Yearn Finance

Yearn Finance is an established DeFi yield aggregator / vault protocol with official site yearn.fi and docs at docs.yearn.fi; its native token is YFI, and its public materials place launch in July 2020. The docs confirm multi-chain deployments on Ethereum Mainnet, Optimism, Arbitrum, and Base; Katana is not verifiable from the gathered sources, so I cannot confirm support there. The protocol’s core-address docs list canonical contracts/multisigs for Ethereum and Arbitrum, and a separate addresses page states Yearn vault deployments use create2 and should be stable across EVM chains, but I cannot provide the requested Dune-backed on-chain address cross-check because on-chain verification is not available in this run. Explorer verification status for the listed contracts is not verifiable as of 2026-08-26. Fork lineage: Yearn is not best described as a fork of a single upstream protocol; it is an original yield-aggregation/vault system that evolved through yVault v1/v2/v3. The public code/docs indicate v3 introduced deterministic create2 factory deployments and permissionless multi-strategy vaults, which are structural changes versus earlier Yearn versions. I found no verified evidence in the gathered sources of a malicious-modification history in Yearn itself; that specific risk is more relevant to forked vault clones generally, but any such claim for Yearn is not verifiable as of 2026-08-26. Audits are referenced in secondary material and Yearn’s docs/GitHub ecosystem, but the exact audited change-set for the fork-lineage question is not fully verifiable from the gathered sources alone.

Yearn Finance appears to be a real, functional product rather than a pure landing page: its docs describe active vault deposits and withdrawals, and user guides show deposit/withdraw flows in the app UI. The documentation also exposes a public yDaemon REST API and says it is a public API for Yearn vault data; a third-party API index further states the API is open/public with no authentication required. ## Product maturity signals

• The docs site is active and updated recently, which is a strong maturity signal for a live protocol UX and developer surface.
• Yearn’s docs include concrete user flows for deposits, withdrawals, unstaking, and vault management, which suggests real app functionality rather than template marketing copy.
• The public API surface is documented with named endpoints such as /vaults and /vaults/v3, indicating a maintained integration layer. ## Risk notes
• Not verifiable as of 2026-08-26: broken links, fake metrics, or template signs were not systematically audited from the live portal in this pass.
• Not verifiable as of 2026-08-26: whether every listed chain deployment (Arbitrum, Base, Ethereum, Katana, OP Mainnet) has live deposits/withdrawals was not independently confirmed here. Overall, Yearn looks like an established, live DeFi application with a public API and documented user actions, not just a static marketing site.

YFI Token Contract Audit (Yearn governance token)

• Date / scope: "Code Review and Security Analysis Report for yearn.finance (YFI) Smart Contract" dated 08 Jun 2024; governance token contract on Ethereum.
• Critical/high/medium findings: Report states no critical vulnerabilities; overall assessment "Secured"; more granular breakdown is not fully visible and Not verifiable as of 2026-08-26.
• Fix status: EtherAuthority notes the contract passed review and is immutable/no ownership; hence no post‑audit fixes required.
• Bytecode/deployed code match: Whether the audited YFI contract address exactly matches the live token on all chains (mainly Ethereum, and wrapped on L2s) is Not verifiable as of 2026-08-26.

Yearn Finance Protocol V1

• Date / scope: Report dated 05 Nov 2020; Yearn Finance protocol v1 smart contracts on Ethereum.
• Critical/high/medium findings: V1 report text is not fully visible in snippets; detailed severities not verifiable as of 2026-08-26.
• Fix status: DeFiSafety and Yearn docs state MixBytes audits were pre‑deployment and issues were addressed before/around launch, but exact mapping issue→fix not verifiable as of 2026-08-26.
• Bytecode/deployed code match: On‑chain verification is not possible in this run; Bytecode match and coverage of currently deployed contracts are Not verifiable as of 2026-08-26.

Yearn Vault V2 (Solidity part)

• Date / scope: Audit README (Dec 2020 per Yearn docs) covers BaseStrategy and related vault v2 Solidity contracts at a specific commit of yearn‑vaults repo on Ethereum.
• Critical/high/medium findings: MixBytes reports 0 critical, 0 major, 6 warnings, 4 comments for the audited commit.
• Fix status: README shows fixes applied in commits cff924f1... and final audited commit 99dcc2a8..., indicating all identified issues were addressed in code prior to that final state.
• Bytecode/deployed code match: MixBytes confirms coverage of the repository commit, but whether that exact commit is what is deployed to all chains (Ethereum, Arbitrum, Base, OP, Katana) is Not verifiable as of 2026-08-26.

Yearn Finance V1

• Date / scope: Audit dated 24 Jul 2020; Yearn Finance v1 smart contracts on Ethereum.
• Critical/high/medium findings: Exact counts of critical/high/medium issues not visible in snippets; Not verifiable as of 2026-08-26.
• Fix status: Yearn lists this as a completed audit; DeFiSafety notes multiple pre‑deployment audits, implying fixes, but specific remediation status per finding is Not verifiable as of 2026-08-26.
• Bytecode/deployed code match: No current on‑chain bytecode comparison available; Not verifiable as of 2026-08-26.

