Yearn Finance is a decentralised finance (DeFi) protocol on Ethereum. Users deposit tokens into vaults ("yVaults"), and smart-contract strategies put that money to work in other DeFi protocols to earn yield. YFI is Yearn's governance token. Since a governance vote in October 2025, holders stake YFI as stYFI. stYFI carries voting rights and, by default, receives 90% of protocol revenue. The older veYFI locking system is now marked deprecated in Yearn's documentation. Vaults are not risk-free: Yearn says its contributors and YFI holders do not guarantee deposits, and its most recent major exploit, on 30 November 2025, hit the yETH product.
The latest: what changed in 2025–2026
stYFI replaced veYFI (YIP-88, October 2025)
YIP-88 was posted on Yearn's governance forum on 28 September 2025. It bundled three linked changes into one all-or-nothing vote: a DAO restructuring, the new staking token stYFI, and contributor incentives. Yearn's documentation records it as passed, with 631.46 votes for and 0 against on Snapshot.
What it sets out:
- Staking: YFI is staked 1:1 for stYFI, which becomes the only governance token.
- Revenue: By default, 90% of protocol revenue (vault fees, for example) goes to stYFI stakers and 10% to the DAO treasury. The DAO can change this split. The split does not cover assets already in the treasury.
- Rewards: Rewards are paid in a Yearn vault token. The current stYFI docs name yvUSDC.
- Unstaking: Unstaking starts a 14-day linear cooldown, replacing veYFI's lock of up to four years. No rewards or voting power accrue during the cooldown.
- veYFI wind-down: The proposal cited low participation (about 3.8% of supply locked) and contract bugs that could not be fixed. Migration is opt-in. Holders with a four-year lock who migrate get a 2x reward multiplier that decays to 1x. dYFI and its gauges are shut down, but existing dYFI remains redeemable for YFI.
- Contributor incentives: About 1,930 YFI was set aside. Up to 1,111 YFI funds a new round of three-year contributor vests with a six-month cliff, and up to 600 YFI funds a redemption facility for liquid-locker tokens.
- Yield backstop: It runs for three years or until $5 million in rewards has been paid, whichever comes first.
yvUSD, a cross-chain stablecoin vault (2026)
In a blog post dated 23 March 2026, Yearn described yvUSD as "a cross-chain vault for USD-pegged assets like USDC." Users deposit once on Ethereum mainnet and receive ERC-4626 yvUSD shares. The vault's strategies can deploy capital on other chains. An opt-in "Locked yvUSD" version adds a cooldown before withdrawal, with defaults of a 14-day cooldown and a 7-day withdrawal window. The yearn.fi app has shown a different window length, so check the live contract before relying on either figure.
yETH exploit (30 November 2025)
Yearn's own disclosure, dated 1 December 2025, says the yETH weighted stableswap pool was exploited at block 23,914,086 on 30 November 2025:
- Cause: The attacker forced the pool's internal solver into "a divergent state, causing the product term (Π) to collapse to zero." This allowed far more tokens to be minted than had been deposited. An unchecked subtraction then minted about 2.35 × 10⁵⁶ yETH.
- Scope: Yearn states that "Yearn v2/v3 vaults and other Yearn products were not affected."
- Recovery: 857.49 pxETH was recovered on 1 December and is to be redistributed to affected depositors. Most of the remaining funds went to the Tornado Cash mixer.
- Size: The disclosure gives no single loss figure. The Block reported losses of about $9 million.
How yVaults work
Yearn's docs describe yVaults as "capital pools that automatically generate yield based on opportunities present in the market." You deposit an asset and receive vault shares, which can be redeemed for your proportional share of the vault's assets. Strategies deploy the funds and reinvest the returns. Gas costs are shared across all depositors.
| Generation | Strategies per vault | Share naming | Notes |
|---|---|---|---|
| v1 | One | — | Retired; the 2021 yDAI loss happened on a v1 vault |
| v2 | Up to 20 | yv prefix, e.g. yvUSDC | Still used for stablecoin-pool vaults |
| v3 | One or several | yv…-1 (multi-strategy), ys… (single-strategy) | Built around the ERC-4626 standard |
Fees. Before YIP-69, vaults charged a 20% performance fee and a 2% management fee. Fees are now set per vault:
- Performance fee: taken from yield at each harvest.
- Management fee: collected by minting new shares, which dilutes depositors. Single-asset vaults generally charge none.
- Factory vaults: vaults deployed through the vault factory charge a 10% performance fee.
