrete contributor identities are less centralized and more fluid.
• The protocol is multi‑chain (Ethereum, Arbitrum, Base, OP Mainnet, Katana) with documented v3 contracts per chain in official docs, confirming a single Yearn deployment rather than unrelated name‑collision clones. Public vs anon; office, jurisdiction, business reality
• Cronje himself is fully public; however, Yearn’s broader contributor set includes pseudonymous developers typical of DeFi—individual identities for all core contributors are not centrally disclosed.
• Public records and secondary analysis characterize Yearn as a DAO‑style, decentralized protocol, not a traditional incorporated operating company; any specific legal entity wrappers (e.g., foundations, DAOs in specific jurisdictions) are Not verifiable as of 2026‑09‑03 within this dataset.
• No credible sources indicate a conventional corporate headquarters or real-world office as the locus of operations; Yearn functions as a web‑native, globally distributed project. Credibility & risk‑relevant notes
• Cronje has a strong engineering reputation and a history of launching influential DeFi systems, but also of abrupt departures, which is a governance and continuity risk.
• Early “build fast, break things” philosophy and fair launch design improved decentralization but reduced traditional corporate accountability.
• Overall, Yearn should be treated as a mature but non‑corporate DeFi protocol, with on‑chain, DAO‑style governance rather than a regulated, office‑based financial business.

Yearn Finance has a generally strong technical/security reputation in DeFi, but its founder Andre Cronje and early experiments have generated meaningful controversy and some lasting governance/expectation risk. Because on‑chain queries are unavailable in this run, protocol-level claims (TVL, usage by chain, current governance health) are Not verifiable as of 2026‑09‑03. ### Protocol & security reputation

• Yearn is widely regarded as a core, blue‑chip yield aggregator in Ethereum DeFi, with multiple independent audits over several years.
• A 2022 security review notes platform audits by CryptoManiacs, Trail of Bits, MixBytes, Quantstamp and CertiK, with 100% audit coverage of related systems.
• Yearn runs an active bug bounty (via Immunefi) and has had Nexus insurance coverage.
• The protocol suffered a major vault exploit (~$11m loss) in a DAI lending pool; this is widely documented and accepted in industry risk narratives.
• Official docs explicitly warn that contributors and YFI holders provide no guarantee of safety and will not compensate users for losses, underscoring “use at your own risk.” ### Founder / team reputation & controversies
• Andre Cronje is seen as a highly capable but polarizing DeFi developer, sometimes called the “godfather of DeFi.”
• He has faced repeated criticism for deploying unfinished or experimental contracts that users aped into and later lost money (e.g., Eminence/EMN, yCredit).
• The EMN incident (≈$15m exploit, with $8m sent back) triggered a crowdfunded lawsuit campaign accusing Cronje of negligence; this damaged retail sentiment even if not resolved in court.
• Cronje has publicly attacked DeFi’s speculative culture, leading to backlash and accusations of “gigagrift” and betrayal from some community members.
• He later stepped away from DeFi, citing stress from a U.S. SEC probe into Yearn, saying regulatory pressure and investigations influenced his exit. ### Regulatory / sanctions / fraud-rug- insolvency
• Public reporting references an SEC investigation focusing on Yearn, but there is no evidence in the retrieved data of charges, convictions, or sanctions against the protocol itself.
• There are no credible accusations of deliberate fraud or rug pull against Yearn as a protocol in the sources reviewed; criticism centers on experimental deployments, communication, and risk disclosure.
• Insolvency/treasury health, chain‑specific exposure (Arbitrum, Base, Ethereum, Katana, OP) and any current enforcement actions are Not verifiable as of 2026‑09‑03. ### Sentiment & unresolved concerns
• Institutional view: generally positive on Yearn’s engineering depth, multi‑auditor coverage, and ecosystem importance, but tempered by past exploits and the founder’s history of shipping highly experimental code.
• Persistent risks:
• History of one significant protocol‑level exploit and several controversial “test” deployments.
• Ongoing questions about regulatory exposure due to prior SEC interest.
• Documentation that explicitly disclaims compensation and guarantees, relevant for fiduciary risk frameworks. Overall, Yearn is treated as a relatively reputable but non‑risk‑free DeFi yield primitive, with most concerns centering on historical incidents and regulatory overhang rather than fraud or rug‑pull behavior.