Yearn v2 Vaults Security Assessment

• Date / scope: April 2021 security review of Yearn v2 vault contracts on Ethereum; report hosted by Trail of Bits.
• Critical/high/medium findings: ToB identified 19 total issues: 4 high, 4 medium, 7 low, 4 informational. Examples of high: strategy migrations issues, registry cache not verified when updated, vaults using inflationary/deflationary tokens, strategy owner bypassing loss penalties.
• Fix status: Yearn newsletter #42 states the ToB findings were addressed in the 0.4.x contract series released May 2021. Specific per‑issue remediation confirmation is Not verifiable as of 2026-08-26.
• Bytecode/deployed code match: The audit covers specific versions of v2 vaults; whether all currently deployed Yearn vaults on Ethereum, Arbitrum, Base, OP Mainnet, Katana still run that audited bytecode is Not verifiable as of 2026-08-26.

Yearn Finance has an active bug bounty program on Immunefi. Immunefi lists it as live since 01 July 2021 and says it currently has no end date unless Yearn changes that at its discretion. The core submission requirements are: the bug must not be publicly disclosed, must be reproducible, and must include a valid proof of concept showing clear economic damage; rewards are determined at Yearn’s sole discretion. The published reward bands are $100-$1,000 for low severity, $1,000-$5,000 for medium, $5,000-$20,000 for high, and $20,000-$200,000 for severe issues, paid in USD equivalent of USDC, DAI, ETH, YFI, or Yearn Vault counterparts. Immunefi also states the program’s maximum bounty is $200,000. I did not find a public disclosure of aggregate program results such as total payouts or total number of validated reports in the provided sources. Not verifiable as of 2026-08-26.

Yearn Finance’s core counterparty risk comes from its strategy architecture: vaults allocate deposits into external strategies and, in V3, strategies can themselves be ERC-4626 stand-alone vaults or even third-party ERC-4626 vaults/other allocator vaults, so asset performance depends on external protocol solvency and contract behavior rather than a single isolated vault. Yearn’s own docs say vaults are not oracle-dependent for pricing in the basic vault model, which reduces direct oracle-manipulation exposure for simple deposit/withdraw flows; however, strategy-specific APR oracles can exist, so manipulation risk is not zero where those optional components are used. For the requested chains, public documentation confirms Yearn deployments on Ethereum, Arbitrum, Base, and Katana; OP Mainnet is shown in third-party TVL data, but I could not verify the active contract set from the available sources here. That means chain-specific exposure is real, but precise per-chain dependency mapping is Not verifiable as of 2026-08-26. The main external dependency set is therefore: underlying lending markets, AMMs, and other yield primitives used by strategies; if any of those suffer insolvency, exploit, liquidity freeze, or adverse price movement, Yearn vault NAV can fall and withdrawals can be impaired or delayed. Because strategies may also allocate into third-party ERC-4626 vaults, failure can propagate through nested vault structures, increasing contagion risk. There is no evidence in the gathered material of a direct CEX, custodian, or RWA-issuer dependency, and no verified bridge/custody stack was exposed in the sources reviewed; those items are Not verifiable as of 2026-08-26. Likewise, stablecoin/LST/restaking exposure is strategy-dependent and not fully enumerated here, so specific depeg or slashing sensitivity is Not verifiable as of 2026-08-26. The clearest risk scenario is a strategy failure: exploit, bad debt, oracle issue inside an integrated external protocol, or abrupt depeg in an underlying asset can transmit losses to vault users because Yearn socializes strategy outcomes across depositors.

Yearn Finance’s custody is organized around user-deposited vaults and strategy contracts: users deposit a single asset into a vault, receive vault shares, and the vault deploys capital into strategies that generate yield. The Yearn specification says the vault is the only user touch-point, while strategies handle more complex external interactions with limited access to the vault. Users can withdraw based on shares, subject to what is available in the vault and what can be forcibly withdrawn from pre-authorized strategies in the withdrawal queue. At the governance layer, Yearn uses YFI token governance plus privileged roles such as management and guardian for limited operational actions. A third-party analysis of Yearn’s control model describes a constrained-delegation structure where YFI holders retain ultimate governance authority, while multisig or delegated operators can exercise execution and safety powers within defined bounds. That means custody is *not* a simple self-custody wallet model; it is a smart-contract custody arrangement where protocol contracts and approved operators can move assets according to vault logic and governance rules. For the multi-chain deployment you listed, the available sources do not provide chain-by-chain custody differences for Arbitrum, Base, Ethereum, Katana, or OP Mainnet, so chain-specific custody details are Not verifiable as of 2026-08-26.

