(a) Problem the project solves

Yearn's core vault contracts are designed to give depositors a simple way to generate returns on deposited assets through lending protocols, liquidity pools, and any other viable source of yield on Ethereum mainnet and other EVM chains (source: https://github.com/yearn/yearn-vaults-v3; source: https://gov.yearn.fi/t/how-we-think-about-yearn/7137; source: https://yearn.fi/vaults).

(b) Operational priorities

Yearn's operational priorities center on developing and maintaining robust, open, and permissionless financial infrastructure that anyone in the world can use to curate the best risk-adjusted returns available on Ethereum-based markets.

Operations are funded by fees from smart contract development and deployment of core products like Yearn Vaults V3.

(c) High-level project overview

Yearn is a Full Stack DeFi yield aggregator that automates capital allocation and market curation across lending and liquidity protocols through smart contract Vaults. Since creating the first Vault in 2020, it has grown into one of DeFi's most battle-tested yield infrastructures, with over $8B in lifetime deposits and more than $300M in net profits.

(d) Primary token functions

The YFI token is a tool for coordination between Yearn's contributors, community and associated protocols. It was created to decentralize the management and development of yearn products while providing an environment for fast-paced innovation.

In 2025, stYFI was created, enabling token holders to receive 90% of Yearn revenue (source: https://gov.yearn.fi/t/yip-88-governance-overhaul-styfi/14552; source: https://styfi.yearn.fi/).

(e) Control surface reliance

Yearn's public control surface relies on constrained delegation rather than a single centralized operator. YFI holders retain ultimate authority over governance powers and signer changes, yTeams hold delegated operational powers, and the multisig retains execution and veto powers over onchain actions until a more decentralized implementation is adopted (source: https://docs.yearn.fi/contributing/governance/governance-and-operations/; source: https://gov.yearn.fi/t/yip-61-governance-2-0/10460; source: https://gov.yearn.fi/t/yip-79-multisig-compensation-and-rotation/14179).

Labs / DevCo

Foundation

DAO / Onchain Governance

(a) IP ownership & control

Yearn V3 Core Vault Logic has AGPL 3.0 license (https://github.com/yearn/yearn-vaults-v3) Yearn V3 Strategy Logic has AGPL 3.0 license (https://github.com/yearn/tokenized-strategy)

(b) Contract/admin powers

Yearn uses a constrained-delegation governance model. The powers expressly retained by token-holder governance are: creating, assigning, or revoking delegated powers; changing or interacting with the YFI token contract, including minting authority; setting protocol fee structures; changing yChad multisig signers; ratifying or removing yTeams; changing yOps signers; approving expenditures of Treasury funds; and deciding any matter outside an already-delegated power through a YIP. Current governance voting power is held by stYFI holders.

The operational powers delegated under Governance 2.0 are: Execution Power and Veto Power to yChad; Emergency Powers to yGuard to intervene in an attack or bug and shut down or roll back affected vaults or strategies; Manage Strategies to yBrain; Define Yearn Protocol, Manage Protocol, and Add Strategies to yDev; Delegate Transactions to yTx; Pay Team to yPeople; Set Budgets to yBudget; Farm Treasury, including management of airdrops, to yFarm; and Ratify yTeam Signers to yOps. yChad executes applicable onchain decisions and can veto them.

(c) Locked-token rights (conditional)

Yearn governance staking is centered on stYFI and stYFIx.

stYFI: stake YFI, earn 90% of Yearn revenue, and retain direct governance rights. stYFIx: a more passive option that delegates voting power (recommended if you do not want to manage governance actions directly).

