YO Protocol: How the yoUSD and yoETH Yield Optimizer Works

YO is a set of vault contracts plus a web app and developer kit that wallets and fintech apps can embed. Its site says it was created by the team behind exponential.fi, a DeFi risk-rating site, and the YO risk ratings come from that service ¹¹⁶. The Terms of Service, last updated January 29, 2026, name "YO Apps" as the provider of the website and app and send disputes to arbitration in Panama ¹⁵. No incorporation number or registered office is published.

Day-to-day decisions sit with the team. YO's FAQ says the team, with community input, picks new protocols and chains, and that governance by $YO holders is planned but not yet active ².

Each vault (YO calls them yoVaults) holds one asset exposure and spreads it across several pools ⁴⁷:

Vaults accept deposits natively on Base, Ethereum and/or Arbitrum, depending on the vault. The app can also route deposits from Optimism and Avalanche through Enso, which bridges and deposits in one step ⁶. A YO Gateway contract handles deposits and withdrawals on EVM chains ⁷.

yoTokens do not rebase. Your token count stays the same while each token becomes redeemable for more of the underlying asset ⁴.

1. Whitelisted pools. Each vault has an approved list of pools on protocols such as Morpho and Aave ².
2. Risk-weighting. Each pool's rating is expressed as a probability of total loss. YO discounts the pool's APY by that probability to get a risk-adjusted yield ².
3. Daily rebalance. Once a day YO computes a target allocation, sends new deposits to the most attractive pools and pays withdrawals from the least attractive. It waits for a yield trend to hold before moving funds, to avoid needless bridging and trading costs ².
4. Rewards. Incentive tokens such as MORPHO are claimed and sold for more of the vault's asset, so they show up in the vault's yield ².

Some strategies go beyond simple lending. YO lists automated carry trades and concentrated-liquidity farming among them ⁸.

YO v2. Since October 2026, YO says every movement of funds passes through immutable single-purpose "adapter" contracts, with on-chain caps on how much each vault may send to each contract and an allowlist of bridge routes. Upgrades require a 48-hour timelock and a 4-of-6 multisig. Every transaction is simulated before it is sent ¹¹.

YO's docs say its contracts can charge deposit and withdrawal fees within preset limits, but that these are currently set to 0 ³. Check the vault page before depositing; fee settings are on-chain and can change.

Other costs are shared rather than billed directly. The protocol currently pays rebalancing gas, while bridging and trading costs come out of vault returns and are "socialized among depositors" ². You still pay network gas for your own deposit and withdrawal transactions ¹⁵. See our explainer on gas fees.

The displayed yield is a weighted average of the underlying pools' yields, adjusted for idle cash ². It changes daily and is not guaranteed. Separate $YO token rewards, when offered, come from time-limited campaigns ¹⁴.

Withdrawals are usually instant. YO keeps part of each vault idle, and redemptions under 5% of a vault's TVL settle in the same transaction ²⁵. Larger redemptions are queued while the vault unwinds positions; your yoTokens are burned and the assets arrive automatically, typically within 24 hours ⁵. During stress or heavy exits, that delay is the main liquidity risk YO lists ⁸.

$YO is YO's governance token. YO says holders will vote on treasury use, vault parameters and revenue-share settings, with governance guided by the team at first and moving on-chain over time ¹⁴. Tokens launched in a non-transferable phase. Rewards are distributed through Merkl and claimed on Base. Under the terms, the YO Foundation can claw back tokens left unclaimed six months after a campaign ends ¹⁴.

• Layered smart-contract risk. A loss in YO's contracts or in any protocol it uses can hit the vault ⁸.
• Strategy and execution risk. Automated trading can go wrong, as the January 2026 incident shows (see below).
• Bridging and chain risk. Cross-chain moves add bridge exposure; YO says it caps bridge transfers at $500,000 per transaction and uses native tokens only ⁸¹¹.
• Team control. Pool selection and upgrades depend on YO's team and multisig signers until governance is live ²¹¹.
• Audits. YO publishes reports from Offbeat, Hunter Security, Spearbit, Aether Labs, Paladin, Aetheryc, Zellic, Accretion and Cantina, the most recent dated June 2026 ¹⁰. Audits reduce but do not remove risk.
• Optional insurance. A covered yoUSD vault on Base offers OpenCover protection paid from yield, with a 4% deductible and per-component caps. Phishing and key theft are excluded ⁹.
• Access. The terms bar sanctioned persons and regions and put legal compliance on the user ¹⁵.