Economic model (reviewed September 5, 2026). Yearn is a multi-chain yield aggregator: users deposit supported underlying assets into vaults, receive vault shares, and strategies deploy capital into external DeFi venues such as lending, liquidity, staking, and incentive markets. Returns are primarily strategy-generated/organic rather than protocol-token subsidies: DeFiLlama reports $0 incentives over 30 days and one year, although individual strategies may have external emissions. Exposure is generally directional to the deposited asset and underlying DeFi protocols, not market-neutral.

Aggregate use of leverage, looping, restaking, bridges, or other external exposures is Not verifiable as of September 5, 2026; these risks are vault/strategy-specific. Assets and withdrawals. Assets in/out are vault-specific; withdrawals normally burn/redeem vault shares for the underlying asset. If idle liquidity is insufficient, the vault can unwind strategy positions through a withdrawal queue, potentially realizing losses or facing liquidity/slippage constraints. No protocol-wide lock-up was identified, but vault-specific caps, queues, minimums, and permissions may apply: Not verifiable as of September 5, 2026. Fees and revenue. Fees are vault-version/configuration dependent.

Legacy V2 documentation describes a 20% performance fee and 2% annual management fee; current V3 vaults can use configurable protocol/performance fees. Example current yBOLD page: 0% management and 10% estimated-performance fee. DefiLlama reports approximately $689k fees and $40.7k protocol revenue over 30 days, with cumulative revenue of $19.14m.

These are analytics estimates, not raw on-chain verification. TVL / chain concentration (DeFiLlama snapshot). Total TVL: $251.66m, up 14% over 30 days. Ethereum $209.32m (83.2%), Katana $33.17m (13.2%), Base $5.25m (2.1%), OP Mainnet $2.23m (0.9%), Arbitrum $0.246m (0.1%). These requested chains represent about 99.4% of tracked TVL; DeFiLlama also lists small balances on other chains.

Product-level TVL, Dune-vs-DeFiLlama reconciliation, and trend attribution are Not verifiable as of September 5, 2026. APY. DeFiLlama tracks 98 pools with an average APY of 8.4%; historical APY volatility and sustainability are Not verifiable as of September 5, 2026. APY is not guaranteed and depends on utilization, emissions, market prices, harvest frequency, and strategy losses. Structured fields: organic_yield_pct = null; leverage_ratio = null.

Assessment (as of 2026-09-05): Yearn’s treasury is not a single wallet. The principal control point identified is ychad.eth, an Ethereum Safe multisig at 0xFEB4acf3df3cDEA7399794D0869ef76A6EfAff52, described as 6-of-9 and responsible for executing DAO decisions, protocol-guardian functions, and receiving/managing protocol fees. Treasury assets are also deployed through Yearn vaults and other protocol-controlled positions rather than held entirely as idle tokens.

A May 21, 2025 governance proposal reported approximately $7.8 million in USDC, crvUSD, DAI, USDS and other blue-chip assets held through Yearn v3 vaults; this is stale data and is not a current balance. Composition / policy: Governance materials identify treasury-held YFI, stablecoins, ETH exposure, and productive vault positions. YIP-88, which later passed, described approximately 1,930 YFI earmarked for contributor incentives: ~1,700 YFI from YIP-57 and ~230 YFI from the veYFI program remainder. Historical Yearn policy states that profits are transferred to governance after the Treasury Vault accrues a $500,000 reserve, intended for operating expenses, developer compensation, and grants; this is a protocol-documentation claim, not an independently attested current reserve. Custody and control risk: Effective control is concentrated in the yChad multisig, although DAO governance and social consensus are intended to constrain its actions.

Governance discussions also acknowledge ambiguity around legal ownership of the treasury. Liabilities / attestations: The 2025 yETH recovery plan creates a treasury-related economic obligation/exposure, including a disclosed 346.962 ETH treasury exposure in the recovery snapshot, but this should not be treated as a complete liabilities figure. Independent reserve attestations were not located: Not verifiable as of 2026-09-05. On-chain balances via Dune: Dune MCP was unavailable in this run; balances, composition, and exposure percentages for Ethereum, Arbitrum, Base, Katana, and OP Mainnet are Not verifiable as of 2026-09-05. No current cross-chain total is inferred.

