On 15 June 2020, Compound began handing out about 2,880 COMP a day to people using its lending markets. Collecting that reward by hand meant claiming it, selling it, buying more of the original asset and depositing again, with an Ethereum fee at every step. A yield aggregator is the tool that grew out of this chore: one contract that does the work for everyone at once and takes a cut.
Five years later the same tool showed its other side. In the first week of November 2025, Balancer was exploited and Stream Finance froze withdrawals, and people who had thought they held one yield found out how many contracts and managers sat under it. The automation saves real money. Each layer that delivers it can also fail.
This lesson continues from our guide to APR and APY, whose compounding formula it reuses. One point on vocabulary. “Aggregator” here means yield, not swaps: DEX aggregators such as 1inch and Jupiter route a trade across pools, which is a different job.
What a yield aggregator does with your deposit
Think of a shared bag with a receipt. You hand tokens to a vault, a smart contract that pools deposits. It gives you shares, the receipt. A strategy then puts the pooled money to work: lending it, providing liquidity, collecting rewards, selling them and adding the proceeds to the bag.
Nothing lands in your wallet along the way. Take an example: you deposit 1,000 USDC while one share is worth 1.00 USDC, so you get 1,000 shares. A year later the vault holds 1.052 USDC per share. You redeem the same 1,000 shares for 1,052 USDC. Your share count never moved; its price did.
That design is the reward-bearing kind of token, as opposed to the rebasing kind whose balance grows; our lesson on interest-bearing tokens sets the two side by side. For a vault, it means the number to watch is price per share, not your balance.
Liquidity mining created the chore
Liquidity blockchain and earns a reward, which makes rewriting history very expensive.">mining pays users in a protocol’s own token for supplying or borrowing assets. COMP is the scheme that set off what is now called DeFi summer, told in our history of DeFi. Farmers moved so fast that BAT supplied on Compound rose from under 2 million dollars on 15 June to 333 million two weeks later, CoinDesk reported. Token holders voted on 30 June to base rewards on the dollar value supplied or borrowed, not on interest, and the change took effect two days later. Our lesson on yield farming and real yield asks who pays for these rewards. The question here is more mechanical: who does the work.
A farmer working alone pays gas fees for each claim, swap and redeposit, whatever the size of the position. On a small deposit those fees can eat the yield. A contract holding thousands of deposits pays for one transaction and divides the cost among all of them. That is the whole economic case for a yield aggregator.
Yearn: from a stablecoin bouncer to allocator vaults
From iEarn to YFI
Yearn, built by Andre Cronje, started as iEarn, a tool that moved stablecoins between lenders such as Compound, dYdX and Aave to chase the best rate. Rebranded in summer 2020, it launched YFI with 30,000 tokens, no premine, no presale and no team allocation, all paid to users who provided liquidity. Control of the token later passed to a 6-of-9 multisig, according to The Defiant.
How a v3 vault is built
In the current generation, a user deposits into an Allocator Vault, an ERC-4626 contract that spreads one asset across several strategies. The strategies are themselves stand-alone ERC-4626 vaults. A single strategy can feed many vaults, and a user can deposit into it directly. Two helper contracts complete the picture: a Debt Allocator that assigns money to strategies, and an Accountant that handles fees.
Gains reach the share price slowly. When a strategy reports a gain, the vault does not add it to the share price at once. It records the gain, charges fees through the accountant if one is set, and spreads the profit over a period set by the vault manager. A steadier yield is the stated purpose. A loss goes through the same reporting call, and by default anyone can trigger that call through a permissionless keeper.