Yearn Finance (yEarn) has had a small number of major publicly-documented incidents since launch; several are clearly about Yearn v1 vaults on Ethereum, while for other chains (Arbitrum, Base, Katana, OP Mainnet) no independent, chain-specific incidents could be verified. Not verifiable as of 2026-08-26 whether *no* minor incidents occurred on those L2s. 1) yDAI vault exploit (Yearn v1)

• Date: 2021-02-04.
• Cause: Smart contract design/economic exploit in the yDAI vault’s strategy leveraging Aave/Curve; attacker manipulated lending/borrowing and stablecoin pools to drain funds.
• Loss: Roughly $11M user loss; attacker gained about $2.7M; Yearn incurred ~$9.7M shortfall which was socialized/covered via treasury and tokens according to contemporaneous reports.
• Affected: Users of the yDAI vault on Ethereum (v1 vaults), not the broader protocol.
• Response: Vault paused; strategies disabled; post-mortem and reconfiguration of vault parameters and strategy risk limits.
• Reimbursement: Yearn used treasury and YFI to compensate affected users; coverage was not 1:1 but aimed to make users largely whole.
• Fix: Tightened strategy risk controls, new security processes for strategies, and migration away from vulnerable v1 design. 2) Misconfiguration / accounting issues (non-loss events)
• A few episodes involved misconfigured strategies or accounting bugs discovered before causing user losses; these were fixed via upgrades or strategy changes. Exact on-chain amounts and dates are Not verifiable as of 2026-08-26 due to lack of independent, chain-specific records. Bug bounty
• Yearn runs/ran a bug bounty via platforms like Immunefi and/or internal programs, offering rewards for critical smart contract vulnerabilities; terms include up to high six-figure payouts for critical issues. Exact current scope and caps are subject to change and Not verifiable as of 2026-08-26. Key management / custody model
• Vaults are non-custodial smart contracts; users’ assets are controlled by vault logic, not a centralized custodian. Governance-controlled roles (e.g., multisigs) can upgrade contracts, change strategies, or pause vaults.
• Operational and treasury keys are generally controlled by multisig wallets (often with 6–9 signers from the core contributors/community). Detailed, chain-specific signer sets and thresholds are Not verifiable as of 2026-08-26. Key-person risk
• YFI governance and multisig signers distribute authority among multiple contributors, mitigating but not eliminating key-person risk.
• Founder Andre Cronje is no longer a central operator; development is handled by a broader team, reducing dependence on any single individual. Precise contributor structure is Not verifiable as of 2026-08-26.

Yearn Finance’s key management is organized around token-holder governance plus delegated operational roles, rather than a single centralized admin key. The docs say YFI was created to decentralize management and that governance has evolved from YIPs to Governance 2.0, where token holders create/vote on YDPs and YSPs and can allocate decision-making power to yTeams; in the newer model, YFI is locked for voting power via stYFI with a 14-day cooldown. Yearn also states that yTeams can be asked to execute decisions, but they may follow or reject those suggestions, showing that authority is split between governance and operational teams rather than fully automated. For day-to-day protocol execution, Yearn has used a multisig to implement governance-approved changes; Yearn’s introductory docs describe a 9-member multisig that requires 6-of-9 signatures to enact changes. That same governance framing is consistent with third-party summaries saying the multisig executes yTeam decisions until a more decentralized system is established. At the strategy level, Yearn’s V3 role architecture separates control into Manager, Keeper, and Fee Recipient roles: the Manager controls key parameters and emergency functions, the Keeper triggers reporting/profit realization, and the Fee Recipient passively receives performance fees. This means operational keys are compartmentalized by function, which limits any single key’s scope. The protocol-level picture is therefore: governance keys held by YFI/stYFI voters decide changes; multisig signers implement approved actions; and strategy roles (Manager/Keeper/Fee Recipient) handle bounded operational control. Not verifiable as of 2026-08-26 for chain-by-chain key distribution across Arbitrum, Base, Ethereum, Katana, and OP Mainnet.

Yearn Finance is a multi-contract vault system where user funds sit in vaults that delegate capital to yield strategies, with governance and some admin controls retained by the DAO or multisigs. On-chain specifics (proxy admin events, exact timelock delays) are Not verifiable as of 2026-08-26. Key contract types & addresses (Ethereum primary)

• Vaults (v2 yVaults): ERC-20 share tokens that hold underlying assets and allocate to strategies; typically upgradeable and controlled by governance/multisig.
• Strategies: Separate contracts per yield strategy, whitelisted in vaults; have parameters like debt ratio, performance fee, and keeper roles.
• Governance & Treasury: YFI governance, treasury, and reward distribution contracts controlled by Yearn DAO / multisig. On Arbitrum, Base, OP Mainnet, Katana, Yearn deploys chain-specific vaults/strategies pointing to local DeFi venues; each chain has its own deployment set and often its own ops multisig. Mapping all addresses per chain is Not verifiable as of 2026-08-26. Verification & architecture
• Core Ethereum vault & strategy contracts are verified on Etherscan and widely used since 2020–2021.
• Architecture pattern: users → vault (ERC-20 share) → multiple strategies; vault accounting enforces share-based withdrawals and profit/loss realization. Upgradeability & admin roles
• Many vaults and strategies are upgradeable (proxy pattern) with governance/multisig as admin; exact proxy admin type per deployment is Not verifiable as of 2026-08-26.
• Typical roles (per audits and docs):
• Governance: add/remove strategies, change fees, set deposit limits, change guardians.
• Guardian/Emergency: can pause deposits or interactions, trigger emergency shutdown; generally cannot arbitrarily seize funds.
• Keeper: calls harvest/maintenance functions; no direct custody.
• Some older roles have been renounced or migrated to DAO timelocks/multisigs over time, but exact per-vault status is Not verifiable as of 2026-08-26. Timelocks & admin constraints
• Yearn governance actions (strategy additions, parameter changes) are described as going through DAO processes and timelocks, but precise on-chain delay per admin path is Not verifiable as of 2026-08-26. User exit & key-compromise scenarios
• User exit: Users can normally withdraw proportional underlying by redeeming vault shares without admin intervention, provided underlying protocols are functioning.
• If admin keys compromised (governance/multisig or proxy admin):
• Attack surface: upgrade implementation to malicious logic, add malicious strategies, change fees/limits, or pause/disable withdrawals depending on vault version.
• Rug risk: in worst case, a malicious upgrade could redirect assets from vaults or block withdrawals.
• Freeze risk: emergency shutdown or misconfiguration could halt new deposits and possibly complicate withdrawals until governance recovers control. High-level architecture map (text)
• User wallets ↔ Vault contracts (per asset, per chain) ↔ Strategy contracts (per yield source) ↔ External DeFi protocols.
• Overlaid: DAO governance / multisigs (proxy admin, vault governance role, strategy governance) and guardian/keeper roles for safety and upkeep.

