Yearn Finance: How Yearn Vaults, Curated Lending and YFI Work

Yearn is a set of open-source contracts plus the yearn.fi app. Contributors work in small "yTeams" and decisions run through Yearn Improvement Proposals (YIPs) voted by YFI holders ². Day-to-day control sits with the Governance role, a 6-of-9 Safe multisig. Yearn's docs list its signers by name, including people from MakerDAO/Sky, DefiLlama and Katana ⁵.

Yearn states plainly that its security "hinges on the critical assumption" that Governance is honest, and that the role is deliberately not behind a timelock so strategies can be changed quickly ⁴. Read that as the core trust model: you rely on the code and on the people holding those keys.

Yearn sits one layer above protocols such as Curve and Morpho: a Curve deposit earns that pool's yield directly, while a Yearn vault holding Curve LP tokens adds automated reward harvesting and its own fees on top.

How yVaults work

1. Deposit. You deposit a token (for example USDC or a Curve LP token) into a vault and receive vault shares, such as yvUSDC-1 ¹.
2. Strategies earn. The vault lends to or farms on other protocols through one or more strategies. V2 vaults can hold up to 20 strategies; V3 vaults follow the ERC-4626 standard and come as multi-strategy "allocator" vaults or single-strategy vaults with an ys prefix ¹.
3. Harvest. When a strategy reports, profits are added to the vault, so each share is redeemable for more of the underlying token ¹.
4. Withdraw. You redeem shares for the underlying asset. Curve-based vaults return the Curve LP token, which you then withdraw from Curve separately ¹⁹.

Some vaults stake your shares automatically for extra rewards by default. If a deposit "disappears" from the withdraw tab, Yearn's FAQ says it is usually staked and must be unstaked first ¹⁹.

Other products

• yvUSD. A USD vault that deposits on Ethereum and sends funds to strategies on other chains through native bridges such as Circle's CCTP. Yearn notes extra cross-chain, fixed-rate (duration) and leverage risks, and that withdrawals may not always be instant. An optional "Locked yvUSD" adds a cooldown in exchange for a bonus yield ⁹.
• yLockers such as yCRV, which lock governance tokens of other protocols ¹.
• yETH, a liquid-staking-token pool, is now listed as deprecated after its 2025 exploit (see Incident record).

Fees and how APY is shown

Yearn charges two kinds of fee, both taken inside the vault rather than billed to you ¹:

• Performance fee: a cut of profit at each harvest. Vaults deployed through Yearn's factory charge 10% ¹; Yearn's V3 allocator vaults also list 10% ¹¹.
• Management fee: an annual rate collected by minting new shares, which dilutes holders. Single-asset vaults generally have none ¹.

Until 2022 the standard was 2% management plus 20% performance. YIP-69 then moved fee-setting to a team called yRates, with the rule that fees must never exceed the yield depositors earn ². A slice of vault fees can go to the Yearn treasury as a protocol fee, which governance can set between 0% and 50% of fees ³.

The APY on yearn.fi is shown net of fees and is estimated from past harvests, so it is not a promised rate ¹. Gas is extra. On Ethereum it can range from a few dollars to hundreds, and Yearn itself suggests using a layer 2 for deposits under roughly $500–1,000 ¹⁹. See our explainer on gas fees.

Morpho is a lending protocol made of isolated markets, each with one collateral and one loan asset. A Morpho vault pools deposits and lends them across markets chosen by its curator. Yearn began curating after building monitoring for the Morpho vaults its own strategies used ¹⁰¹¹.

Vault tiers. Yearn sorts its Morpho vaults into "Yearn" (mostly blue-chip markets), "Yearn OG" (somewhat higher-risk markets) and "Yearn Degen" (higher risk) ¹¹. Each market gets an internal risk tier from 1 to 5 based on oracle quality and asset liquidity, and Yearn publishes its assessments on curation.yearn.fi ¹⁰.

Who controls what ¹¹:

Yearn does not hold your funds here: deposits stay in Morpho's contracts. The curator decides where they are lent.

Where and at what cost. Yearn lists curated vaults on Ethereum, Katana, Base and Arbitrum ¹¹. On October 23, 2026, the largest by Morpho's data was Yearn OG USDC on Ethereum, at about $10.3 million ¹². There are three ways in ¹¹:

• Deposit directly into a Yearn-curated Morpho vault, usually through the Morpho app. Yearn's docs put the fee at 5–10% of the lending interest, not of MORPHO rewards; Morpho's data shows some smaller vaults at 0% ¹¹¹².
• Deposit into a Yearn "Morpho Lender" strategy, which adds no extra fee and compounds MORPHO rewards.
• Deposit into a Yearn V3 allocator vault that uses those strategies, with its 10% performance fee.

The main risks are bad debt if collateral falls faster than liquidations can cover it, and delayed withdrawals when a market's funds are fully borrowed. Neither is specific to Yearn, but the curator's market choices decide your exposure.

YFI is Yearn's governance token. Its supply is fixed at 36,666, all already minted. The first 30,000 went to liquidity providers over about a week in 2020 ⁷.

Holders can stake YFI as stYFI (keeps voting rights) or stYFIx (delegates voting). Rewards are paid in yvUSDC and must be claimed. Unstaking starts a 14-day linear cooldown; adding more during a cooldown restarts it for the whole amount. stYFI replaced the earlier veYFI lock system, which holders can migrate from ⁸. Rewards vary with protocol income and are not fixed.

• Governance trust. The 6-of-9 multisig can change strategies without a timelock ⁴.
• Strategy and smart-contract risk. Each strategy adds exposure to another protocol. Yearn's own risk table lists governance, technical, market, operational and oracle failures ⁶.
• Audits. V3 core contracts were audited by ChainSecurity, yAudit and Statemind; V2 by MixBytes, ChainSecurity and Trail of Bits. Reports are public on GitHub ⁴. An audit lowers risk but is not insurance.
• Legacy contracts. Several losses since 2021 hit old V1-era or deprecated products, not current vaults. Old contracts can stay live on-chain long after an app stops showing them.
• Phishing. Use yearn.fi and docs.yearn.fi only. The keyword data shows "yearn finance" combined with unrelated token names, a common pattern in impersonation scams.