The 2021 yDAI exploit
On 4 February 2021 the v1 yDAI vault lost 11 million DAI, according to Yearn’s disclosure. The attacker repeatedly unbalanced Curve’s 3pool so that the vault deposited at bad rates, and made about 2.7 million DAI by Yearn’s estimate (2.8 million dollars according to Yearn developer banteg). Yearn stopped it about 11 minutes after noticing, which saved 24 million of the vault’s 35 million DAI. On 9 February, Yearn opened a Maker vault with about 1,591 YFI from its treasury and minted about 9.7 million DAI to refill the yDAI vault. The team called it “a one-off celebration of going through this DeFi rite of passage” and added: “Don’t count on it happening again.”
Beefy: the multichain compounder
Harvests, mooTokens and fees
Beefy, which calls itself a multichain yield optimizer, does one thing many times over: it auto-compounds. You deposit a token and receive a mooToken, an interest-bearing receipt. A harvest collects the farm’s rewards, swaps them and reinvests them, and the value of your mooToken rises.
Harvests cost gas, so their frequency depends on the money in the vault. On Ethereum, Beefy’s documentation sets it by staking or liquidity, measured at current market prices. It is the main size metric in DeFi.">TVL: every 3 days above 100,000 dollars, every 15 days between 10,000 and 100,000 dollars, and left to community harvesting below that. They also pause there when the gas price is 20 gwei or more.
Fees come in three kinds. Most vaults take a percentage of harvest rewards, a performance fee, never charged on the deposit itself. Some add a withdrawal fee, meant to stop people depositing just before a harvest and leaving right after. Using Beefy’s zap, which converts tokens on the way in or out, costs 0.05%. The docs say vault fees are already included in the APY shown, so you do not subtract them a second time. BIFI, the protocol token, has a fixed supply of 80,000 with no minting or burning.
Growth, the Multichain scare and the new liquidity manager
Beefy’s own account dates the launch of the protocol and BIFI to October 2020, with 1 billion dollars locked by October 2021 and V2 in March 2022. In 2023 the Multichain bridge collapsed, and Beefy says it migrated about 15,000 positions over three months with no funds lost. That is the team’s claim, and it is a useful reminder that a vault on a smaller chain also inherits that chain’s bridge. In April 2024 came the Cowcentrated Liquidity Manager, which automates concentrated-liquidity positions.
Beefy also says it passed Yearn at the end of 2024 to become the largest yield optimizer. Those rankings move. As of 31 October 2026, DefiLlama shows Yearn at about 151.9 million dollars and Beefy at about 99.2 million, and both sit far below their peaks: about 6.9 billion for Yearn in early December 2021 and about 1.3 billion for Beefy in late November 2021. That leaves Yearn at about 2% of its record and Beefy at about 8%. DefiLlama lists 42 chains for Beefy, but only ten hold more than 1 million dollars, led by Ethereum, Base and Arbitrum.
ERC-4626: one interface for every vault
Before a standard existed, each vault had its own functions, so every wallet, lender or strategy that wanted to plug into one needed custom code. ERC-4626, created on 22 December 2021 and now Final, fixes one interface for tokenized vaults. The share is an ordinary ERC-20 token, and the standard defines how it converts to the underlying asset. Lego-style stacking, covered in our lesson on DeFi composability, depends on interfaces like this one.
Shares and assets in plain numbers
Every ERC-4626 vault answers the same small set of calls. These are the ones a reader sees most often on an explorer or a dashboard.
| Function | What it answers | Note |
|---|---|---|
| asset() | Which token does the vault hold? | Example: USDC |
| totalAssets() | How much does the vault manage? | Includes money deployed in strategies |
| convertToAssets(shares) | What are these shares worth? | Ideal rate, ignores fees |
| convertToShares(assets) | How many shares would this amount be worth? | Ideal rate, ignores fees |
| previewDeposit(), previewRedeem() | What would I get if I did this now? | Includes fees |
| deposit(), mint() | Put assets in, get shares | Set the assets, or set the shares |
| withdraw(), redeem() | Burn shares, take assets out | Set the assets, or set the shares |
| maxWithdraw(), maxRedeem() | How much can leave right now? | The vault can report less than your balance |
Why rounding always goes against you
Solidity has no decimals, so conversions round. The standard tells implementers which way: the spec says “it is considered most secure to favor the Vault itself during calculations over its users”. You receive slightly fewer shares on the way in and slightly fewer assets on the way out. On normal amounts this is dust. It protects the people already in the vault from being drained by tiny repeated transactions.
