Risk vs. Reward: Optimizing Yield While Prioritizing Safety

Transcript

Louder? Okay, there we go. Uh hello everyone. Thank you for joining. Uh today I will be discussing risk versus reward. Uh some of you might have known about some events recently that involved some risks. So, this feels rather timely. But, there's always risk in DeFi. So, let's get into it. Uh really quick, world's fastest intro. I'm engineer. I do stuff with code. I am at Yearn solutions architect. Been at some other projects in the past. But, what we're here for today is talking about vaults, risk versus reward. Not all vaults are equal. You might think high APY is the world's greatest thing since sliced bread, but there is more to it than just the APY

number. Uh so, first we're going to discuss why vaults matter. Why should you care about vaults? What are the differences in designs? And then we'll get into the risks because there's a lot to get into with risk and it's hard to see at first glance. So, first, why vaults matter? To understand this, we need to do a bit of a a history lesson. We're going to go way back in time. Uh first of all, at a high level, you can just think of assets that are in vaults are growing. And when assets are growing, this is a good thing for the people holding the assets. When the asset is not growing, it's just stationary. It's not being used. It's capital inefficient.

So, if we go way back to prehistoric times in DeFi, which is 6 years ago, if you can believe it. Like, I didn't even know people humans were alive 6 years ago. Uh but, DeFi summer, there were crazy yields, like 100% 1,000% APYs. Funds were always moved manually. Automation was just a a vision. There were rug pulls everywhere. You had to be careful of any code that you saw on the blockchain. It was It was a dangerous, wild west type place. The code had bugs everywhere. The prices of new tokens were down only after launch.

And uh you really had to stay on top of what was happening. People were waking up in the middle of the night to move their funds. Uh crazy times. And Yearn started with the vision of how do we automate this? Because this is hard. This is very easy to make mistakes with. So, how do we make it easier for users? Before vaults really existed as a concept, what happened in these prehistoric times, 6 years ago, is that users would deposit assets. Maybe they would get multiple tokens as rewards.

They would need to convert the tokens back to the token they wanted. It was a whole process. But with vaults, you can think of it as just put your money in, and later you take more money out. It's that straightforward. And this simplicity in the user experience is really important to greater adoption and really to anyone in the space. No one wants to have a terrible user experience. In late 2021, we had the first vault standard. You might have heard of ERC-4626.

And this is where we really entered, let's say, the vault revolution, which made it very easy to use this idea of a vault. Uh if you think of uh this standard as just a way to make it easier to store your money, and a way to make it easier to integrate with other places where money or assets are stored. So, with this new concept of this vault standard, you can have a vault in a vault in a vault. Uh there are all these new ideas that are very easy to plug and play. Uh we actually used to refer to concepts like this as DeFi money Legos, where it's very easy to attach these different blocks together. And this vault standard is one part of that.

Uh don't look at the details here, but this is just another view of these DeFi money Legos. You can just sort of draw some arrows, have very easy interfaces between different vaults, and they all connect together. And this is how Yearn V3 works, but I'm not getting into it now. But now in 2026, it's almost too easy. Everyone has vaults. You get a vault, you get a vault. Do you want a vault? You get three. So, vaults are just everywhere in this day and age. So, things have really changed since the prehistoric 2020 days. But, even though everyone does vaults and everyone offers yield, and everyone makes different claims about these vaults, it's it's not all sunshine and flowers.

We used to have rug pulls back in 2020, and now we have bad debt. It sounds a lot more technical, but the problem remains. Uh we used to have tokens dumping in price, and now we have things like inflated or inaccurate APY numbers. It's a bit more of a hidden problem, but we still have problems. Uh we used to have scam projects everywhere. Now we have these hidden off-chain yield sources, which could be shady projects, but we really don't know. So, we've made vaults easier to use, but we haven't solved the underlying problems. And we still need individuals to be aware, where is their money going? Do you know where your money is? If you put your money on chain

and you don't actually know where it is, there could be problems. So, now we get into the different designs for these vaults. Can anyone spot the difference here? We've got two ERC-4626 vaults. Are they the same? Well, this is exactly the problem that we have in DeFi today because there are vaults everywhere, but are they the same? What's different about them? Unfortunately, there's no easy answer, and it does require some level of knowledge to dig into. And today I will be trying to explain some of these differences, what you can look for, and how to differentiate these different