Unstaking starts a 14-day linear cooldown:

funds unlock linearly over time and holders can withdraw the currently unlocked amount at any point during the stream

(source: https://docs.yearn.fi/contributing/governance/styfi)

(d) Value accrual & holder rights

stYFI and stYFIx holders earn 90% of Yearn revenue (source: https://styfi.yearn.fi/)

(e) Dissolution authority

Operationally, spinning down the Yearn DAO would require a governance proposal approved by YFI token holders. The proposal would authorize a series of on-chain governance actions, such as revoking or transferring privileged roles, disabling contributor funding, winding down or migrating vaults, defining treasury disposition, and making governance contracts immutable or otherwise minimizing administrative authority. Execution would occur through Yearn's governance contracts and timelock, with each approved action carried out according to the protocol's governance process.

stYFI token holders govern the Yearn ecosystem through offchain proposals and votes via Snapshot. Proposals that generate majority support (>50% of the vote) are expected to be implemented by the proposed relevant parties. The 9-member yChad multi-signature wallet is then empowered to execute all related transactions after their own review. The members of the multi-signature wallet are voted in by YFI holders and are subject to change via future governance votes (source: https://docs.yearn.fi/contributing/governance/proposal-process).

(a) Entity

Ychad.Eth Yearn BORG, a foundation company limited by guarantee without any share capital

c/o International Corporation Services Ltd, PO Box 472, 2nd Floor, North Wing, Harbour Place,103 South Church Street, George Town, Grand Cayman KY1-1106, Cayman Islands

(b) IP ownership & control

No IP exists for the Foundation.

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

The professional BORG Director does not independently exercise Yearn governance, treasury, token, emergency, or reward-setting powers and does not have a key to unilaterally operate yChad. The Director's affirmative authority is limited principally to signing legal documents and government filings on behalf of the Foundation and participating in a liquidation of the Foundation; liquidation cannot be approved by the Director alone and additionally requires yChad and Yearn DAO approval.

The relevant operational powers instead sit with Yearn's governance system and multisigs. yChad is a 6-of-9 Safe, so an ordinary transaction requiring yChad approval requires six of the nine yChad signers. Binding DAO proposals are approved by a majority of voting stYFI and, where onchain execution is required, are implemented through the multisig.

For emergency powers, Governance 2.0 delegates authority to yGuard to immediately intervene in an attack or bug, including shutting down or rolling back affected vaults or strategies. Yearn's emergency procedures contemplate actions such as revoking strategies, activating emergency shutdown, changing debt ratios, and placing strategies into emergency-exit mode. Where execution requires yChad, the execution threshold is 6-of-9; some contract-specific emergency actions may instead be performed through separately delegated operational multisigs.

For Treasury distributions, the general power to spend Treasury funds remains with token-holder governance. A binding governance decision requires majority support from stYFI voters, and a yChad transaction requires 6-of-9 signatures for execution. YIP-88 additionally created a $250,000 discretionary fund managed by yChad for urgent or sensitive expenditures; yChad may spend from that approved envelope, but replenishing it requires a new formal DAO proposal and vote. 

For YFI token administration, authority over the YFI token contract remains with token-holder governance rather than the Director or yChad acting unilaterally. Actions such as changing minting authority therefore require a governance decision; if an onchain yChad execution is required, the Safe threshold is 6-of-9. 

For reward and revenue parameters, YIP-88 establishes a default protocol-revenue split of 90% to stYFI stakers and 10% to the DAO Treasury, with the split expressly designated as a DAO-configurable parameter. The reward asset itself may be changed by the DAO-ops multisig, and DAO-ops was delegated implementation authority over the governance-participation APR boost subject to the limits adopted in YIP-88. These are not unilateral powers of the BORG Director. 

There is one additional BORG-specific threshold worth stating: changes to yChad's signer set, yChad's signing threshold, Safe modules, or Guards require bilateral approval by both the DAO and yChad, rather than yChad acting alone. On the yChad side that means the normal 6-of-9 threshold; on the DAO side it means the applicable binding governance vote.

(d) Powers over DevCo

No powers over the DAO exist for the Foundation.

(e) Contract/admin powers

Per YIP-81, the Yearn Multisig (AKA yChad) serves in the Guardian role to steward and protect the Yearn Protocol and its participants. The Guardian role is defined as being able to "nullify a proposal or governance decision but cannot make proposals".

