No exploit of vfat's Sickle contracts was found in the sources reviewed for this profile (DefiLlama lists no hallmarks for vfat.io), as of October 2026
—outcome unclear- Outcome
- No incident on record in reviewed sources; not proof that none occurred
vfat.io is a non-custodial DeFi app for finding, entering and managing liquidity-pool farming positions on EVM chains. Instead of swapping, adding liquidity and staking in separate steps, you deposit once and vfat's contracts do the rest from a personal smart-contract wallet called a Sickle, which you control 12. It can also harvest, compound, rebalance and exit positions automatically for a percentage fee 3. As of October 23, 2026, the site displays about $32.5 million in deposits across 37 chains 1. (Searching "vfat" also returns the unrelated FAT filesystem; this page covers the crypto app.)
vfat sits on top of existing decentralized exchanges. It does not run pools itself; it routes your money into pools on DEXs such as Aerodrome, Uniswap, PancakeSwap or Curve and stakes the resulting position in the pool's reward gauge 19. Background: yield farming and automated market makers.
The key piece is the Sickle. The first time you open a position on a chain, a factory contract deploys a Sickle smart wallet for your address on that chain 2. Each later action runs through it as one batched transaction: swap your token into the two pool tokens, add liquidity, stake. The batching function only accepts calls from strategy contracts on vfat's on-chain registry, and those can only touch registered contracts 2. That design limits what can run through your Sickle, but it also means you rely on vfat's registry and strategy code being correct.
Typical flow, based on vfat's docs 291:
APR figures are estimates. Reward APR follows the pool's emission rate, which protocols such as Aerodrome reset weekly; fee APR is extrapolated from the previous seven days of swap fees, so it can change sharply 11.
vfat offers four automations, enabled per position after a one-time "Automation" approval on each chain 46:
Automated actions can run without a new signature from you, inside the permissions you granted. You can switch Automation off per chain from the Sickle settings 2.
vfat charges strategy fees on top of gas, DEX swap fees and slippage. As of October 2026 the docs list 3:
| Action | vfat fee |
|---|---|
| Deposit or withdraw the LP token/NFT, or both underlying tokens | 0% |
| Deposit or withdraw via a single other token (swap occurs) | 0.09% |
| Manual harvest or compound | 0.9% of rewards |
| Rebalance | 0.01%, 0.03% or 0.05% of the position, by pool fee tier |
| Auto-harvest | 1.2% of rewards |
| Auto-compound | 1.8% of rewards |
| Auto-rebalance | Same as manual, plus reward-handling fee |
| Auto-exit | Withdrawal fee plus any fee on collected rewards |
Part of the automation fee pays the gas for automated runs 4. An optional prepaid gas balance can cover runs when fee revenue is too low; it does not waive the fees 7. Some tokens also tax their own transfers, and a single zap can trigger that tax several times; vfat shows a warning but cannot detect every case 3. See gas fees and slippage.
Your assets sit in a Sickle you own, not in a pooled vault controlled by vfat 2. Smart-contract risk still applies at two levels: vfat's Sickle and strategy contracts, and the DEX and gauge contracts your money goes into.
vfat publishes audit reports from yAudit (ten reports, June 2023 to May 2026), Ackee Blockchain (two, 2025) and Omniscia (January 2025) 8. The docs note that each audit covers only the code version in its scope, and that contracts carry risk regardless of audits 89.
For selected protocols, vfat sells Bundled Protocol Cover: protection against protocol hacks for one specific Sickle position, priced at purchase, for 30, 60, 90 or 180 days, paid in USDC on Base, Arbitrum or Optimism 10. It does not cover other positions, and this profile did not review the policy wording.
Other risks are not fixable by vfat: impermanent loss, reward-token price falls, and pools or gauges that a DEX winds down.
vfat's docs carry a recovery notice for Velodrome users: bridges for xVELO on eight chains, including Mode, Lisk, Metal, Unichain, Fraxtal, Celo and Soneium, were scheduled for deprecation on October 15, 2026, with Lisk Velodrome positions also affected 13. The app shows a banner to wallets holding affected assets. The deadline came from Velodrome, not vfat, and later recovery is not guaranteed 13. Holders should check Velodrome's own notices.
Support runs on tickets opened inside an action pane and tied to the wallet that signed them; closed tickets are deleted after about 30 days 12. Legitimate support never needs your seed phrase (phishing). Other features include a meta-aggregator swap and bridge page 16, a Telegram alert bot, a referral program that pays a share of referred users' fees 14, and an MCP server that lets AI assistants look up yields and prepare transactions 15.
Hacks in DefiLlama’s public database are also scored as the security record on the vfat.io rating page.
EarningWhat is yield farming and how does it work?Yield farming lets you earn rewards by lending or supplying crypto to DeFi protocols. Here is how it works, plus the risks to weigh first.8 min read·
SecurityWhat Is a Rug Pull, and How to Spot OneA rug pull is when a project's team abandons it and drains investor funds. Learn the main types, the warning signs, and how to check a token before you buy.7 min read·
RegulationBitcoin ETF Outflows Weigh on Market as Interactive Brokers Launches Ethereum StakingSpot Bitcoin ETFs recorded $65.4 million in net outflows as hawkish Federal Reserve comments pressured prices. Meanwhile, Interactive Brokers rolled out Ethereum staking for eligible US clients.4 min read·
MarketsCFTC Opens Retail Crypto Leverage Rulemaking as Bitcoin Holds Near $84KThe CFTC has begun a rulemaking on leveraged retail crypto trading, while Bitcoin hovers near $84,000 and traders wait for U.S. inflation data and the Fed’s October meeting.4 min read·
MarketsUS Moves $1B in Seized Bitcoin as Senate Scrutiny of Tether GrowsU.S.-linked wallets shifted 12,267 BTC from a Bitfinex hack seizure address without any exchange deposit, while Senator Richard Blumenthal pressed Cantor Fitzgerald over its Tether partnership.3 min read·Related: What is yield farming? · All company profiles