The spec also warns that a contract can follow the interface without following the specification, so integrators should review the code before plugging in. And preview functions, being exact results at that moment, can be moved by someone manipulating the vault, so they are not always safe as price oracles. ERC-4626 tells you how to talk to a vault. It says nothing about whether the vault is any good.
The first-depositor inflation attack
The best-known weakness of share vaults is not discussed in the EIP; it is documented by OpenZeppelin. It works on an empty or nearly empty vault, because a rate set by a few units is easy to distort.
Here is a toy example in the token’s smallest units. An attacker deposits 1 unit and receives 1 share. The attacker then sends 1,000 units straight to the vault, a donation that mints no shares, so 1 share now stands for 1,001 units. A victim deposits 1,000 units and should get shares equal to 1,000 × 1 ÷ 1,001, which rounds down to zero. The vault now holds 2,001 units and the attacker owns the only share. Redeeming it returns the victim’s money.
OpenZeppelin’s defence has two parts: shares carry more decimals than the asset, and the exchange rate is computed with a few virtual shares and virtual assets, so a donation is mostly captured by the vault and not by the attacker. Its formula shows the effect. With an offset of 3 decimals, a 1-unit deposit and a donation of 100,000 units, the attacker gives up about 50,000 units to steal at most 50. OpenZeppelin’s contract notes also tell deployers to make a sizeable first deposit themselves.
Lending markets have met a close relative of this bug. The move is the same, distorting the exchange rate of a nearly empty market, but the victims are the lenders already there and not a later depositor. Sonne Finance, a Compound V2 fork on Optimism, lost about 20 million dollars in May 2024 through a newly opened VELO market, by PeckShield’s estimate. On 26 June 2025, Resupply lost between about 9.6 million dollars (Decrypt) and about 9.8 million (Halborn): a donation into a thin new market pushed an exchange rate to zero through integer division, and the attacker borrowed about 10 million dollars against one wei of collateral.
Auto-compounding, net of fees and gas
Our APR lesson gives the formula: APY = (1 + APR/n)^n − 1. Take 12% APR compounded daily: about 12.75% APY. A vault that keeps 10% of rewards leaves 10.8% APR, or about 11.40% APY at the same frequency. Those are example figures; we state no real fee level here because neither Yearn’s nor Beefy’s docs give a single one, and fees vary by vault.
The more interesting comparison is against doing it yourself, and the answer depends on the size of your deposit. Example: a farm paying 8% APR, 12 dollars of gas per manual compounding round, and a vault that charges 10% of rewards, compounds weekly and spreads the same gas across 2 million dollars of deposits. You compound by hand once a month, which costs 144 dollars a year, paid from your wallet and not from the position.
| Your deposit (example) | By hand, monthly, after gas | Vault, after fee and shared gas |
|---|---|---|
| 1,000 dollars | about −6.1% | about 7.4% |
| 10,000 dollars | about 6.9% | about 7.4% |
| 100,000 dollars | about 8.2% | about 7.4% |
The small saver gains the most from sharing gas, and the large holder can end up paying the vault more than the chores are worth: on these assumptions the two columns cross near 16,500 dollars. Three things the table leaves out: reward tokens can fall before they are sold, a cheap layer 2 shrinks the gas column to almost nothing, and the vault adds risk that does not appear in any percentage. Gas costs also move daily, so treat the 12 dollars as a placeholder for your own figure.
Curated vaults: Morpho and the person choosing the collateral
A newer kind of vault replaces the strategy with a person or a firm. On Morpho, lending markets are isolated, and a vault sits on top and decides which ones receive deposits. Yearn and Beefy automate a farm; a Morpho vault automates a risk decision, made by a curator.