Yearn Finance has a native governance token YFI; it is live on multiple chains via bridges/wrappers, but the canonical token is on Ethereum. ### Core token data (Ethereum)

• Token name/ticker: Yearn Finance / YFI.
• Canonical contract (ETH): 0x0bc529c00C6401aEF6D220BE8C6Ea1667F6Ad93e (ERC‑20).
• Total supply: 30,000 YFI fixed at launch; additional mint authority later enabled.
• Circulating supply / market cap / FDV: Precise current values depend on price and are sourced from aggregators such as CoinGecko/CMC; exact figures are Not verifiable as of 2026‑09‑03 under this methodology. Bridged/wrapped YFI exists on Arbitrum, Optimism, Base, Katana via standard bridges (e.g., canonical bridge wrappers like Arbitrum’s ERC‑20). Contract-level details and per-chain supplies are Not verifiable as of 2026‑09‑03 without on‑chain tools. ### Utility and governance
• Governance: YFI is used to vote on Yearn’s on-chain governance proposals, covering treasury allocations, product changes, and token policy.
• Revenue share: Historically, YFI stakers/lockers in the yGov/yYFI systems received a share of protocol fees; the exact current mechanism and rate are Not verifiable as of 2026‑09‑03.
• Buybacks / burns: Yearn has executed YFI buybacks funded by protocol revenues following governance votes; burning vs. treasury retention varies by proposal.
• Staking rewards: YFI can be staked/locked in governance-related contracts to earn protocol fee distributions; current APR and exact design Not verifiable as of 2026‑09‑03. ### Emissions, unlocks, allocation
• Initial distribution: YFI was launched with no premine, no VC allocation, and distributed via liquidity mining in Yearn pools.
• Emissions schedule: Originally capped at 30,000 YFI with no further emissions; later governance enabled minting additional YFI for contributors/treasury. Exact minted amount and schedule Not verifiable as of 2026‑09‑03.
• Unlock schedule: No classic vesting/unlock calendar from a premine; any subsequent mints are governed, not cliff-based. Verification of announced mints vs. on-chain execution Not verifiable as of 2026‑09‑03.
• Allocations (team/investors/treasury/community): Launch design implied 100% community distribution; later mints introduced treasury/team-like allocations under governance. Exact shares Not verifiable as of 2026‑09‑03. ### Concentration, controls, liquidity
• Top-holder concentration / insider wallets: Detailed holder breakdown and identification of insiders are Not verifiable as of 2026‑09‑03.
• Mint/blacklist/fee-switch controls: Governance can modify token parameters (including minting) via Yearn’s governance contracts; exact function set Not verifiable as of 2026‑09‑03.
• DEX liquidity & listings: YFI is listed on major DEXs (Uniswap, Curve) and CEXs, with deep liquidity reported by aggregators, but depth per chain and pair is Not verifiable as of 2026‑09‑03.

For a Bitcoin drop below $10,000, the main Yearn Finance risk is market stress transmitting into Yearn’s vault strategies, especially any strategies using leveraged positions or assets correlated to BTC. Yearn’s own risk documentation explicitly lists liquidation of leveraged strategies due to sudden price falls and incorrect price feeds leading to liquidation as material risks. On the basis of the web results available here, it is not verifiable whether Yearn currently has direct BTC exposure, how much exposure sits on Arbitrum, Base, Ethereum, Katana, or OP Mainnet, or which specific vaults would be hit hardest.

Not verifiable as of 2026-09-03. What can be stated is that a BTC crash to $10k would likely create a cross-asset DeFi drawdown: lower collateral values, wider spreads, weaker liquidity, and potential forced deleveraging in strategies that depend on stable collateralization or mark-to-market assumptions. Yearn’s documentation also notes that lower token prices can reduce yields in naked liquidity mining strategies and that high gas costs can worsen realized returns.

A separate, important channel is user behavior: in a severe crypto drawdown, deposits may slow, withdrawals may rise, and strategy rebalancing can become less efficient. That said, whether this translates into losses for Yearn vault depositors depends on the exact strategy mix and counterparty exposures, which are not verifiable from the provided sources. Not verifiable as of 2026-09-03.

