{"investigation":{"slug":"yield-protocol","entity_name":"Yield Protocol","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Yield Protocol was a decentralized finance protocol offering fixed-rate, fixed-term borrowing and lending on Ethereum and Arbitrum, launched in October 2020 and funded by Paradigm. It suffered multiple security incidents including collateral damage from the March 2023 Euler Finance hack and a critical smart contract vulnerability patched via Immunefi in April 2023, before announcing a full wind-down in October 2023 citing insufficient demand and regulatory pressure. After official operations ceased in December 2023, abandoned smart contracts on Arbitrum were exploited in April 2024 for approximately $181,000 via a flash loan attack on pool balance discrepancies.","sections":[{"content":"Yield Protocol was a DeFi lending protocol that brought collateralized fixed-rate, fixed-term borrowing and lending to decentralized finance. Launched in October 2020 on Ethereum and later expanded to Arbitrum, the protocol used a zero-coupon bond model represented by fyTokens — future yield tokens redeemable 1-to-1 for a base asset at a fixed maturity date. Borrowers could deposit ERC-20 collateral and select from available maturity dates, locking in a fixed rate until maturity. The protocol was co-founded by Allan Niemerg (formerly Head of Research and Investments at DRW/Cumberland) and Alberto Cuesta Canada, with early involvement from Paradigm's Dan Robinson, who helped incubate the project. Yield Protocol was based in Chicago, Illinois and incorporated as a Series A company. At its April 2022 peak, the protocol held over $22 million in total value locked across Ethereum and Arbitrum.","heading":"Protocol Overview","sources":[{"url":"https://medium.com/financial-narratives/understanding-the-yield-protocol-6e4ecc688bec","name":"medium.com","type":"other","credibility":3},{"url":"https://exponential.fi/protocols/yield-protocol/aa11da42-a185-4aec-8bb0-9b825a170e92","name":"exponential.fi","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/10/04/defi-project-yield-protocol-to-wind-down-by-years-end","name":"coindesk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In June 2021, Yield Protocol closed a $10 million Series A funding round led by Paradigm, building on a prior seed investment and incubation relationship with the Paradigm team. Additional investors in the round included Framework Ventures, Symbolic Capital Partners, CMS Holdings, Variant, and the DeFi Alliance. The capital was designated to fuel growth ahead of the Version 2 launch, which was intended to add new collateral and borrowable asset types and improve gas efficiency. The Paradigm involvement — including co-founder Dan Robinson's direct participation in the protocol's design — gave the project significant early credibility within the Ethereum DeFi ecosystem.","heading":"Funding and Investors","sources":[{"url":"https://medium.com/yield-protocol/yield-closes-10mm-funding-round-led-by-paradigm-7e456e72b5e3","name":"medium.com","type":"other","credibility":3},{"url":"https://www.theblock.co/linked/109352/yield-team-raises-10-million-to-build-out-defi-bond-market","name":"theblock.co","type":"other","credibility":3},{"url":"https://decrypt.co/74300/defi-yield-fixed-income","name":"decrypt.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Yield Protocol experienced three distinct security events over its operational life.\n\nFirst, in March 2023, the Euler Finance flash loan attack — which drained approximately $197 million from the Euler protocol — caused collateral damage to Yield Protocol. Yield held assets in Euler-based liquidity pools and suffered losses estimated at under $1.5 million. These funds were ultimately recovered by July 2023 after the Euler hacker, who identified as 'Jacob,' returned the stolen funds following on-chain negotiations.\n\nSecond, on April 28, 2023, a whitehat researcher identified as Paludo0x responsibly disclosed a critical logic error in Yield Protocol's strategy contract burn() function via Immunefi's bug bounty program. The vulnerability allowed an attacker to manipulate LP token calculations by artificially inflating the contract's pool token balance through direct transfers. An attacker could exploit the function's reliance on pool.balanceOf(address(this)) — a value susceptible to manipulation — to drain base tokens from pools. Approximately $950,000 in user funds across Arbitrum and Ethereum pools were at risk. The team patched the vulnerability by replacing the live balance call with a cached value (poolCached_). No user funds were lost. The whitehat received a bounty of $95,000 USDC, equal to 10% of funds at risk.\n\nThird and most critically, on April 30, 2024 — months after the protocol had ceased operations — an attacker exploited a discrepancy between pool token balance and total supply in the abandoned Arbitrum smart contracts using flash-loaned assets. PeckShield first flagged the incident on-chain; CertiK subsequently confirmed the attack mechanics. Approximately $181,000 in crypto assets were drained from residual liquidity pools. Because the protocol had shut down and was no longer actively maintained, there was no team response or remediation.","heading":"Security Incidents","sources":[{"url":"https://immunefi.com/blog/bug-fix-reviews/yield-protocol-logic-error/","name":"immunefi.com","type":"other","credibility":3},{"url":"https://medium.com/immunefi/yield-protocol-logic-error-bugfix-review-7b86741e6f50","name":"medium.com","type":"other","credibility":3},{"url":"https://coincodecap.com/defunct-yield-protocol-faces-smart-contract-exploit-over-180k-drained-report","name":"coincodecap.com","type":"other","credibility":3},{"url":"https://www.thecoinrepublic.com/2024/04/30/crypto-scam-hacker-steals-181k-from-defunct-defi-protocol/","name":"thecoinrepublic.