{"investigation":{"slug":"yo-protocol","entity_name":"YO Protocol","trust_score":42,"severity_base":null,"score_modifier":0,"confidence":0.62,"status":"published","content_type":"investigation","summary":"YO Protocol (yo.xyz), operated by YO Labs, is a San Francisco-based multi-chain DeFi yield optimization protocol founded by former Uber and Amazon executives and backed by Paradigm, Coinbase Ventures, and Foundation Capital with $24 million in total funding. Independent security research published in September 2025 identified significant centralization risks, MEV attack vectors, and EIP-4626 compliance gaps that existing audits had not fully addressed. No hacks, exploits, or regulatory actions have been publicly confirmed against the protocol; a claimed ZachXBT flag has not been corroborated by any findable public source as of May 2026.","sections":[{"content":"YO Protocol is a cross-chain DeFi yield optimization platform developed by YO Labs, a San Francisco-based company. The protocol was incubated from Exponential.fi, a DeFi risk-rating platform founded by the same team. Co-founder and CEO Driss Benamour previously led fintech products at Uber, including the Instant Pay feature, and held earlier roles at SmartBiz Loans and Zynga. He holds degrees from ENSAE Paris and Stanford. Co-founder and CIO Mehdi Lebbar launched UberEats in London, led strategy at CloudKitchens, and previously worked at the World Bank and Credit Suisse. Co-founder Greg Jizmagian and additional former Uber and Amazon engineers round out the core team. The protocol operates vaults named yoUSD, yoETH, yoEUR, yoBTC, and yoGOLD across Ethereum, Base, Solana, and Arbitrum. As of May 2026, total value locked (TVL) stands at approximately $42.31 million, with the largest portion ($30.19 million) on Base.","heading":"Background and Corporate Structure","sources":[{"url":"https://www.coindesk.com/web3/2025/12/13/yo-labs-raises-usd10m-to-scale-cross-chain-crypto-yield-optimization-protocol","name":"coindesk.com","type":"other","credibility":3},{"url":"https://gen.xyz/blog/yo-xyz","name":"gen.xyz","type":"other","credibility":3},{"url":"https://defillama.com/protocol/yo-protocol","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"YO Labs has raised a total of $24 million across two rounds. The seed round of $14 million was announced in October 2022 and led by Paradigm, with participation from Haun Ventures, FTX Ventures, Polygon, Solana Ventures, and Circle. The inclusion of FTX Ventures — the venture arm of the exchange that collapsed in November 2022 amid fraud charges against founder Sam Bankman-Fried — is a notable detail in the protocol's early capital structure, though no direct operational impact on YO Labs from FTX's collapse has been publicly documented. A Series A round of $10 million was announced in December 2025, led by Foundation Capital and joined by Coinbase Ventures, Scribble Ventures, and Launchpad Capital. The Series A brought cumulative funding to $24 million.","heading":"Funding and Investor Relationships","sources":[{"url":"https://www.coindesk.com/web3/2025/12/13/yo-labs-raises-usd10m-to-scale-cross-chain-crypto-yield-optimization-protocol","name":"coindesk.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/crypto-vc-firm-paradigm-leads-141310544.html","name":"finance.yahoo.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/174468/ftx-haun-ventures-back-14-million-raise-for-ex-amazon-and-uber-vets-new-defi-platform","name":"theblock.co","type":"other","credibility":3}],"severity":"medium"},{"content":"YO Protocol has commissioned eight audits of its vault and gateway contracts across multiple firms. The yoVault contract was reviewed by Offbeat Security (January 15, 2025), Hunter Security (January 21, 2025), Spearbit (May 29, 2025), Aether Labs (October 23, 2025), Paladin (November 21, 2025), and Aetheryc (December 1, 2025). The yoVault Solana deployment was audited by Zellic (February 24, 2026) and Accretion (April 13, 2026). The yoGateway contract was reviewed by Aether Labs (August 20, 2025) and Paladin (November 21, 2025). The protocol's official documentation states that no critical or high-severity vulnerabilities were identified in the initial Hunter Security