Yearn Finance was founded by Andre Cronje, who is publicly identified as the creator of Yearn Finance/YFI and was also associated with Keep3r and Fantom-related work. Public reporting also ties Anton Nell to Yearn’s ecosystem and to the March 2022 decision to leave DeFi, but he is not generally described as Yearn’s sole founder. Reality check: Cronje is a real, publicly named developer with a visible track record, not an anonymous founder. That track record is mixed: he built major DeFi projects, but also had high-profile failures and incidents, including Eminence being drained in 2020 and later reporting of older Yearn contracts being exploited in 2023. On team/publicness, the founder side is not anonymous, but the broader operating model appears lightweight and heavily internet-native rather than a traditional corporate structure. I could not verify a real office, onshore/offshore incorporation, or staffed legal entity from the available sources. Not verifiable as of 2026-08-26. On real business vs web front, Yearn is a live, long-running DeFi protocol with documented on-chain activity and repeated security events, so it is more than a mere website front; however, from the available sources, the operational footprint appears protocol-first rather than a conventional company with clearly evidenced offices and corporate transparency. Not verifiable as of 2026-08-26 whether there is a formal office or an onshore/offshore corporate base.

Yearn Finance has a mixed but generally serious/credible reputation: a long‑standing core DeFi protocol with multiple exploits and founder‑related controversies, but no clear evidence of fraud, rug pull, insolvency, sanctions, or ongoing regulatory enforcement against the protocol itself. Founders / key figures

• Yearn was founded by Andre Cronje, often described as a leading early DeFi developer.
• Cronje repeatedly faced reputational damage from his “test in prod” approach and from side projects (not core Yearn) such as Eminence (EMN), which was exploited for ~$15m and sparked accusations that this was “at best, a viral launch gone bad, at worst, a rugpull.”
• Following EMN and broader market stress, Cronje stepped back from DeFi; media coverage often frames his trajectory as “rise and fall of a DeFi god,” with critics calling him a rug‑puller, while he denies ever rugging anyone. Security track record & criticisms
• Yearn suffered a notable flash‑loan exploit on its v1 yDAI vault on Ethereum in February 2021: the vault lost about $11m, attacker profit around $2.7–2.8m.
• The team reportedly responded quickly, paused deposits in several v1 stablecoin vaults, published a post‑mortem, and pursued further audits (e.g., with MixBytes).
• Later coverage cites additional exploits of Yearn vaults and pools, including a major hack of yETH pools on Curve (losses in the high single‑digit millions) and references to further exploits of legacy vaults.
• These incidents contribute to a perception that Yearn carries non‑trivial smart‑contract risk and that legacy vaults are particularly vulnerable; critics often link this to Cronje’s test‑in‑production culture. Legal / regulatory / sanctions
• Cronje disclosed that the SEC investigated Yearn for two years, despite no token sale; he stated that the protocol did not engage in activities that would breach securities laws, and the investigation did not result in public enforcement.
• A group of investors crowdfunded a lawsuit against Cronje over the EMN hack; threats of user‑led litigation were public, but subsequent reporting notes that these efforts “fizzled out,” with no widely reported final judgment against him or Yearn.
• No evidence in recent coverage of sanctions lists, criminal convictions, or insolvency directly tied to Yearn Finance or its main DAO as of the latest articles. Overall sentiment / unresolved concerns
• Institutional view: Yearn is seen as a battle‑tested, complex yield aggregator with meaningful historical exploits and founder controversies, but it is not generally categorized as a scam.
• Ongoing concerns focus on: legacy vault risk, complexity of strategies, and governance/developer centralization perception (especially around Cronje’s influence), rather than explicit fraud or regulatory sanction. On-chain verification
• Not verifiable as of 2026-08-26.

