Harvest Finance Review

How Harvest Finance scores in yield aggregators

This entry rates Harvest's auto-compounding vaults in our yield aggregator ranking. The basis is desk research of Harvest's documentation, its security page and terms, and the harvestfi GitHub repositories, checked on November 1, 2026. No deposit was made. The category uses five criteria, each marked 0 to 10 and weighted equally, as set out in our ratings methodology.

The overall score is the plain average: (7 + 8 + 8 + 5 + 7) / 5 = 35 / 5 = 7.0.

Three marks rose at this check, and the licence mark rose again when the category's scale was applied. Fee disclosure went from 6 to 7 because the FAQ now states in writing that there is no deposit or withdrawal charge, which the rubric counts as disclosure. Licence & code openness went from 2 to 4 after we found a permissive LICENSE.md in Harvest's Base strategy repository. Custody & control went from 3 to 5 because the terms now define the app as non-custodial and the timelock page documents how strategy changes are gated. On November 6, 2026 the category's licence scale was applied consistently, and the licence mark moved from 4 to 8: the live repositories declare open-source terms, but the main Ethereum repository has no LICENSE file. The previous overall was 5.2.

Strongest criteria: audits, licence terms and strategy documentation

Audit disclosure scores 8. All five audit reports on Harvest's security page are linked, and each firm is named with a summary of its findings. The page is candid about scope: it says audits cover the system only at the time of each engagement, and that later deployments, vault redesigns and third-party integrations are not automatically covered. The mark stops at 8 because four of the five engagements carry no date, and the only dated review (Halborn, January 2025) covers core vault infrastructure rather than the long list of strategies.

Licence & code openness also scores 8. Harvest's Ethereum strategy repository has no LICENSE file, and its licence statement is "ISC" in package.json. The Base repository includes a LICENSE.md that grants the usual MIT-style permissions, which GitHub cannot classify, and its contract files are tagged "Unlicense." The category scale gives open-source terms declared only through package.json or SPDX headers, with no LICENSE file in the live repository, an 8. A recognised licence file in every strategy repository would move it to 10.

Strategy transparency scores 7. The FAQ states that the performance fee is already included in the displayed APY. The strategies page explains how doHardWork() collects rewards, sells them for the farmed token and reinvests, with most vaults harvested every 12 to 48 hours. Harvest also says some strategies use "folding," lending and borrowing the same asset several times. Each farm's Details tab carries an APY performance chart, so past rates can be checked against the current figure. What is missing is a per-vault document that states allocation and every dependency in one place.

Weakest criteria: custody wording and the fee range

Custody & control at 5 is partly a wording problem. The terms define "Non-Custodial" so that the website operator never takes possession of, controls or can transfer users' assets. They apply that definition to the website and app, though, and state that the protocol is separate and not operated by that operator. The docs do not say plainly that vault deposits are never locked and are not owned or controlled by anyone. The timelock page describes the control that does exist. Developers deploy a new strategy, announce it, and can apply it after 12 hours, during which users can withdraw. Harvest notes the drawback itself: the same delay also holds back emergency fixes.

Fee disclosure at 7 is held back by the range. "8% to 15%" tells a depositor the bounds but not the rate on a given vault, and the docs do not say how the fee splits between FARM buybacks and operating costs.

What the score does not cover

• APY levels and the FARM price, which move daily.
• The safety of the lending markets and pools Harvest farms. Each vault inherits their risk.
• Past incidents. Harvest's docs record that $24 million was taken from its fUSDC and fUSDT vaults on October 26, 2020, through price manipulation of a Curve pool. The rubric does not score incident history.
• Eligibility. The terms bar US persons and several other jurisdictions.

For how farming rewards become APY, see our guide to how yield farming works.

Harvest Finance vs Pendle and Beefy

Pendle scores 7.4, 0.4 points ahead: it marks higher on fees, audits and custody, matches Harvest on licence, and Harvest leads only on strategy transparency. Beefy scores 8.4, 1.4 points ahead, mainly on a far more explicit custody statement, a longer auditor list and published fee ceilings; the two are level on licence and strategy transparency. Peer marks are as currently published and may change as those entries are rechecked.

Who it suits

The score suits a depositor outside the restricted jurisdictions who values linked audit reports, a written net-of-fee APY and a 12-hour window to exit before any strategy change. It suits less well anyone who needs a fixed fee per vault, a licence file on the main contracts, or a protocol-level statement that deposits are never controlled by its developers.