and Offbeat Security audits. YO Protocol also maintains a bug bounty program through Immunefi with a maximum payout of $10,000 for critical vulnerabilities, active since May 5, 2025.","heading":"Security Audits","sources":[{"url":"https://docs.yo.xyz/protocol/security-audits","name":"docs.yo.xyz","type":"other","credibility":3},{"url":"https://immunefi.com/bug-bounty/yo-protocol/resources/","name":"immunefi.com","type":"other","credibility":3}],"severity":"medium"},{"content":"An independent security analysis published on September 16, 2025, by researcher Parlan identified four categories of risk not fully captured in the protocol's formal audits. First, centralization and operator control: the AuthUpgradeable access-control contract grants vault operators the ability to change share-to-asset exchange rates during redemption fulfillment, creating a single point of failure if an operator key is compromised. The analyst cited real-world precedents including the $55 million BTCTurk private key compromise and the $13 million Venus Protocol social-engineering incident as analogous risks. Second, MEV and sandwich attacks: the protocol updates underlying vault balances approximately once per day via the onUnderlyingBalanceUpdate() function; Spearbit's own audit confirmed this call 'can be sandwiched,' allowing attackers to front-run balance increases with deposits and back-run with redemptions to capture yield intended for existing depositors. Third, accounting precision errors: the totalPendingAssets variable allegedly overestimates available balances by including fees rather than excluding them, and fee calculations performed twice introduce rounding discrepancies. The analyst cited Bunni protocol's $8.4 million rounding-bug loss as a comparable precedent. Fourth, EIP-4626 compliance gaps: the protocol's requestRedeem function does not support ERC-20 approvals, users cannot cancel pending redemption requests, and maximum withdrawal functions reportedly do not return zero when the vault is paused. The researcher also criticized the $10,000 maximum bug bounty as misaligned with the scale of funds at risk, contrasting it with LayerZero's $15 million and MakerDAO's $10 million ceilings. These concerns are sourced from a single independent research publication; they have not been independently confirmed by additional security firms or on-chain evidence of actual exploitation.","heading":"Independent Security Concerns","sources":[{"url":"https://paragraph.com/@parlan/yo-protocols-unseen-dangers-why-code-audits-arent-enough","name":"paragraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"YO Labs announced tokenomics in January 2026 and opened airdrop claims on February 5, 2026. The total token supply is 1 billion $YO tokens, allocated as follows: 30% to community growth and future rewards, 24% to core contributors, 21.5% to ecosystem development and strategic partnerships, 16.5% to early investors, and 8% as a genesis airdrop to early protocol participants. Combined, team, investor, and ecosystem allocations represent 62% of total supply. The token launched in a non-transferable phase, with transferability to be enabled through a future governance vote. As of May 2026, $YO is not listed for active trading on major exchanges tracked by CoinGecko, and market price data is not available. The airdrop claim window ran until May 6, 2026. Vesting schedules for contributor and investor allocations have not been prominently disclosed in publicly available materials, which represents a transparency gap.","heading":"Tokenomics and $YO Token","sources":[{"url":"https://www.yo.xyz/blog/post/introducing-yo-powering-the-yield-engine-for-crypto","name":"yo.xyz","type":"other","credibility":3},{"url":"https://www.bitrue.com/blog/yo-token-tokenomics-claiming-guide","name":"bitrue.com","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560605175106","name":"bitget.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/yo","name":"coingecko.