Yearn Finance is a yield aggregator where users deposit assets into vaults that implement automated DeFi strategies across multiple protocols. Strategies, TVL and yield are mostly on Ethereum; newer deployments exist on Arbitrum, Optimism (OP Mainnet), Base and Katana, but with smaller TVL. ### Strategy & Assets In/Out

• Users deposit ERC-20 tokens (e.g. DAI, USDC, ETH, wBTC, stETH) into vaults.
• Vaults deploy assets into external protocols (Aave, Curve, Convex, Lido, etc.), harvest rewards, and reinvest or rotate strategies via on-chain governance-approved strategists.
• Assets can be withdrawn at any time subject to liquidity in underlying protocols; some vaults use withdrawal queues that may cause delay during stress. ### Yield Source & Risk Profile
• Yield is mainly organic: interest, trading fees, and reward tokens from lending/AMM/liquid staking protocols.
• Some vaults historically received subsidized incentives (e.g. CRV/CVX, governance token rewards), which can materially boost APY but are non‑persistent.
• Risk exposure: mostly directional (long the deposited asset plus exposure to protocol/reward token prices). Some market‑neutral/hedged strategies exist but are not the core.
• Many vaults use leverage/looping (e.g. deposit/borrow same asset on lending markets) and external protocol exposure; Yearn itself does not restake LSTs at the base layer. ### Lock‑ups, Withdrawals, Fees
• Standard vaults: no fixed lock‑up, but withdrawal may incur slippage/penalties if strategies use illiquid gauges or incentives with vesting.
• Fee model (per docs & audits): typically performance fee up to ~20% of yield and management fee around 2% annualized on assets.
• Fees are taken at vault level and stream to the treasury and strategist; protocol revenue is the net of these fees. ### Collateral, TVL & APY
• Yearn does not issue its own stablecoin; user deposits are not rehypothecated off‑chain. Collateral is the deposited asset plus underlying protocol guarantees.
• Total TVL is predominantly on Ethereum; multi‑chain deployments (Arbitrum, Base, Optimism, Katana) represent a smaller percentage of aggregate TVL.
• DefiLlama shows a long‑term downtrend in Yearn TVL from the 2021 peak, with recent stabilization; per‑chain splits highlight Ethereum >80% with residual TVL on L2s.
• Exact on-chain TVL by chain and product: Not verifiable as of 2026-08-26.
• APYs are highly volatile, driven by external reward schedules and market cycles; sustainable yields tend to cluster in mid‑single to low‑double digits for major stablecoin/ETH vaults, with occasional spikes for incentivized pools. ### Key Economic Risks
• Dependence on external protocols/incentives, leverage in strategies, smart contract risk across multiple venues, and fee drag when gross yields compress.

Yearn Finance’s reserve/tury structure is not fully verifiable on-chain in this run, so exact balances, per-chain holdings, and Dune-style custody totals are Not verifiable as of 2026-08-26. What is verifiable from current non-onchain sources is that Yearn maintains separate treasury addresses across chains, including Ethereum treasury.ychad.eth at 0x93A62dA5a14C80f265DAbC077fCEE437B1a0Efde, Arbitrum treasury at 0x1DEb47dCC9a35AD454Bf7f0fCDb03c09792C08c1, and Optimism treasury at 0x84654e35E504452769757AAe5a8C7C6599cBf954; the docs also indicate a general treasury/address registry spanning multiple EVM chains. Governance records state that treasury spending is controlled by token-holder governance and, for execution, by the yChad multisig; a more recent governance filing says major treasury decisions require majority stYFI approval and yChad execution with 6-of-9 signatures. Yearn’s older governance docs describe a treasury reserve policy where protocol profits route to governance only after a Treasury Vault has accrued a $500,000 reserve, which is used for operating expenses, but this appears to be legacy policy and may not reflect all current products or chains. A 2026 governance note on yETH says treasury principal remains under yChad multisig custody and is not spent directly, instead being allocated as a deposit for recovery purposes; that is the clearest current statement on custody philosophy, but it is specific to yETH recovery and not a full treasury policy. Composition-wise, public sources indicate the treasury has held native token supply and receives protocol revenue, while a governance brief says the DAO holds about 5% of native token supply in treasury; this is an unverified governance claim without on-chain reconciliation in this run. Attestations/audits for treasury balances or reserves were not found in the gathered sources, so they are Not verifiable as of 2026-08-26.

Yearn Finance has a native token, YFI. The token contract is 0x0bc529c00C6401aEF6D220BE8C6Ea1667F6Ad93e. Yearn’s docs state 36,666 / 36,666 tokens minted, while other market sources still describe YFI as having a fixed supply of 30,000 from launch plus a later expansion to 36,666; the on-chain supply figure is Not verifiable as of 2026-08-28 because I cannot run a chain query in this turn. YFI is the protocol’s governance token: holders vote on governance and can control protocol parameters, including changes to the token contract and fee settings via governance. Yearn’s docs also describe veYFI, a vote-escrowed, time-locked form of YFI used for governance and reward boosts, with locks up to 4 years. Yearn’s docs say any newly minted YFI would be split 1/3 to key contributors and 2/3 to treasury, but the same docs and governance discussion indicate there is currently no active minter and the supply is intended to remain capped unless governance changes that. The announced historical expansion to 36,666 is documented in external coverage, but whether every unlock/issuance event actually occurred on-chain is Not verifiable as of 2026-08-28 without chain data. Yearn has discussed buybacks / dYFI redemption mechanics and reward distribution funded by protocol profits, and redeemable dYFI is burned on redemption; however, claims about current revenue share, buyback size, burn totals, or staking rewards are Not verifiable as of 2026-08-28 in this run. Allocations to team/investors are effectively none at launch per external coverage; the later 6,666-token increase was designated for contributors and treasury, but exact realized allocations are Not verifiable as of 2026-08-28. Top-holder concentration, insider wallets, DEX liquidity depth, and main listings are Not verifiable as of 2026-08-28 without chain data. Yearn’s token is widely listed on major ETH DEX pools and markets, but precise liquidity depth and concentration require fresh on-chain verification. Mint/blacklist/fee-switch controls: Yearn docs indicate YFI holders control changes to the token contract and fee settings, and the governance discussion says the multisig cannot mint additional tokens absent a governance-set minter; blacklist and fee-switch functions are Not verifiable as of 2026-08-28.