These operational powers include:

1. YFI holders can vote to create, assign, or revoke discrete powers to or from yTeams
2. Any interaction with the YFI token contract, such as to mint YFI or burn the minting keys, remains under the control of YFI holders.
3. Set the standard fee structures in the Yearn Protocol
4. As the Multisig will continue to hold critical powers over the near term, only YFI holders can vote to change its signers
5. Formally ratify or deratify yTeams to control which yTeams can hold delegated powers
6. As yOps has the power to change signers of other yTeams, this is a special power to change the signers of yOps
7. Spend funds from the treasury
8. YFI Holders have the power to propose a YIP on anything not already delegated

Additional information about Governance and Operations can be found here: https://docs.yearn.fi/contributing/governance/governance-and-operations

(f) Current economic arrangements and distribution policies

The Yearn BORG does have a limited governance-approved mechanism for paying its ongoing operating costs. Under YIP-87, initial formation costs and the first two years of the MetaLeX web application/supervisor service were funded from Yearn's pre-existing LeXpunK Builder Defense contribution. Thereafter, recurring expenses are funded from the yChad/Yearn Treasury: approximately $12,000 per year to maintain the Cayman Foundation in good standing, beginning in year two, and approximately $5,000 per year for the non-U.S. professional Director, beginning in year one.

The 1 YFI payments to yChad signers under YIP-79 were separately governance-approved one-time compensation, not an automatic annual or recurring funding mechanism. YIP-79 granted 1 YFI to ongoing signers and a separate 1 YFI retroactive payment to the then-current signers for past service.

Separately, yChad receives, holds, and manages Yearn Treasury assets and protocol fees for the benefit of the Yearn ecosystem, and YIP-88 establishes a default routing of 10% of protocol revenue to the DAO Treasury. Those assets are DAO/Treasury assets and are not a revenue share, fee entitlement, reward stream, or compensation entitlement belonging to the Foundation, its Director, or its signers. Other than the expressly approved operating costs above and separately approved compensation such as YIP-79, there is no standing contractual or programmatic mechanism that automatically directs a percentage of Yearn fees, revenue, rewards, emissions, or token distributions to the Foundation or its contributors as compensation.

(a) Entity

DevCo does not exist

(b) IP ownership & control

DevCo does not exist

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

DevCo does not exist

(d) Powers over Foundation

DevCo does not exist

(e) Contract/admin powers

DevCo does not exist

(f) Current economic arrangements and distribution policies

DevCo does not exist

(a) Planned but not yet executed airdrop

YFI has been in circulation for over 6 years. No airdrops occurred or are planned for.

(b) Executed airdrop

None

(c) No airdrop planned or conducted

None

(a) Date & component affected

1. 2021-02-04, Yearn v1 yDAI vault
2. 2025-11-30, yETH exploit (yETH weighted stableswap pool, different product than a standard Yearn vault)

(b) Exploit vector summary

1. yDAI exploit: The exploiter created exchange-rate imbalances in Curve's 3pool, causing the yDAI vault to deposit and withdraw at unfavorable rates (source: https://github.com/yearn/yearn-security/blob/master/disclosures/2021-02-04.md).
2. yETH exploit: The disclosure states that the attacker forced the pool's internal solver into a divergent state, over-minted yETH LP tokens, drained underlying LSTs, then re-entered the initialization branch and minted approximately 2.3544 × 10^56 yETH LP tokens to drain the yETH/ETH Curve pool (source: https://github.com/yearn/yearn-security/blob/master/disclosures/2025-12-01.md).

(c) Quantified impact

1. yDAI exploit: The disclosure states that 11 million DAI of vault deposits were lost, while 24 million DAI out of 35 million DAI deposits were saved; exploiter profit was estimated at 2.7 million DAI (source: https://github.com/yearn/yearn-security/blob/master/disclosures/2021-02-04.md).
2. yETH exploit: The forum discussion described the incident as affecting yETH depositors, and the security disclosure states that 857.49 pxETH was recovered; the same disclosure states that Yearn v2/v3 vaults and other Yearn products were not affected and that impact was isolated to yETH and direct integrators (source: https://gov.yearn.fi/t/yeth-exploit-discussion; source: https://github.com/yearn/yearn-security/blob/master/disclosures/2025-12-01.md).

