Yearn Finance is a decentralized finance (DeFi) protocol that pools users' crypto in smart contracts called vaults (yVaults) and puts it to work in other DeFi protocols through automated strategies. Yearn's documentation describes yVaults as "capital pools that automatically generate yield based on opportunities present in the market." A depositor receives a vault token that records their share of the pool. Yearn's governance token is YFI.
How a Yearn vault works
A deposit follows three steps:
- You deposit one asset, for example USDC, into a vault.
- The vault allocates that asset to one or more strategies.
- You receive vault shares, a token that represents your position and is redeemed for the underlying asset when you withdraw.
Yearn's docs list practical reasons to use a vault instead of farming by hand: vaults socialize gas costs across depositors, automate yield generation and rebalancing, and move capital as opportunities change. Because everything runs on public blockchains, the docs note that depositors can see where their assets are deployed.
Vaults and strategies in Yearn V3
Yearn's current vault generation is V3. Its developer docs define the parts this way:
- Allocator vault: an ERC-4626 compliant contract that "takes in user deposits" and allocates the underlying asset to an array of strategies.
- Strategy: a contract that "takes the underlying asset and deploys it to a single source, generating yield on that asset."
- Tokenized strategy: a strategy that is also a stand-alone ERC-4626 vault. One tokenized strategy can serve several vaults at once, and users can deposit into it directly.
ERC-4626 is a standard interface for tokenized vaults, which is what lets V3 strategies plug into more than one vault. In V2, by contrast, each strategy was attached to one specific vault.
Token names follow a pattern. Multi-strategy vaults carry a yv prefix and a category suffix, such as yvUSDC-1. Single-strategy tokenized strategy vaults carry a ys prefix, such as ysUSDC.
Fees
Yearn charges two kinds of fees, per its vault overview:
- Performance fee: taken from yield each time a strategy is harvested.
- Management fee: a flat annual rate, collected by minting new vault shares at harvest, which dilutes existing holders.
Under governance proposal YIP-69, fees are set per vault rather than at one fixed rate. The docs say single-asset vaults generally charge no management fee and factory-deployed vaults have a 10% performance fee. Check the fee shown for the specific vault before depositing.
Where the yield comes from
A vault does not create yield. Its strategies collect it from other protocols. Yearn's strategy risk documentation groups the sources into four types:
| Source | How the strategy earns | Main risks named by Yearn |
|---|---|---|
| Lending | Lends the asset to borrowers on a lending protocol | Low borrowing demand, collateral price drops, high utilization blocking withdrawals |
| Liquidity mining | Earns a protocol's reward tokens for using it | Falling price of the farmed token, adverse admin changes such as withdrawal penalties |
| Trading fees | Provides liquidity to automated market makers (AMMs) | Lower trading volume, impermanent loss |
| Leverage | Borrows to increase the position | Liquidation after price drops, incorrect oracle prices, flash loan costs exceeding income |
The APY a vault shows is an estimate. Yearn's docs say the displayed figure is a net APY based on historical data, because harvests do not happen on a fixed schedule. Past yield is not a forecast.
Which risks come with your Yearn vault's yield?
Pick where the vault's strategy earns its yield to see the risks Yearn's own documentation names for that source.
Where does the strategy behind the vault you are looking at earn its yield?
- Lending the asset to borrowers on a lending protocol → Lending: demand and withdrawal risk
- Earning a protocol's reward tokens (liquidity mining) → Liquidity mining: reward-token risk
- Providing liquidity to automated market makers for trading fees → Trading fees: volume and impermanent loss
- Borrowing to increase the position (leverage) → Leverage: liquidation and oracle risk
- I don't know yet → next question
Yearn's docs note that depositors can see where their assets are deployed, because everything runs on public blockchains. Have you checked which protocols the vault's strategies use?
- Yes, and it is one of the four sources → Start again with that source
- No, not yet → Find where the assets go first
Yearn names low borrowing demand, collateral price drops, and high utilization that can block withdrawals. These sit on top of the vault's own smart contract risk.