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Context provided to AVOID.NET indicated that on-chain investigator ZachXBT had flagged YO Protocol. As of May 27, 2026, no public post, Telegram message, X (Twitter) thread, or third-party news article corroborating a ZachXBT investigation or flag directed at YO Protocol (yo.xyz) has been located through web search. ZachXBT joined Paradigm in February 2025 as an incident response advisor; Paradigm separately led YO Labs' seed round, which is a potential relationship worth noting but does not itself constitute a conflict or an allegation. The claimed flag should be treated as unverified until a primary-source citation is provided. Absent such a citation, the initial trust score of 30/100 assigned to this claim cannot be independently substantiated.","heading":"ZachXBT Flag — Status: Unverified","sources":[{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3}],"severity":"medium"},{"content":"YO Protocol's official documentation acknowledges six risk categories: smart contract risk (bugs in YO's code or underlying protocols despite audits), protocol risk (oracle manipulation, bad debt, or governance exploits in third-party DeFi protocols YO deploys into), chain risk (outages or congestion on Ethereum, Base, Solana, or Arbitrum), liquidity risk (withdrawal delays of up to 24 hours during periods of high redemption demand), strategy risk (underperformance or losses due to market volatility or execution lag), and bridging risk (cross-chain asset transfer failures). The protocol states it employs a DeFi Graph that monitors dependencies up to five levels deep and can trigger automated withdrawals if an underlying protocol fails.","heading":"Protocol Risks — Official Disclosures","sources":[{"url":"https://docs.yo.xyz/protocol/risks","name":"docs.yo.xyz","type":"other","credibility":3}],"severity":"medium"},{"content":"As of December 2025, YO Protocol reported that none of its vaults had been impacted by hacks or exploits since launch, with over $80 million in historical TVL at peak, $2.67 million in cumulative yield distributed to users, and approximately 15,000 unique depositors. Current TVL as reported by DeFiLlama stands at $42.31 million as of May 2026, representing a significant decline from reported peak TVL. Annualized protocol fees are approximately $787,132. The protocol reports zero fee extraction from users, with all yield flowing to depositors.","heading":"Operational Track Record","sources":[{"url":"https://www.coindesk.com/web3/2025/12/13/yo-labs-raises-usd10m-to-scale-cross-chain-crypto-yield-optimization-protocol","name":"coindesk.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/yo-protocol","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-10","event":"Exponential (later rebranded to YO Labs) raises $14 million seed round led by Paradigm, with FTX Ventures, Haun Ventures, Polygon, Solana Ventures, and Circle participating.","source":"","date_original":"2022-10-01"},{"date":"2022-11-11","event":"FTX, a seed-round investor via FTX Ventures, collapses and files for bankruptcy amid fraud charges against founder Sam Bankman-Fried.","source":""},{"date":"2024-07-11","event":"Exponential.fi launches an all-in-one DeFi investing platform, setting the foundation for the YO Protocol rebrand.","source":""},{"date":"2025-01-15","event":"Offbeat Security completes audit of the yoVault contract, finding no critical or high-severity vulnerabilities.","source":""},{"date":"2025-01-21","event":"Hunter Security completes audit of the yoVault contract.","source":""},{"date":"2025-05-05","event":"YO Protocol's Immunefi bug bounty program goes live with a $10,000 maximum bounty for critical vulnerabilities.","source":""},{"date":"2025-05-29","event":"Spearbit completes audit of yoVault; audit confirms the onUnderlyingBalanceUpdate function can be sandwiched by MEV bots.","source":""},{"date":"2025-09-16","event":"Independent researcher Parlan publishes 'Yo Protocol's Unseen Dangers: Why Code Audits Aren't Enough,' identifying centralization, MEV, accounting, and EIP-4626 compliance risks.","source":""},{"date":"2025-12-13","event":"YO Labs raises $10 million Series A led by Foundation Capital, with Coinbase Ventures, Scribble Ventures, and Launchpad Capital participating, bringing total funding to $24 million.","source":""},{"date":"2026-01-30","event":"YO Protocol announces $YO token and tokenomics: 1 billion total supply, 8% genesis airdrop, 