For Yearn Finance, a Bitcoin move below $10,000 is a severe *cross-crypto stress* scenario rather than a direct protocol-specific event. The most relevant implication is likely risk-off pressure on Yearn’s token and strategy TVL, especially on chains where Yearn exposure depends on broader DeFi liquidity and sentiment; however, the exact chain-by-chain impact across Arbitrum, Base, Ethereum, Katana, and OP Mainnet is Not verifiable as of 2026-08-26 because on-chain verification is unavailable in this run. Yearn is also in the news cycle associated with a recent exploit-related market shock, which shows that protocol incidents can amplify Bitcoin weakness through contagion and liquidity withdrawal. The external stress evidence available here supports a bearish macro link: multiple market sources describe a $10,000 Bitcoin outcome as a worst-case, tail-risk scenario tied to systemic deleveraging, liquidity contraction, ETF outflows, geopolitical shock, or broad market liquidation. In practical risk terms, that would usually mean:

• TVL compression as users exit yield strategies and de-risk from DeFi.
• Lower fee generation if strategy deposits and activity fall.
• Higher redemption pressure on liquid vaults and potentially weaker secondary-market pricing for Yearn-associated assets. What cannot be stated reliably from the provided evidence is the protocol’s current balance-sheet exposure, per-chain TVL split, or whether any specific Yearn vault has direct Bitcoin, wrapped-Bitcoin, or correlated collateral concentration on those chains. Those items are Not verifiable as of 2026-08-26. If you want, I can next produce a risk matrix by chain using only verifiable web sources and clearly mark all unverifiable on-chain items.

Yearn’s documented strategy risk framework explicitly includes collateral price falls and stablecoin peg failure as stress drivers, so a 20% depeg of the largest collateral would be a relevant adverse scenario for strategies that borrow against or depend on that asset. However, the results provided do not include chain-by-chain vault exposure, collateral composition, or current TVL for Arbitrum, Base, Ethereum, Katana, or OP Mainnet, so the impact size is Not verifiable as of 2026-08-26. At a high level, the stress would likely matter most where Yearn strategies use the depegged asset as collateral or rely on it for liquidity; the main failure modes are undercollateralization, forced liquidation, worse swap execution, and withdrawal delays if liquidity thins out. Yearn’s docs also note that risk depends on protocol-specific factors such as liquidation handling, oracle accuracy, and whether liquid assets remain available during stress. The only direct protocol-side figure in the search results is a marketing TVL-style claim on Yearn’s landing page, but it is not enough to determine stressed losses by chain or asset mix. For a defensible institutional answer, the missing on-chain exposures would need to be verified first; until then, the correct output is: Not verifiable as of 2026-08-26.

For Yearn, a top counterparty insolvency stress generally transmits through the affected strategy first: the strategy’s position becomes impaired, the vault’s report process recognizes a loss, and the vault may enter emergency shutdown so withdrawals can continue while debt is recalled as quickly as practicable. Yearn’s own risk docs state that Yearn contributors and YFI holders provide no guarantee of safety of funds and will not compensate users for critical failures or loss of funds from system use. Expected loss path:

• If the insolvent counterparty sits inside a leveraged, lending, or LP strategy, the strategy’s asset value drops or becomes unrecoverable, and the loss is realized when the strategy reports to the vault.
• In shutdown, the vault attempts to recall strategy debt and make withdrawals available, but users can still bear the loss if the underlying assets are impaired. Who absorbs it:
• Vault depositors absorb the economic loss first, because the vault NAV falls and share value reprices downward.
• Strategy/accounting layers absorb no external rescue by default; Yearn explicitly disclaims compensation obligations.
• YFI holders / Yearn DAO are not a stated backstop absent a separate governance decision. Compensation:
• There is no default compensation guarantee from Yearn.
• Any reimbursement would be case-by-case governance action, not a protocol promise; Yearn’s past governance proposals for affected vault users show that compensation can be discretionary rather than automatic. Smart-contract impact path:
• Counterparty failure -> strategy position impairment / bad debt -> strategy report -> vault loss accounting -> lower share price -> possible emergency shutdown -> withdrawals/recall of remaining debt. Chain coverage:
• Ethereum, Arbitrum, Base, OP Mainnet, Katana: Not verifiable as of 2026-08-26 from the available sources whether this specific stress path differs materially by chain; the risk mechanics are described at the Yearn vault/strategy level, not separately by chain.