The roles in Morpho Vaults V1.0 and V1.1 are public. The owner appoints the others and sets the fee, which is minted as vault shares. The curator submits supply caps and market removals. The allocator orders the supply and withdrawal queues and moves liquidity between markets. The guardian can revoke pending changes. Raising a cap has to wait out a timelock, while lowering one applies at once. If a vault’s timelock is short, you have little time to leave before a riskier market gets added.
| Yearn v3 | Beefy | Morpho vaults V1 | |
|---|---|---|---|
| What earns the yield | Several strategies | Usually one farm, auto-compounded | Isolated lending markets |
| Your receipt | ERC-4626 share | mooToken | ERC-4626 share |
| Who decides | Vault manager and debt allocator | Strategy contract and harvest bots | Curator and allocator |
| Where the fee comes from | Accountant, on reported gains | Share of harvest rewards | Minted as shares to the fee recipient |
| Main thing to check | Strategy list and fees on the vault page | Harvest frequency and the farm itself | Collateral list, caps and timelock |
As of 31 October 2026, DefiLlama’s yields page shows how much these numbers need reading. smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">Pool names below are the symbols it gives.
| Pool (DefiLlama symbol, chain) | TVL (million dollars) | Base APY | Reward APY | 30-day mean |
|---|---|---|---|---|
| Morpho GROVE-STEAKUSDC, Base | 554.4 | 7.47% | 0% | 4.98% |
| Morpho SPARKUSDC, Base | 450.3 | 6.66% | 0% | 4.35% |
| Morpho STEAKUSDG, Robinhood Chain | 512.1 | 4.96% | 23.63% | 7.33% |
| Yearn USDC, Ethereum | 19.3 | 3.44% | 0% | 3.58% |
| Beefy USDT-WBTC-WETH, Ethereum | 9.3 | total 8.23% | not split | 4.08% |
The third line reads 28.58% in total, of which about 83% is reward. The first two sit well above their own monthly average, so that day was not a typical one. Nothing here ranks these products; the table is an exercise in the reading method of the previous lesson.
How risk stacks under one yield number
A single APY line on a vault page can hide the following pile, from the bottom up.
- The chain, and any bridge that brought the asset there.
- The underlying asset, whether a stablecoin, a wrapped token or a staking token.
- The base protocol, such as a lending market or a liquidity pool.
- The oracle that prices the collateral.
- The strategy contract, and anything it borrows or swaps through.
- The vault contract and its keepers or harvest bots.
- The people: curator, allocator, multisig signers, and any off-chain fund manager.
A failure on any one of those layers reaches the same place, your share price. Depositing directly in the base protocol would have exposed you to some of them. A vault adds at least two, and when one vault holds another vault’s token as collateral, the list repeats.
Five incidents, five different layers
| Date | Name | Layer that failed | Loss, with source | What followed |
|---|---|---|---|---|
| 4 Feb 2021 | Yearn v1 yDAI | Strategy, Curve 3pool rates | 11 million DAI; attacker’s gain about 2.7 million (Yearn) | About 9.7 million DAI minted against treasury YFI |
| 26 Jun 2025 | Resupply | New thin market, exchange rate | About 9.6 million (Decrypt) to 9.8 million (Halborn) | wstUSR market paused |
| 3 Nov 2025 | Balancer V2 | Base protocol, rounding in stable pools | About 95 million (Balancer) to about 128 million (third-party counts) | Part frozen or recovered, including about 19 million of osETH |
| 3-4 Nov 2025 | Stream Finance, xUSD | Off-chain fund manager | About 93 million disclosed; about 285 million of related debt (Yields and More, via The Block) | Withdrawals halted; creditor claims opened in June 2026 |
| 30 Nov 2025 | Yearn yETH | Legacy custom stableswap pool | About 9 million dollars (The Block) | 857.49 pxETH recovered, about 2.4 million dollars |
The Balancer figure needs care. The exploit began around 7:46 UTC on 3 November 2025, and Balancer’s post-mortem of 18 November estimates 94.8 million dollars of user funds stolen from Composable Stable Pools on V2. Earlier and wider counts ran higher: 116 million in Cointelegraph on 5 November and more than 128 million from PeckShield and Nansen, as cited by The Block. Rekt’s tally shows one reason totals differ: about 93.4 million for the main exploiter and about 18 million more on forks such as BEX and Beets. The cause was incorrect rounding in the exact-out swap path. Weighted pools and Balancer V3 were reported unaffected. We found no source tying this exploit to Yearn.
