Yearn Finance Review

How Yearn Finance scores in yield aggregators

This entry rates Yearn's yVaults, the v3 ERC-4626 vaults and the legacy v2 vaults, in our yield aggregator ranking. yLockers and Yearn's Morpho curation are not scored separately. The basis is desk research of Yearn's documentation, its yearn-security repository and its vault code on GitHub, checked on November 6, 2026. No deposit was made. The category uses five criteria, each marked 0 to 10 and weighted equally, as set out in our ratings methodology.

The overall score is the plain average: (7 + 10 + 9 + 7 + 8) / 5 = 41 / 5 = 8.2. The previous overall was 8.2.

Two marks changed at this check. Strategy transparency rose from 7 to 8 after we read Yearn's net-APY statement and its risk score framework, which together document both the yield basis and a per-strategy risk rating. Custody & control moved from 8 to 7 when the category's scale was applied consistently on November 6, 2026: an admin multisig without a timelock, with a written statement that it cannot take deposits, is marked 7 wherever it appears. The other three marks were re-checked against current pages and held, and the two changes cancel out in the overall.

Strongest criteria: licence and audit record

Licence & code openness carries the full 10. The current vault and strategy code is AGPL-3.0, a copyleft licence that requires anyone running a modified version as a network service to publish their changes. The repositories are active, with commits in October 2026.

Audit disclosure scores 9. Yearn's security page is one of the clearer in the category: each audit is listed against the version it covered, with a link to the report. The newest, a yAudit review of v3.1.0 from June 2026, is already on it. The yearn-security repository also keeps dated reports going back to 2020 and dated incident disclosures. The mark is not 10 because one legacy audit, ChainSecurity's review of v2 version 0.3.5, has no public report.

The incident record shows why audits are not guarantees. Yearn's disclosure of December 1, 2025 describes the exploit of the yETH stableswap pool, a product it says is self-governed by its depositors. The same disclosure says v2 and v3 vaults were not affected and that contributors and governance are not liable for reimbursement.

Weakest criteria: per-vault fees and the untimelocked multisig

Fee disclosure at 7 is the lowest mark. Yearn explains the mechanics well: the performance fee comes out of harvested yield, and a management fee, where one applies, is taken by minting new shares. But after YIP-69 the structure is dynamic, and the docs point depositors to yearn.fi for each vault's rate instead of stating a full schedule or a maximum. Deposit and withdrawal fees are not mentioned either way. Peers that publish fee ceilings or one rate for every product score higher.

Custody & control at 7 is a measured result. The written guarantee is strong: shares can always be redeemed for a proportional amount of vault assets, and the multisig cannot remove deposits. The limit is governance itself. Yearn's security page says the protocol hinges on the governance role being honest, that a compromised governance could cause catastrophic damage, and that the role is not timelocked by design. Signers are elected by YFI holders and named in the docs, but a depositor has no delay in which to exit. Peers with a similar written guarantee and a documented timelock mark higher.

What the score does not cover

• APY, TVL and returns, which change with each vault's strategies.
• The protocols underneath a vault. Yearn's docs call this yield-stack risk, and state that no one will compensate losses and that there is no insurance.
• Products such as yETH and yLockers that carry their own governance or redemption terms. yLocker tokens cannot be redeemed for the locked token.
• The YFI token and stYFI governance.

Our guide to how yield farming works covers the risks a vault inherits.

Yearn Finance vs Origin and Convex Finance

Origin (OUSD) scores 8.8 and Convex Finance 8.6. All three hold the top licence mark and the same strategy mark. Yearn's gap is fee disclosure: Origin states one 20% fee on yield, and Convex publishes its full fee schedule. On custody Yearn matches Convex, whose admin multisig is also not time-locked, and trails Origin, whose upgrades pass a 48-hour timelock. Yearn leads Convex on audits. Peer marks are as currently published and may change when those entries are rechecked.

Who it suits

The score suits a depositor who wants AGPL code, an audit list tied to contract versions, net-of-fee yield figures and a published risk rating for each strategy. It suits less well anyone who needs a fixed fee schedule in the docs, or a timelock on governance actions. Check the vault's fee and risk level on yearn.fi before depositing.