vaults. So, this is a long list, but everyone putting their money somewhere should be asking a few basic questions. If you're going to be getting yield, interest, where is it coming from? If you're giving, let's say for example, the US government your money, and you're expecting interest, well, it's partially because they just print more dollars. If you're putting your money in a DeFi protocol that's fully on chain, in theory, you should be able to track where is this extra money coming from? Is it coming from lending? Is it coming from some off-chain yield source? There are many answers to this question, but you should understand where is the yield coming from. If you don't have an answer

to this question, there could be problems. Maybe not, but there could be. The next question is, if you know where this yield is coming from, is it safe? Because if you see you're getting 1,000% APY per year returns, this sounds amazing, but is it safe? Most likely not. If you're seeing a 1,000 APY, I'm sorry to break your bubble. Uh this is a bit unrealistic to be safe. Um but we need to be asking these questions. Next, are the smart contracts secure? I think in this day and age, everyone has heard about hacks.

Hacks are not a new thing in DeFi, which is very unfortunate, and this brings up a very key point, which is that when we discuss risk in DeFi, it's different than risk in traditional finance. In traditional finance, if we talk about a risky investment, you might lose 10% of your money, 20% of your money because the price went down. You bought a house, now it's down 20%. That's very sad. But in DeFi, you have the chance for 100% losses. This is very different risk that we have to consider.

And so the entire mindset about risk should be a lot more focused on what are these risks? Because if I have the possibility of 100% loss, that's a lot more devastating than a 10% loss. 10% you can come back from this. 100% no chance. It's gone. So this is something that still I think is scaring away a lot of people from DeFi and even for average users, it probably should be a a greater concern than it is. Just because the the meaning of risk in this space is different than risk in other financial circles. Um let's hope we can change that. Uh fourth point here, uh what dependencies are

there? Are you depending on someone else's code? Because if you're putting your money here, but it depends on 10 other people, then are you going to trust all these 10 other people? Are these trustworthy people? Are they not? Uh a valid question to ask. Additionally, who governs the vault? Who owns owns what's going on? What control do they have? And lastly, but very importantly, can you withdraw quickly? I think we saw recently, I won't name names, but there have been incidents where withdrawing has gotten uh difficult in in harsh times uh when an incident happens. So this is worth asking. Like if there is a big 10x

leverage loop, maybe it's hard to get out of this loop quickly, and this can cause problems. So, these are simply questions. I don't have perfect answers. I'm sorry, I wish I did. Um but, I really want to draw awareness to these questions because not all vaults are equal, and these are some differences you will see in the designs. Um I will also say sometimes you will find vaults where when you look closely, the governance can just take all the money. I'm not saying that governance will take all the money, but based on the rules of what the code does, it's possible for for the owner of the vault to just take the money. So, is this where you you want to put your money? This is totally up to you. You, of course, have the freedom to choose

where you put your money. Um but, there is risk. And a small shill at the bottom, this is a tool I made for uh checking multi-sig security, but we're not talking about that here. But, let's talk about real vaults. Stuff that you can find on chain. Like, what are actual differences that you will find? Let's talk about Athena. This protocol still has billions of dollars in it. Got quite famous maybe a year or two ago, and they really historically made their yield, which used to be double-digit yield, maybe over 10%, through delta-neutral perps positions.

So, they like have a uh buy and a sell position, and basically they make yield based on this uh funding rate. But, they switched this. They switched this, and I think a lot of the billions of dollars invested in this protocol are not aware that where their money is has changed. And now, what used to be almost 100% of where the funds were is now 11%, and instead they're using DeFi lending and liquid stables. Uh I don't know. Show of hands, how many people knew about Athena before this?

Quite a few. Okay. And how many knew that now they're not doing perps and funding rate? Okay, there are a few hands, so props to those of you who are educated. Um this was actually news to me when I first heard it a couple months ago, but it's all on the Athena website. So, this is not hidden as long as you look for it. But not many people look for it. So, that's the important thing is to ask these questions to find information and understand where is your money. Let's talk about another vault protocol. All I want to point out here is that even though it's probably a bit hard to see, uh basically all the funds of this vault are off-chain.

So, you put your money into this vault and then it just sort of disappears and you can't really track it except for this website. And you just sort of have to trust that your money is making money off-chain and maybe it's actually great returns. Maybe you are perfectly happy with this because it looks very much like a traditional bank account, um but maybe you want to see your money on-chain. And this is just a choice for users to decide, do you want to know where your money is or do you trust this off-chain yield source? I mean, maybe you know the owner of this bank that's off-chain and you trust them, but uh for me personally, I really prefer these on-chain sources that you can track and verify.