(d) Remediation/response taken

1. yDAI exploit: Yearn's security team and multisig acted in roughly 11 minutes, and mitigation included applying setMin(0) to disable deposits into the strategy (source: https://github.com/yearn/yearn-security/blob/master/disclosures/2021-02-04.md).
2. yETH exploit: Publicly described response included coordinated recovery efforts, pro rata redistribution of recovered assets to affected depositors, continued postmortem publication, and ongoing evaluation of governance-constrained remediation options (source: https://gov.yearn.fi/t/yeth-exploit-discussion; source: https://github.com/yearn/yearn-security/blob/master/disclosures/2025-12-01.md).

(e) Current status

1. yDAI exploit: Exploit was detected while it was in progress and a majority of funds at risk were saved thanks to rapid response time (source: https://github.com/yearn/yearn-security/blob/master/disclosures/2021-02-04.md).
2. yETH exploit: Recovery efforts are ongoing and recovered assets are slated for redistribution to affected depositors (source: https://gov.yearn.fi/t/yeth-exploit-discussion; source: https://github.com/yearn/yearn-security/blob/master/disclosures/2025-12-01.md).

(f) References (optional)

1. yDAI: https://github.com/yearn/yearn-security/blob/master/disclosures/2021-02-04.md
2. yETH: https://gov.yearn.fi/t/yeth-exploit-discussion and https://github.com/yearn/yearn-security/blob/master/disclosures/2025-12-01.md

(a) Regulatory, Legal & Tax Risks

YFI, stYFI, and stYFIx token holders need to evaluate their own regulatory and tax position without project-specific public guidance.

(b) Protocol, Technology & Security Risks

Yearn's vault system depends on smart contracts and strategy integrations that can fail in ways that lead to depositor losses. The 2021 yDAI disclosure shows that exchange-rate imbalances in Curve's 3pool were sufficient to make the vault transact at unfavorable rates and lose 11 million DAI before mitigation (source: https://github.com/yearn/yearn-security/blob/master/disclosures/2021-02-04.md). The 2025 yETH disclosure shows a different class of design and implementation risk in which the attacker forced the pool into a divergent state, over-minted LP tokens, and drained assets, while the incident was isolated to yETH and direct integrators rather than Yearn v2/v3 vaults generally (source: https://github.com/yearn/yearn-security/blob/master/disclosures/2025-12-01.md). Yearn focuses resources toward security audits of smart contract code, secure deployment, and operational security work, but those measures do not fully eliminate all exploit risks (source: https://gov.yearn.fi/t/yip-36-system-rewards-as-operational-capital/2311).

(c) Token Economics, Unlocks & Incentive Risks

Yearn's token economics have changed through governance and can change again. Proposal 0 set a 30,000 YFI launch supply, but YIP-57 later minted 6,666 additional YFI for contributor retention and treasury capitalization, showing that supply is governed rather than permanently fixed (source: https://gov.yearn.fi/t/proposal-0-yfi-supply/24; source: https://gov.yearn.fi/t/yip-57-funding-yearns-future/9319). Yearn's public governance framework also leaves YFI holders with power over the token contract, treasury spending, multisig signer changes, and governance delegation, while YIP-65 contemplates governance-linked reward systems built on bought-back YFI and veYFI locking (source: https://docs.yearn.fi/contributing/governance/governance-and-operations/; source: https://gov.yearn.fi/t/yip-65-evolving-yfi-tokenomics/11994). veYFI has now been deprecated and is replaced by stYFI, while the live stYFI interface includes a delegated-voting stYFIx mode and yvUSDC as the Reward Token (source: https://legacy-veyfi.yearn.fi/; source: https://styfi.yearn.fi/). These governance-controlled monetary and reward decisions could affect tokenholder dilution, treasury deployment, and the balance between governance utility and economic rewards. Disclaimer: This Token Transparency Filing is prepared by YFI and is provided for general informational purposes only. Blockworks makes no representations or warranties, express or implied, regarding the accuracy, completeness, or timeliness of the information provided (including any external links to third-party content), and Blockworks is not liable for any errors or omissions in the content or for any actions taken in reliance on this content.