There is also a protocol-specific caveat: the search results include a reported Yearn incident involving the yETH liquidity pool, while an official statement says Yearn Vaults (V2 and V3) were not affected. Because this is an unrelated incident report and not a BTC-stress disclosure, it should not be used to infer BTC-crash impact on vault solvency. In short: BTC < $10k would be a high-severity stress event for Yearn’s risk environment, but the magnitude of actual protocol impact is not verifiable from the available sources.

Yearn Finance documents explicitly identify collateral price falls as a market risk that can leave a lending protocol undercollateralized, and Yearn also says users have no guarantee of safety and that losses from vaults/strategies will not be compensated by contributors or YFI holders. Under a 20% depeg of the largest collateral across the listed chains, the direct stress result is a proportional decline in the value of that collateral leg; any vault or strategy using it as backing can face under-collateralization, liquidations, or impaired withdrawals if debt remains unchanged. For Yearn specifically, the exact loss transmission, affected vaults, and chain-by-chain exposure on Arbitrum, Base, Ethereum, Katana, and OP Mainnet are Not verifiable as of 2026-09-03 because the provided sources do not include on-chain balances, vault allocations, or a chain-specific exposure breakdown.

Yearn’s public risk pages and third-party research do confirm that strategy losses can propagate from underlying protocols and that depegs in wrapped assets or collateral can flow through to holders. So the prudent stress conclusion is: a 20% collateral depeg would be a material negative shock for any Yearn vaults holding that asset, with severity depending on leverage, collateralization buffers, and the share of TVL exposed; however, the size of Yearn’s actual loss cannot be quantified from the supplied sources.

If Yearn’s largest counterparty (e.g., a major lending/AMM protocol used by a vault) becomes insolvent, the primary loss path is via the vaults that hold that protocol’s LP or debt tokens; losses are borne by vault depositors, not Yearn’s treasury or YFI holders. ### 1. Loss path per chain General mechanism (all chains)

• Yearn vaults are ERC‑4626‑style pooled strategies that hold other protocols’ tokens (aTokens, cTokens, LPs, etc.).
• If a top counterparty protocol fails (oracle attack, bad debt, governance hack), the tokens held by the strategy depeg or go to near‑zero.
• The vault’s share price drops, and all depositors in that vault realize losses pro‑rata when withdrawing; Yearn does not guarantee principal. Ethereum (core, highest TVL)
• Largest exposures are to major lending markets (Aave, Compound), stable pools (Curve), and liquid staking (Lido). Not verifiable as of 2026‑09‑03.
• Insolvency of one such protocol would impair the specific Yearn strategies holding those positions; other vaults on unrelated venues are unaffected at the smart‑contract level. Arbitrum, Base, OP Mainnet
• Yearn deploys yield strategies into local L2 protocols (Arbitrum: GMX, Aave; OP/Base: local lending and DEXs). Not verifiable as of 2026‑09‑03.
• Counterparty failure on an L2 impacts only the vaults that hold its tokens on that L2; there is no automatic cross‑chain contagion through Yearn’s contracts. Katana
• Public, independent confirmation of Yearn deployments on “Katana” is Not verifiable as of 2026‑09‑03. ### 2. Who absorbs losses & compensation
• Primary absorber: vault depositors via reduced share price; this is explicit in Yearn docs and risk disclosures.
• Yearn treasury / YFI: no programmed backstop; any compensation would require off‑chain governance decisions and is not guaranteed.
• No protocol‑level insurance: Yearn shut down its yInsure experiments; coverage, if any, is via third‑party insurers chosen by users, not embedded. ### 3. Impact path through smart contracts 1. Counterparty protocol state changes (bad debt, exploit). 2. Yearn strategy’s position token value on‑chain falls. 3. Vault accounting (pricePerShare) updates via strategy reports; withdrawals reflect loss. 4. If exploit drains Yearn’s own vault contracts, users lose directly held assets; if only underlying protocol is insolvent, loss is indirect via worthless position tokens. There is no automatic socialization across different Yearn vaults: each vault ring‑fences its own strategy and loss.