Uh last but not least, just showing some cool charts from Yearn because we really like to focus on on-chain, fully on-chain yield sources. Uh so, you can track everything. You can track where your money is now. It's invested in these strategies. You can go to the contract, you can see it. You can even see when we change the allocation between strategies, where has the money gone? It went from this contract to this contract. We have the timestamp, you can follow everything. And so, again, this might not be for everyone. If you don't like dealing with on-chain data, maybe it's not your favorite, but everything is verifiable. And this is a more automated approach than, let's say a manually controlled off-chain vault. So, vaults might look similar, but when you

look behind the scenes, there are there are differences. So, that was a lot, and I just want to do a quick summary here because the number of decisions you can make when you create a vault, there's a lot. Uh you can have manual asset allocation, or you can have automation. So, decide where the money is being moved manually or automate it with some algorithm or bots. Uh how frequently the money moves. Sometimes you want to move money several times a day if you're chasing the ideal yield, but if you move the money too much, maybe you get slippage, maybe you waste gas. There's a lot of decisions here to be made.

Every team has a different approach to risk analysis. Some teams really really care about doing a deep dive on the code that they integrate with, and others are trusting teams that they know, different approaches. Uh governments, this is a huge topic on itself, won't get into that. Um protocol integrations, which protocols do you trust? And lastly, I've discussed this before, how do you withdraw? Cuz when when things get bad, you might want to withdraw, and when there's this crazy edge case and you can't withdraw, then panic sets in.

As some here may know. Let's talk about risk. Who likes high APY? No hands? Come on. Okay, I got the risk-aware crowd in the room. Um so, yeah, high APYs are nice, but there's always some risk with high yield. There's no free lunch, sorry to say. Now, in normal market conditions, a lot of these things you see on chain probably work fine. Like they're working right now today, well, I haven't checked Twitter. Is today a normal day? I hope so. But last I checked, it's normal market conditions more or less today.

But the problems always come in these edge cases. When there's a hack, when there's a depeg, when things go really wrong, then we see which protocol is designed to last. And it would be great if we could find this out before these crazy scenarios. Unfortunately, I haven't found a good solution for that besides asking a ton of questions. So it's really these scenarios that we have to watch out for. Because again, it's not a 10% loss risk that we're talking about. It's the possibility of a 100% loss. That's the risk we are worried about.

So, this is a two question test from Vitalik. It's not vault specific, but it is relevant. So if you want to keep like a very simple quiz when you're looking at a vault, like what are the risks here? You can ask, can the protocol wind down? Now this was relevant recently with the help down incident where we saw many people were looping and leveraged. And to undo these loops, you have a long delay. If you want to loop something 10 times, it might be easier to get into this position, but then to sell it, you have the total opposite where you have to wait weeks to reverse the position.

So understanding this wind down process, again, like can you actually get your money? If your money is over there, but you can't get it, then it's useless. It's like traditional finance where your money is in the bank, but the bank's bankrupt, so there's no money. And then secondly, how does a stablecoin maintain its peg? Now the equivalent for vaults is probably where does the yield come from or how are the assets invested? But simply two questions can help you avoid some disastrous situations. And if I recall this post was after the Luna incident.

So some questions you can ask for vaults. Again, there are many questions, but how centralized is it? Can the governance theoretically rug the money? Can the asset movement be tracked on chain? This might be user preference. If you don't like diving into the data on chain, that's fine. How are the assets managed? Do you trust the team moving the assets around or do they have a bad or relatively short track record? And how liquid are the assets? Again, getting back to withdrawing the assets, can you withdraw? If you can't withdraw, what's the point? Like you just put your money somewhere and it's in a black box.

Again, I wish I had easy answers. I I wish I could like present you this website. I'm like, "If you just use my fancy tool, it'll work." Um but I'm actually going to pitch for anyone doing hackathons, uh Vault Beat would be an amazing idea where you compare these different vaults. Now, the closest I know of is Vaults FYI, which is really just comparing the yield on vaults. It doesn't compare the design decisions. Um but you might be surprised to know that the APY numbers you see on different UIs are calculated in different ways and sometimes are inaccurate.