24% to core contributors, 16.5% to investors.","source":""},{"date":"2026-02-05","event":"Genesis airdrop claim portal opens for early depositors and points program participants.","source":""},{"date":"2026-02-24","event":"Zellic completes security audit of the yoVault Solana deployment.","source":""},{"date":"2026-04-13","event":"Accretion completes second audit of the yoVault Solana deployment.","source":""},{"date":"2026-05-06","event":"Genesis airdrop claim window closes.","source":""}],"sources_used":[{"url":"https://www.coindesk.com/web3/2025/12/13/yo-labs-raises-usd10m-to-scale-cross-chain-crypto-yield-optimization-protocol","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260726222849/https://www.coindesk.com/web3/2025/12/13/yo-labs-raises-usd10m-to-scale-cross-chain-crypto-yield-optimization-protocol","credibility":3,"archive_timestamp":"2026-07-26T22:28:49+00:00"},{"url":"https://gen.xyz/blog/yo-xyz","name":"gen.xyz","type":"other","archive_url":"http://web.archive.org/web/20251006142102/https://gen.xyz/blog/yo-xyz","credibility":3,"archive_timestamp":"2025-10-06T14:21:02+00:00"},{"url":"https://defillama.com/protocol/yo-protocol","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20260711162708/https://defillama.com/protocol/yo-protocol","credibility":3,"archive_timestamp":"2026-07-11T16:27:08+00:00"},{"url":"https://finance.yahoo.com/news/crypto-vc-firm-paradigm-leads-141310544.html","name":"finance.yahoo.com","type":"other","archive_url":"https://web.archive.org/web/20260829033020/https://finance.yahoo.com/news/crypto-vc-firm-paradigm-leads-141310544.html","credibility":3,"archive_timestamp":"2026-08-29T03:30:20+00:00"},{"url":"https://www.theblock.co/post/174468/ftx-haun-ventures-back-14-million-raise-for-ex-amazon-and-uber-vets-new-defi-platform","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://docs.yo.xyz/protocol/security-audits","name":"docs.yo.xyz","type":"other","archive_url":"http://web.archive.org/web/20260721151058/https://docs.yo.xyz/protocol/security-audits","credibility":3,"archive_timestamp":"2026-07-21T15:10:58+00:00"},{"url":"https://immunefi.com/bug-bounty/yo-protocol/resources/","name":"immunefi.com","type":"other","archive_url":"http://web.archive.org/web/20260623111934/https://immunefi.com/bug-bounty/yo-protocol/resources/","credibility":3,"archive_timestamp":"2026-06-23T11:19:34+00:00"},{"url":"https://paragraph.com/@parlan/yo-protocols-unseen-dangers-why-code-audits-arent-enough","name":"paragraph.com","type":"other","archive_url":"http://web.archive.org/web/20260415005728/https://paragraph.com/@parlan/yo-protocols-unseen-dangers-why-code-audits-arent-enough","credibility":3,"archive_timestamp":"2026-04-15T00:57:28+00:00"},{"url":"https://www.yo.xyz/blog/post/introducing-yo-powering-the-yield-engine-for-crypto","name":"yo.xyz","type":"other","archive_url":"http://web.archive.org/web/20260414062008/https://www.yo.xyz/blog/post/introducing-yo-powering-the-yield-engine-for-crypto","credibility":3,"archive_timestamp":"2026-04-14T06:20:08+00:00"},{"url":"https://www.bitrue.com/blog/yo-token-tokenomics-claiming-guide","name":"bitrue.com","type":"other","archive_url":"http://web.archive.org/web/20260830073226/https://www.bitrue.com/blog/yo-token-tokenomics-claiming-guide","credibility":3,"archive_timestamp":"2026-08-30T07:32:26+00:00"},{"url":"https://www.bitget.com/news/detail/12560605175106","name":"bitget.com","type":"other","archive_url":"https://web.archive.org/web/20260829083626/https://www.bitget.com/news/detail/12560605175106","credibility":3,"archive_timestamp":"2026-08-29T08:36:26+00:00"},{"url":"https://www.coingecko.com/en/coins/yo","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20260711162709/https://www.coingecko.com/en/coins/yo","credibility":3,"archive_timestamp":"2026-07-11T16:27:09+00:00"},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"},{"url":"https://docs.yo.xyz/protocol/risks","name":"docs.yo.xyz","type":"other","archive_url":"http://web.archive.org/web/20260721151058/https://docs.yo.xyz/protocol/risks","credibility":3,"archive_timestamp":"2026-07-21T15:10:58+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:19.184716+00:00","updated_at":"2026-08-30T12:05:00.259786+00:00"}}