Stream is the case most specific to vaults. On its own account, an external fund manager lost about 93 million dollars, and deposits and withdrawals stopped. Decrypt, citing CoinGecko, reported xUSD down about 77%. The damage then travelled through lending markets where curators had accepted xUSD or Elixir’s deUSD as collateral. Protos listed the exposures on 6 November 2025: about 34 million dollars for MEV Capital, about 27.4 million for Re7 Labs across two sets of markets, over 19 million for Varlamore, and an analysts’ estimate of 124 million for Telos Consilium, which had not given its own figure. Elixir, which had lent Stream more than 68 million dollars, wound down deUSD. Gauntlet said it had no xUSD exposure, yet it paused the Compound markets it manages during the liquidity crunch. At the end of June 2026 Stream began collecting creditor claims through an online form; as of 31 October 2026 we found no report of a final settlement.
yETH teaches the opposite lesson about brands. On 30 November 2025 at 21:11 UTC, an attacker broke the pool’s solver and emptied its staking tokens, then minted about 2.35 × 1056 yETH to drain the yETH/ETH Curve pool. Yearn’s disclosure says “Yearn v2/v3 vaults and other Yearn products were not affected”. It also says the product “is self-governed by its depositors” and that contributors and governance are not liable for reimbursement. The word Yearn in a name did not mean Yearn would pay. In 2021, for yDAI, it had. Letters mislead the other way too: the yUSD that Protos placed in a lending chain with xUSD and deUSD is issued by YieldFi, not by Yearn.
Checks before you deposit in a yield aggregator
- Read what the vault holds today, by name, down to the collateral and any token that is itself a vault share.
- Find out who can change the strategy or the market list, and how long the timelock gives you to react.
- Compare the current APY with the 30-day mean, and split base from reward.
- Check the vault’s age and size, since a new, nearly empty vault is the setting for an inflation attack.
- Call maxRedeem() or try a small withdrawal to see how much can really leave, and on what schedule.
- Read the audits, and note which contracts they cover and on what date.
- Ask what happened at this team’s last incident, and who paid.
- Try a small amount first, with the gas of both directions counted in.
A fuller due-diligence method, and a survey of DeFi hacks, will come in later lessons of this path.
Taxes: what is settled and what is not
We found no tax authority in the United States that has ruled specifically on vault deposits. The IRS treats crypto as property under Notice 2014-21, so a sale of vault shares is a disposal. Whether swapping USDC for a share is itself a taxable exchange is unsettled, and auto-compounded gains that never reach your wallet make the timing harder still. Keep the date, the share count and the share price of each deposit and withdrawal. Our guide to crypto taxes in the United States covers the basics.
In the UK, HMRC published a policy paper, Cryptoasset loans and liquidity pools, on 13 July 2026, last updated on 28 October 2026. It proposes deferring Capital Gains Tax until an economic disposal for single-cryptoasset lending and borrowing and for automated market making. The page gives no start date and does not mention vault shares, so do not assume they qualify. Ask a professional before a large position.
The next lesson of the path looks at another layer of the yield machine: vote-locked tokens and the Curve wars, where the fight is over which pools receive rewards at all.