Not verifiable as of 2026-08-26 whether Yearn Finance’s DAO or owners committed fraud. The available sources describe the protocol as DAO-governed and document multiple exploits/incidents, but none of the provided material proves fraudulent intent by the DAO or owners. What *is* supported is that Yearn suffered security failures and loss events: a 2020 Yearn incident was described as a flash-loan/manipulation exploit, not DAO fraud, and Yearn’s own security disclosure says no Yearn vault accounting flaw was found in the 2021 Cream-related incident, while Yearn recovered some funds and reset affected vault pricing. More recent media reports describe a 2026 yETH pool exploit and state Yearn said the primary yield markets were unaffected; again, this is framed as an exploit, not evidence of fraud by insiders. For a fraud-style stress scenario, the relevant conclusion is: insider/DAO fraud is not established by the sources you provided. The risk assumption can be modeled only as an *unverified worst-case governance/insider abuse scenario*, not as a documented fact. If you need a stricter institutional output, the correct phrasing is: “Fraud by DAO/owners: Not verifiable as of 2026-08-26.”

Yearn Finance is exposed to a negative primary-yield shock because its vaults are yield aggregators that depend on external DeFi opportunities, and Yearn explicitly states that vaults inherit the risks of the underlying protocols they use. In a stress case where the primary yield source turns negative over the last 30 days, the immediate effect is likely fee compression, lower deposit attractiveness, and possible net asset underperformance versus holding idle collateral, because Yearn’s strategy returns come from deployed yield rather than a fixed base rate. The main stress-transmission channels are:

• Lower borrowing demand / weaker market yields: Yearn’s docs identify low borrowing demand and reduced farming returns as direct market risks that can lower strategy APYs.
• Underlying protocol risk: if a strategy is routed through lending, AMMs, or other DeFi venues, adverse changes there can reduce or reverse realized yield.
• Capital migration risk: if vault yields go negative on a trailing 30-day basis, users may withdraw and rotate to competing venues, which can further reduce scale and strategy efficiency. For the requested chains—Arbitrum, Base, Ethereum, Katana, and OP Mainnet—I could not verify chain-by-chain exposure, vault mix, or 30-day realized yield from the provided sources. Not verifiable as of 2026-08-26. Because no on-chain query access is available in this run, I cannot confirm whether the negative-yield condition is already occurring on any specific chain, nor quantify TVL at risk. Not verifiable as of 2026-08-26.

Yearn Finance is governed by a mix of token‑holder DAO mechanics and several powerful multisigs, with substantial practical control concentrated in a small group of technical and operational contributors. Because Dune MCP is unavailable, all on‑chain governance concentration metrics are: Not verifiable as of 2026‑08‑26. 1. Governance structure & who controls what

• Token & DAO: Governance token is YFI; voting occurs mainly through Snapshot off‑chain voting and on‑chain execution by multisigs.
• Smart contracts / upgrades: Core protocol contracts are controlled by multisigs (e.g., “Yearn multisig”, “YFI dev multisig”), typically on Ethereum; they can upgrade vaults, set parameters, and move treasury funds according to passed proposals.
• Treasury / funds: The main Yearn treasury and protocol fees are custodied by these multisigs; they execute DAO‑approved spending but retain significant discretion for operations and emergencies.
• Frontend / branding: The yearn.fi frontend, domains, and branding are operated by the core team/entity; governance can influence via budget and contributor selection but day‑to‑day control is centralized. 2. Proposal process
• Idea → forum → Snapshot → multisig: Governance typically follows discussion on the governance forum, then a Snapshot vote (YFI‑weighted), and, if passed, execution by the relevant multisig.
• No fully trustless on‑chain governor controls all contracts; governance is DAO‑guided but multisig‑executed, not purely protocol‑autonomous. 3. DAO reality vs symbolism & voting concentration
• Voting is open to all YFI holders, but large holders (early contributors, treasury, liquidity providers, centralized exchanges/custodians) likely dominate outcomes; precise top‑holder and voter‑turnout stats: Not verifiable as of 2026‑08‑26.
• Practical power is concentrated in the multisig signers and core contributors, so the DAO is real but operationally mediated rather than directly controlling all contracts. 4. Multisigs, timelocks, powers
• Yearn uses multi‑sign multisigs (commonly 6–9 signers, 4–6 threshold, varying by wallet) for treasury and contract control; signers are mostly long‑standing contributors, not independent institutions.
• Some critical operations use timelocks, but not all contracts are timelocked; emergency powers (pauses, parameter changes) can be exercised relatively quickly by multisigs. 5. Legal entity & ToS
• Yearn has used a contributing entity structure (e.g., Yearn‑related service companies/foundations) to pay contributors and manage IP; specifics on current primary entity, jurisdiction, registration number, directors are Not verifiable as of 2026‑08‑26 within the search budget.
• The yearn.fi frontend is subject to Terms of Service and disclaimers that typically disavow custody and classify the interface as informational software; these are unverified marketing/website claims unless supported by independent legal filings. 6. Chain breakdown (Arbitrum, Base, Ethereum, Katana, OP)
• Governance and control remain Ethereum‑centric; deployments on Arbitrum, Base, OP, Katana are governed via the same Ethereum‑side DAO/multisigs, usually with bridge/middleware contracts.
• Per‑chain TVL and governance control percentages: Not verifiable as of 2026‑08‑26.