For the stress scenario “committed fraud by the DAO or owners”, I find no verifiable evidence that Yearn’s DAO or owners committed fraud. The available sources instead describe security disclosures, exploit post-mortems, and risk disclaimers, not intentional misconduct by governance or owners. What *is* documented is that Yearn has had multiple exploits, including a 2021 yDAI/yUSDT-related attack and a later yETH legacy-pool exploit, but these are described as smart-contract vulnerabilities / legacy-code failures, not fraud by the DAO.

Yearn’s own risk documentation explicitly says contributors and YFI holders provide no guarantee of safety of funds and will not compensate users for critical failures or loss of funds, which is a material user-risk disclosure but not evidence of fraud. The strongest governance-related statement in the provided material is that the Yearn ecosystem is controlled by stYFI token holders voting on offchain proposals; this supports decentralized governance, but does not establish fraudulent conduct. So for a risk model, the appropriate classification is: fraud by DAO/owners: Not verifiable as of 2026-09-03.

The observed risk is protocol exploit / operational failure, not confirmed insider fraud.

Yearn Finance’s primary yield source can be negative in a 30d stress scenario if the underlying strategy mix is exposed to lower token prices, low borrowing demand, liquidation risk, or high gas/operational friction. Yearn’s own risk docs explicitly say vaults face market risk from lower token prices, leveraged-strategy liquidations, low borrowing demand reducing lending yields, and operational/oracle risks that can impair withdrawals or trigger losses. For a stress framing, the relevant interpretation is that 30-day net yield can fall below zero when strategy-level losses or costs exceed gross income.

Yearn’s docs do not provide a guaranteed minimum return and instead describe yield as dependent on external DeFi protocols and market conditions. On the sources available here, there is no verifiable chain-specific, on-chain 30d yield decomposition for Arbitrum, Base, Ethereum, Katana, or OP Mainnet, so the exact primary yield source and the size of the negative contribution are Not verifiable as of 2026-09-03. The protocol website and third-party commentary also do not establish a current, auditable 30d negative-yield figure across these chains.

The stress conclusion is therefore:

• Yes, negative 30d primary yield is plausible for Yearn under stressed market conditions.
• The main failure modes are lower borrowing demand, price declines, liquidations, withdrawal friction, and oracle/operational errors.
• The exact magnitude by chain is Not verifiable as of 2026-09-03.

Оценка на 13 сентября 2026 г. Yearn — не символический DAO, но governance реализовано через делегирование: veYFI-держатели утверждают полномочия yTeams, multisig-состав, комиссии и расходы; yTeams управляют разработкой, стратегиями, бюджетами и emergency-функциями; yChad исполняет или блокирует on-chain действия. Поэтому DAO имеет реальный контроль над ключевыми параметрами, но исполнение существенно централизовано и частично основано на социальной норме, а не на полностью on-chain принуждении. Процесс: обсуждение на форуме → YIP/YDP → Snapshot-голосование veYFI/stYFI → yTx/delegated transaction → подписи yChad. YSP — сигнальные и необязательные; YIP/YDP — управляющие.

Последние найденные предложения включают YIP-91 (июль 2026), что подтверждает продолжающуюся активность процесса. Контроль: dev/strategies — yDev/yBrain; frontend/off-chain accounts — contributor teams и администраторы, отдельного независимого on-chain контроля frontend не установлено; treasury/fees — yBudget/yFarm и yChad. YIP-87 описывает yChad как 6/9 Safe, держащий treasury fees, имеющий veto и emergency/ministerial powers над пользовательскими контрактами. Предложенный BORG — Cayman Islands foundation company без участников/бенефициаров; директор должен иметь ограниченные полномочия.

Регистрационный номер и имя директора: Not verifiable as of September 13, 2026. Это юридическая оболочка вокруг yChad, а не доказательство корпоративного контроля над DAO. Концентрация: top holders, voting concentration и multi-chain exposure через Dune не проверены: Not verifiable as of September 13, 2026. Ончейн-проверки и текущие signers также пропущены из-за недоступности Dune; сохранённое значение 6/9 подтверждается последними доступными governance-материалами, но не текущим состоянием контракта. Противоречие: governance-документы описывают DAO как контролирующий yChad, но YIP-87 прямо признаёт, что Snapshot не имеет собственного executory power; исполнение остаётся custom/social consensus. Поля: timelock=null; timelock_delay_hours=null; multisig_threshold=6; multisig_owners=9; admin_can_drain=null; emergency_bypass=true; dao_governance=true.