Current rates are shown on yearn.fi.
yLockers. Yearn's docs also list yLockers: vaults built around other protocols' governance tokens. Locked positions earn extra yield, but the docs say they can only be traded on decentralised exchanges.
What YIP-88 means for your YFI
Answer two or three questions about what you hold to see how the stYFI rules from the October 2025 vote apply to you.
Which Yearn governance asset do you hold?
- Plain YFI → next question
- YFI locked as veYFI → next question
- dYFI → dYFI: gauges shut down, still redeemable
Have you staked your YFI as stYFI?
Have you started unstaking your stYFI?
- Yes, unstaking has started → In the 14-day cooldown
- No, it is still staked → Staked: voting rights and revenue share
Is your veYFI lock a four-year lock?
- Yes, four years → Four-year veYFI lock: 2x multiplier if you migrate
- No, shorter → Shorter veYFI lock: opt-in migration
Under YIP-88, stYFI is the only governance token, and YFI is staked 1:1 for it. YFI that is not staked carries no voting rights and no share of the revenue paid to stYFI stakers.
stYFI carries voting rights. By default, 90% of protocol revenue goes to stYFI stakers and 10% to the DAO treasury, and the DAO can change this split. Rewards are paid in a Yearn vault token; the current stYFI docs name yvUSDC.
Unstaking starts a 14-day linear cooldown. No rewards or voting power accrue during the cooldown.
veYFI is marked deprecated and migration to stYFI is opt-in. Holders with a four-year lock who migrate get a 2x reward multiplier that decays to 1x.
veYFI is marked deprecated and migration to stYFI is opt-in. The 2x reward multiplier described in YIP-88 is for holders with a four-year lock.
YIP-88 shuts down dYFI and its gauges, but existing dYFI remains redeemable for YFI.
This shows only the YIP-88 rules as described in the article; it does not confirm the date stYFI went live on-chain, give revenue figures or cover parameters changed by later governance votes, so check Yearn's docs before acting.
The YFI token: supply and history
- Origin: Yearn started in early 2020 under the name iEarn, built by developer Andre Cronje. Sources disagree on whether the month was January or February.
- Launch: YFI launched in July 2020 with a 30,000 token supply, no premine and no founder allocation. It was distributed to users who provided liquidity.
- YIP-1 (July 2020): Created on 19 July 2020, it asked whether to allow ongoing weekly YFI distribution or lock supply "at 30000 YFI permanently." The distribution option passed with 61.02%.
- YIP-56 (January 2021), "Buyback and Build": Replaced staking payouts with open-market YFI buybacks for the treasury. It passed.
- YIP-57 (28 January 2021): Minted 6,666 YFI, about 22% of the 30,000 supply, bringing the total to 36,666. Roughly one third went to vested contributor retention packages and roughly two thirds to the treasury, each with a 5% margin either way. The often-quoted exact 2,222/4,444 split is not stated in the YIP. It passed with 1,670.23 votes for and 331.03 against.
- YIP-88 (October 2025): Moved governance and revenue sharing to stYFI (see above).
Risks
Yearn's risk page sets out three categories:
- Rug risk: Only depositors can withdraw their funds, and contributors cannot mint shares without depositing. However, the Yearn multisig "does have the power to pause or withdraw funds from strategies to protect depositors."
- Bug risk: Despite audits, code flaws can be exploited.
- Yield stack risk: Vaults "are only as safe as the strategies and protocols that they deposit into." This includes stablecoin depegs and hacks at those underlying protocols.
Losses and gains in a vault are shared across all its depositors. Yearn states that contributors and YFI holders will not compensate users for losses.
The incident record shows these risks are real. Yearn's security repository lists 26 disclosures from September 2020 to December 2025. Two of them are covered above:
- 4 February 2021: The v1 yDAI vault lost 11 million DAI of deposits. The attacker manipulated stablecoin pool exchange rates across several transactions, and Yearn estimates the attacker's profit at about 2.7 million DAI. Yearn's write-up cites loose 1% slippage protection, a withdrawal fee set to 0%, and the fact that anyone could call
earn(). - 30 November 2025: The yETH exploit described above.
Official links
- Yearn app: https://yearn.fi
- Documentation: https://docs.yearn.fi
- Governance forum: https://gov.yearn.fi
- Security disclosures: https://github.com/yearn/yearn-security
Limitations: protocol revenue figures and the date stYFI went live on-chain could not be confirmed from Yearn's own pages. Fees and parameters change by governance vote, so check yearn.fi before acting. This is not investment advice.