Yearn Finance operates as a decentralized protocol with associated entities; its exact legal perimeter and regulatory posture are only partially documented. Any on-chain facts are Not verifiable as of [2026-08-26]. 1. Legal entities & jurisdiction

• The original Yearn ecosystem is associated with Yearn Finance Ltd. (BVI) and the Yearn Finance DAO structure, referenced in community and governance discussions, but there is no single, clearly consolidated public corporate registry entry tying all operations together.
• Yearn smart contracts run permissionlessly across Ethereum, Arbitrum, Optimism, Base, Katana, but the legal responsibilities of any foundation/company versus token holders are not clearly delineated in public filings. 2. Terms of service & user restrictions
• Front-end interfaces (e.g., app.yearn.fi) present standard DeFi-style disclaimers: use at your own risk, no guarantees, non-custodial service, and likely restrictions for residents of sanctioned jurisdictions; however, details vary by interface and are not consistently mirrored across all front-ends and chains.
• No clear, unified ToS indicating formal licensing (e.g., broker-dealer, investment adviser, AIFM) could be found. Not verifiable as of [2026-08-26]. 3. KYC / AML
• Public documentation and UI screenshots indicate no KYC/AML checks at protocol level; interaction is via self-hosted wallets.
• Any AML obligations would fall on intermediaries (exchanges, fiat on/off-ramps) or on regulated front-end operators, not on the smart contracts themselves. 4. Regulatory classification & guidance
• Yearn is typically described by regulators and commentators as a yield aggregator / DeFi protocol, not as a registered fund.
• There is no public evidence of specific licenses (e.g., SEC, ESMA, FCA) for the protocol or DAO. Not verifiable as of [2026-08-26]. 5. Enforcement actions, warnings, and court cases
• As of the latest available web data, there are no widely reported regulatory enforcement actions or sanctions specifically naming Yearn Finance or yTokens.
• No major court cases directly against the DAO or protocol are visible in mainstream legal/media search. Not verifiable as of [2026-08-26]. 6. Sanctions & data protection
• Front-ends likely geoblock OFAC-sanctioned regions and reference compliance with applicable sanctions regimes, but implementation details differ and are not auditable on-chain.
• Data protection appears limited to standard web stack privacy policies for the UIs; the protocol itself does not handle personal data beyond pseudonymous addresses. 7. Key institutional risk takeaways
• Regulatory perimeter is unclear: no confirmed licensing, partial corporate visibility.
• No protocol-level KYC/AML: addresses are pseudonymous, raising regulatory and compliance risk for institutional allocators.
• Front-end/operator risk: obligations may sit with UI operators, not contracts; this fragmentation complicates counterparty risk assessment.
• Multi-chain deployment increases jurisdictional touchpoints without clarifying which entity, if any, is accountable in each region.

Yes—if by “the stablecoin used” you mean USDT, which is explicitly referenced in Yearn’s legacy yUSDT/iEarn exploit. The provided results do not show any evidence that Yearn’s stablecoin itself depegged; instead, they show that the protocol was exploited via a legacy USDT-related contract and that attackers swapped into other stablecoins. The 2023 incident on the deprecated iEarn/yUSDT contract is the only clearly identified USDT-linked event in the results, so the answer is 1 time in this dataset. The last identifiable event was April 13, 2023. However, a true price depeg percentage for USDT is not verifiable as of 2026-08-26 from the supplied sources, because none of them provide a Yearn-specific stablecoin price series or a measured deviation from the peg.

Yearn Finance’s top risks are: 1) Smart contract / strategy risk — Yearn vaults and strategies interact with other DeFi protocols, so bugs, exploits, or adverse behavior in those underlying systems can cause losses. 2) Governance / admin-key risk — Yearn docs explicitly note that admin or multi-sig holders can make adverse protocol changes, including approving strategies that lead to losses or changing risk parameters. 3) Oracle and liquidation risk — leveraged and lending strategies can be liquidated or mispriced if price feeds are wrong or delayed. 4) Market / yield compression risk — yields can fall when borrowing demand, trading volume, or token prices decline, and liquidation risk rises when collateral values drop. 5) Operational / composability risk — withdrawals, emergency exits, gas costs, outages, and poor strategy management can prevent timely rebalancing or increase losses. Yearn’s own docs describe these as inherent to vault, protocol, strategy, and AMM/lending integrations rather than as isolated events.

Yearn Finance’s top strengths are its automated yield optimization, gas efficiency through pooled vaults, accessibility for non-expert users, battle-tested security focus, and broad product suite / multi-strategy design. Yearn is described as a yield aggregator that automatically searches for the best yield opportunities across DeFi, with yVaults pooling funds and sharing gas costs among depositors, which reduces per-user execution cost. It is also positioned as simplifying DeFi for users who do not want to manually manage complex strategies. Yearn emphasizes security as a top priority and says its contracts are thoroughly audited, supporting its reputation as a mature, battle-tested protocol. Its product set includes vaults, Earn, Zap, and other strategy tools, which gives it flexibility across lending, trading, and automated capital deployment.