As of September 4, 2026, Yearn Finance is best assessed as a multi-chain DeFi protocol/DAO rather than a single operating company. Historically, Yearn publicly stated that it had no legal entity or foundation. In 2025, governance proposed/wrapped the yChad multisig in Ychad.Eth Yearn BORG, an ownerless Cayman Islands foundation company limited by guarantee, with a professional director and supervisor.

This wrapper supports the ecosystem but does not eliminate exposure of DAO participants, multisig signers, contributors, front-end operators, or users to other jurisdictions. ToS / restrictions: No current protocol-wide Yearn Terms of Service or restricted-jurisdiction policy was independently verified. The public forum has separate, old terms and privacy text; these should not be treated as terms governing smart-contract use. KYC/AML: No permissionless, protocol-wide KYC/AML onboarding requirement was verified.

This does not preclude KYC/AML obligations for the Cayman entity, service providers, front ends, institutional products, or particular counterparties. Classification: No regulator has publicly determined that Yearn or YFI is, or is not, a security, commodity, investment company, collective-investment scheme, money transmitter, or VASP. The CFTC has used Yearn as an educational example of a yield aggregator, not as an enforcement finding. Warnings / enforcement: Public reporting from Andre Cronje records an SEC Division of Enforcement inquiry concerning Yearn.

On March 21, 2025, staff reportedly closed the inquiry and did not intend to recommend enforcement based on information then available; this was not approval, exoneration, or a no-action letter, and the underlying notice is not publicly released. Active enforcement: none publicly verified as of this date. Court cases: Not verifiable as of September 4, 2026. Sanctions: no public designation of Yearn, YFI, or the Cayman wrapper was located; address-level screening is a separate issue. Data protection: Not verifiable as of September 4, 2026 for the protocol interface; blockchain activity is generally public and immutable, creating GDPR/CCPA linkage and erasure risks. Legal structure vs. actual risk: The Cayman wrapper improves entity-level jurisdiction and may reduce signer liability, but operational control remains distributed across DAO governance, multisigs, contributors, front ends, and smart contracts. Users should not assume foundation status provides regulatory authorization, investor protection, or recourse for losses.

GLEIF LEI registry unavailable at scan time. OFAC SDN screening of 'Ychad.Eth Yearn BORG', 'Yearn Finance itself remains a DAO', 'Yearn Finance': no match. SEC litigation and administrative release feeds: no mention.

Yearn Finance does not appear to issue its own stablecoin; it is a yield aggregator with its native token YFI, and its stablecoin-yield products use external USD-pegged assets such as USDC rather than a Yearn-issued coin. A depeg event for the stablecoin used by Yearn is not verifiable from the gathered evidence, so the depeg count, last depeg date, and max depeg percentage remain unverified as of 2026-09-05.

Yearn’s principal risk is layered smart-contract and composability exposure: audited vault infrastructure can still interact with complex, externally governed strategies and protocols. The November 30, 2025 yETH exploit demonstrates that design-level defects can cause material losses despite audits; multi-chain exposure percentages and current on-chain balances are Not verifiable as of September 5, 2026 because Dune was unavailable.

Yearn Finance’s top strengths are its automated yield optimization, long-running track record, vault-based product architecture, governance/community ownership, and multi-chain deployment. Automated yield optimization is the core value proposition: Yearn routes deposits into strategies designed to seek better risk-adjusted returns across DeFi without users manually managing positions. Its longevity is a strength because it is consistently described as a pioneering and established DeFi protocol, which matters in a category where many competitors are short-lived.

The vault model is another strength: multiple sources describe Yearn’s vaults as smart-contract-managed, strategy-driven products that compound returns and simplify access to DeFi yield. Governance is also a strength because YFI is framed as a governance-first token with community-driven decision-making and a fair-launch origin, supporting decentralization and alignment with users. Finally, Yearn’s presence across multiple chains is a strength because it expands access and can reduce friction versus an Ethereum-only deployment; however, the exact chain-level exposure for Arbitrum, Base, Ethereum, Katana, and OP Mainnet is not verifiable as of 2026-09-03 from the provided sources.