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/euler-attack-causes-locked-tokens-losses-in-11-defi-protocols-including-balancer","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On October 4, 2023, Yield Protocol published a wind-down announcement stating that all borrowing and lending operations would cease by December 29, 2023, when the final December series matured. The team cited two primary reasons: insufficient sustainable demand for fixed-rate borrowing and a deteriorating regulatory environment. The announcement specifically referenced U.S. regulatory uncertainty as well as increasing requirements in Europe and the United Kingdom as factors making continued operation unviable.\n\nAt the time of announcement, TVL had declined from an April 2022 peak of over $22 million to approximately $2 million — a decline of roughly 91%. The team indicated it would continue providing support until the December series maturity and support withdrawals for a limited period afterward. Users were directed to Discord and the @yield Twitter account for guidance on exiting positions.\n\nOfficial support for the protocol ended on February 2, 2024. Despite this, smart contract code remained deployed on Arbitrum with residual liquidity, creating the attack surface that was later exploited in April 2024.","heading":"Protocol Shutdown and Wind-Down","sources":[{"url":"https://yield-protocol.medium.com/winding-down-yield-protocol-0974b38066cc","name":"yield-protocol.medium.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/10/04/defi-project-yield-protocol-to-wind-down-by-years-end","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/yield-protocol-permanently-wind-down-december-2023","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://blockworks.co/news/yield-protocol-defi-project-shutter-fixed-rate-platform","name":"blockworks.co","type":"other","credibility":3},{"url":"https://invezz.com/news/2023/10/04/yield-protocol-winds-up-operations-cites-deteriorated-demand-regulatory-woes/","name":"invezz.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The April 2024 exploit illustrates a broader risk pattern in DeFi: protocols that shut down without fully draining or disabling their smart contracts leave residual liquidity vulnerable to exploitation. In Yield Protocol's case, the team ceased active maintenance after February 2, 2024, but deployed contracts on Arbitrum continued to hold user funds. Because there was no active team to respond to the April 30, 2024 exploit, the $181,000 drained was unrecoverable. CertiK's post-mortem attributed the vulnerability to the same class of pool-balance manipulation previously patched in April 2023, suggesting that not all contract variants received the fix or that analogous vulnerabilities existed in related contracts. The incident is cited in DeFi security literature as a cautionary example of inadequate sunset procedures for permissionless smart contract protocols.","heading":"Abandoned Contract Risk","sources":[{"url":"https://coincodecap.com/defunct-yield-protocol-faces-smart-contract-exploit-over-180k-drained-report","name":"coincodecap.com","type":"other","credibility":3},{"url":"https://www.thecoinrepublic.com/2024/04/30/crypto-scam-hacker-steals-181k-from-defunct-defi-protocol/","name":"thecoinrepublic.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Yield Protocol has been flagged by on-chain investigator ZachXBT. The specific basis of ZachXBT's flag has not been independently detailed in publicly available posts reviewed for this investigation. Given the timing, the flag is likely related to one or more of the following: the April 2024 post-shutdown exploit, the Euler Finance collateral losses, or the protocol's pattern of security vulnerabilities across its operational lifecycle. ZachXBT is recognized as a credible Tier 2 source for DeFi incident reporting, though the absence of a specific detailed post reduces the confidence weight of this particular flag.","heading":"ZachXBT Flag","sources":[],"severity":"medium"},{"content":"Yield Protocol's wind-down announcement in October 2023 explicitly cited U.S. and European regulatory pressure as a contributing factor. The protocol did not identify any specific enforcement actions, investigations, or notices from regulatory bodies such as the SEC or CFTC in its public communications. No SEC, CFTC, DOJ, or OFAC enforcement actions against Yield Protocol, its founders, or its corporate entity have been identified in searches of public regulatory records as of the date of this investigation. The regulatory concern cited appears to have been prospective — related to anticipated compliance costs and jurisdictional uncertainty in the post-2023 regulatory environment — rather than the result of an active enforcement proceeding.","heading":"Regulatory and Compliance Context","sources":[{"url":"https://yield-protocol.medium.com/winding-down-yield-protocol-0974b38066cc","name":"yield-protocol.medium.com","type":"other","credibility":3},{"url":"https://invezz.com/news/2023/10/04/yield-protocol-winds-up-operations-cites-deteriorated-demand-regulatory-woes/","name":"invezz.