Yearn names a falling price of the farmed token, plus adverse admin changes such as withdrawal penalties. The vault's own contract layer adds smart contract risk.
Yearn names lower trading volume and impermanent loss. The vault's own contract layer adds smart contract risk.
Yearn names liquidation after price drops, incorrect oracle prices, and flash loan costs exceeding income. The vault's own contract layer adds smart contract risk.
Choose the matching source above to see its risks. If the vault uses several strategies, Yearn says smart contract risk increases with the number of strategies and protocols, so read each one.
Yearn says a vault does not create yield; its strategies collect it from other protocols. Until you know which ones, you can't tell which of the four risk types apply. Check the vault's page, including its fee, before going further.
This only matches a yield source to the risks Yearn's docs list. It does not score a particular vault, check its fees, APY or audits, or say whether you should deposit.
Risks
Yearn's own security docs open with a plain disclaimer: its smart contracts, interfaces and products "are offered as-is," and contributors and YFI holders "provide no guarantee of safety of funds" in any vault or strategy.
Smart contract risk
Every vault, strategy and outside protocol is code that can fail. Yearn's vault risk table says smart contract risk "increase[s] with the number of strategies and protocols" a vault uses. The docs also note a trade-off: each extra strategy adds diversification but raises the chance that one of them causes a loss.
Yearn publishes incident reports in its yearn-security repository. Two examples:
- February 4, 2021: an attacker manipulated an external stablecoin pool so that the V1 yDAI vault deposited and withdrew at poor rates. About 11 million DAI was lost. The report blames loose 1% slippage protection, a withdrawal fee that had been set to zero, and the ability of anyone to push deposits into the strategy.
- November 30, 2025: a numerical bug in the legacy yETH weighted stableswap pool let an attacker mint near-unlimited LP tokens and drain the pool. Yearn's disclosure says the impact was "isolated to the yETH product and its direct integrators" and that "Yearn v2/v3 vaults and other Yearn strategies were never at risk."
On audits, Yearn's security page lists ChainSecurity, yAudit and StateMind for the V3 core contracts, and MixBytes, ChainSecurity and Trail of Bits for the legacy V2 contracts. An audit of the core vault does not cover every strategy plugged into it.
Strategy risk
A strategy carries the risks of the protocols it uses: liquidations in leveraged positions, oracle errors, impermanent loss, reward tokens losing value, and lending markets where withdrawals stall. Yearn's operational risks include a poor strategy mix and mismanaged debt positions. Yearn's security team scores strategies with its Risk Score Framework.
Governance and admin risk
Yearn's security page calls the Governance role a critical trust assumption. It is controlled by a 6-of-9 multisig with no timelock, which Yearn describes as a deliberate choice to allow fast fixes. The vault risk table names the matching risk: the multisig "approves a strategy that leads to losses." The docs say the multisig can pause strategies or withdraw funds from them to protect depositors, but cannot remove the funds, and that only the depositor has access to what they deployed in a vault.
YFI and governance
YFI coordinates decisions across Yearn's contributors and community. Yearn's YFI page says 30,000 tokens were first distributed as rewards to liquidity providers, and holders later voted to mint 6,666 more. One third of the new tokens vested to key contributors and two thirds went to the treasury, for 36,666 YFI minted in total.
Voting rights have changed twice. Yearn first moved voting to veYFI, a vote-escrow lock of up to four years. The veYFI docs are now marked as covering a "legacy" system: under YIP-88, stYFI replaced veYFI as the source of voting power. With stYFI, holders stake YFI and keep direct voting rights. The stYFIx variant delegates voting power. Unstaking starts a 14-day linear cooldown, and rewards are paid in yvUSDC. Holders of old veYFI locks may be able to migrate them.
Who Yearn suits
Yearn fits someone who wants exposure to DeFi lending or liquidity yield without managing positions by hand, and who accepts that the vault adds its own contract layer on top of the protocols it uses. If you would rather compare simpler options first, see staking vs yield farming.
Limitations: this guide reflects Yearn's documentation as read on October 24, 2026; vault fees, strategies and governance rules change through YIPs, so check the vault page before depositing.