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-10","event":"Yield Protocol launches on Ethereum, offering fixed-rate collateralized borrowing and lending via fyTokens.","source":"","date_original":"2020-10-01"},{"date":"2021-06-23","event":"Yield Protocol closes a $10 million Series A funding round led by Paradigm, with participation from Framework Ventures, Symbolic Capital Partners, CMS Holdings, Variant, and the DeFi Alliance.","source":""},{"date":"2022-04","event":"Yield Protocol reaches its peak total value locked of over $22 million.","source":"","date_original":"2022-04-01"},{"date":"2023-03-13","event":"Euler Finance suffers a $197 million flash loan exploit. Yield Protocol, which held assets in Euler-based pools, suffers collateral losses estimated under $1.5 million.","source":""},{"date":"2023-04-28","event":"Whitehat Paludo0x responsibly discloses a critical logic error in Yield Protocol's strategy contract burn() function via Immunefi. Approximately $950,000 in funds protected. Bounty of $95,000 USDC awarded.","source":""},{"date":"2023-07","event":"Yield Protocol confirms full recovery of funds lost in the March 2023 Euler Finance hack, after the Euler hacker returned stolen assets.","source":"","date_original":"2023-07-01"},{"date":"2023-10-04","event":"Yield Protocol announces permanent wind-down by end of December 2023, citing insufficient demand for fixed-rate borrowing and regulatory pressures in the U.S., Europe, and U.K.","source":""},{"date":"2023-12-29","event":"Yield Protocol's final December series matures. All borrowing and lending operations officially cease.","source":""},{"date":"2024-02-02","event":"Yield Protocol formally ends all official support.","source":""},{"date":"2024-04-30","event":"An attacker exploits abandoned Yield Protocol smart contracts on Arbitrum via a flash loan attack targeting a discrepancy between pool token balance and total supply. Approximately $181,000 drained. PeckShield first alerts; CertiK confirms. No team response due to protocol being defunct.","source":""}],"sources_used":[{"url":"https://medium.com/financial-narratives/understanding-the-yield-protocol-6e4ecc688bec","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://exponential.fi/protocols/yield-protocol/aa11da42-a185-4aec-8bb0-9b825a170e92","name":"exponential.fi","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.coindesk.com/business/2023/10/04/defi-project-yield-protocol-to-wind-down-by-years-end","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://medium.com/yield-protocol/yield-closes-10mm-funding-round-led-by-paradigm-7e456e72b5e3","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20250911072015/https://medium.com/yield-protocol/yield-closes-10mm-funding-round-led-by-paradigm-7e456e72b5e3","credibility":3,"archive_timestamp":"2025-09-11T07:20:15+00:00"},{"url":"https://www.theblock.co/linked/109352/yield-team-raises-10-million-to-build-out-defi-bond-market","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://decrypt.co/74300/defi-yield-fixed-income","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260412221919/https://decrypt.co/74300/defi-yield-fixed-income","credibility":3,"archive_timestamp":"2026-04-12T22:19:19+00:00"},{"url":"https://immunefi.com/blog/bug-fix-reviews/yield-protocol-logic-error/","name":"immunefi.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://medium.com/immunefi/yield-protocol-logic-error-bugfix-review-7b86741e6f50","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20251127161042/https://medium.com/immunefi/yield-protocol-logic-error-bugfix-review-7b86741e6f50","credibility":3,"archive_timestamp":"2025-11-27T16:10:42+00:00"},{"url":"https://coincodecap.com/defunct-yield-protocol-faces-smart-contract-exploit-over-180k-drained-report","name":"coincodecap.com","type":"other","archive_url":"http://web.archive.org/web/20260421071415/https://coincodecap.com/defunct-yield-protocol-faces-smart-contract-exploit-over-180k-drained-report","credibility":3,"archive_timestamp":"2026-04-21T07:14:15+00:00"},{"url":"https://www.thecoinrepublic.com/2024/04/30/crypto-scam-hacker-steals-181k-from-defunct-defi-protocol/","name":"thecoinrepublic.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cointelegraph.com/news/euler-attack-causes-locked-tokens-losses-in-11-defi-protocols-including-balancer","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260417003626/https://cointelegraph.com/news/euler-attack-causes-locked-tokens-losses-in-11-defi-protocols-including-balancer","credibility":3,"archive_timestamp":"2026-04-17T00:36:26+00:00"},{"url":"https://yield-protocol.medium.com/winding-down-yield-protocol-0974b38066cc","name":"yield-protocol.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251016165611/https://yield-protocol.medium.com/winding-down-yield-protocol-0974b38066cc","credibility":3,"archive_timestamp":"2025-10-16T16:56:11+00:00"},{"url":"https://cointelegraph.com/news/yield-protocol-permanently-wind-down-december-2023","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260829234646/https://cointelegraph.com/news/yield-protocol-permanently-wind-down-december-2023","credibility":3,"archive_timestamp":"2026-08-29T23:46:46+00:00"},{"url":"https://blockworks.co/news/yield-protocol-defi-project-shutter-fixed-rate-platform","name":"blockworks.co","type":"other","archive_url":"http://web.archive.org/web/20251112063211/https://blockworks.co/news/yield-protocol-defi-project-shutter-fixed-rate-platform","credibility":3,"archive_timestamp":"2025-11-12T06:32:11+00:00"},{"url":"https://invezz.com/news/2023/10/04/yield-protocol-winds-up-operations-cites-deteriorated-demand-regulatory-woes/","name":"invezz.com","type":"other","archive_url":null,"credibility":3,"archive_error":"forbiddenaccess","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:32.998627+00:00","updated_at":"2026-08-30T01:16:27.418361+00:00"}}