So, having a standardized way to compare APYs is actually very useful because then you get an apples-to-apples comparison of is the the APY better here versus there? Um I will say it's of course very difficult to predict future APYs, so that's an entirely different question. But anyway, just saying that there is no good website for this. If you're a builder, consider it. Uh but you can at least compare APYs. Let's talk about uh incident that happened late last year. Uh there was this unfortunate incident where I think uh 1 2 million-dollar loss happened and this is related to one risk factor, which is who do you trust? What are the

dependencies here? In this case, it was an Oracle issue. Um I just like to say that if you look at the green line, the green line is the price that the Oracle was reporting. Over we here we have one, we have a hundred, we have a thousand. It's a logarithmic scale, and you can see a few points where there are giant green spikes where the price goes from one to about a million. Now, I'm pretty sure anyone would look at this and be like, "We have a problem here." The question is how how would you even design a system and think this is a normal result? Like how would a price go from one to a million and we think this is normal. This is fine. Especially for assets that are

pegged. We are not talking about like Bitcoin versus dollar. We are talking about like ETH and a staked ETH derivative. So, there really should be no scenario where this happens, but it happened. And the system was not prepared for this condition. So, we have another loss, unfortunately, in DeFi. And how did it happen is the interesting thing because you might just wave your hand and say it was an Oracle issue. But when there's data on chain, you can always dive deeper. And so, let's do that. So, here it was specifically a Chainlink Oracle.

There were 10 different uh Oracle price providers in this Oracle. So, Chainlink aggregates different providers. And here it was a five v five contest. So, it was like an equal number reporting a price of one versus a price of one million. And as you saw on the chart, a few of these blocks, the price just jumped. A huge jump. And so, it was an almost equal split, but yeah, unfortunately, this happened. Um I have to be honest, I forget the exact root cause if this was uh due to like a liquidity issue, but at the end of the day, you have to look at this chart, which is inside Chainlink, who is actually reporting the price, and these are the people you're trusting?

Chainlink might be the brand wrapper around where the price is coming from, but that's not the source. The source of the data is deeper. And so, if you don't trust the source, if you think these 10 people are not your best friends, then you have a problem. And anyone using Chainlink has to consider that the actual prices reported to Chainlink are the real concern here. That's where the dependency is. And as we saw, sometimes it doesn't work out. Um if I have time, which I might, I'm going to do a quick rant about off-chain, because this whole idea that we are in blockchain, we are in DeFi, it's for the transparency. If if it's not transparent, if it's a black box, why not use a bank? Why not use a stock

market? So, for me, this idea of off-chain yield sources, where you really lack transparency, you lack the verifiability, it's uh a bit uh counterintuitive to why many of these projects exist, where the code's all open source. And a final analogy, you can think of this a bit like open source software versus closed source. Uh open source, you can look and see if there are problems. Closed source, some people claim it's better, but you can't tell. You don't have access to judge. It's just closed.

So, at the end of the day, for me, having this on-chain verifiability is really important. How to evaluate risk? Well, okay, I already had a show of hands who likes high APYs, and there was no one here, so I'm going to skip this, and instead jump to what probably these risk-aware people here are aware of, which is sometimes you'll see a risky protocol, and then a few months later it's on fire, and you're like, I told you so. I told you so. And it's very unfortunate this happens. I think there really should be no smile, there should be crying, because this is not a great scenario. Sure.

So, step one is to understand where issues often happen and then secondly to quantify where like the likelihood of those issues. And I will say our full risk methodology at yearn is online. Our risk scores are also online. I might have an image here. Here are some of the risk scores so you can actually see the results that we have for different protocols and understand what yearn thinks as a somewhat independent party who's actually trying to integrate with these, how risky consider each of these protocols and dive into the exact reasons why. So, we have different categories. If you were here earlier for the D5 scan talk, it looks similar to that. Um, I think I am out of time because we want some questions. So, I

will go very quickly. There's also incident, I'll just take one more minute if that's okay. Uh, there's also the question of which team do you trust when there is this edge case. So, when crazy stuff happens, do you want a team that's very smart in handling D5 situations or a team that's a bit newer to the technology? And this cannot be predicted. There's always issues that happen on chain. I'm not trying to uh, say that this was a scenario that we will always have, but in the recent Kelp DAO incident, yearn was luckily one of the first to withdraw from Aave's wrapped ETH pool and luckily no funds were lost. So, for yearn users, this was basically the end result.

So, in conclusion, vaults are a key component to D5 today. And there are many different designs that have different trade-offs. It's up to you as users to understand like where you want to put your money, but there are some questions you should ask instead of just using the highest APY as the only metric. Understanding and managing your risk exposure is crucial to surviving in the space. Again, risk, the risk can be a 100% loss, not a 10% loss, but a 100%. So, managing that, it's your responsibility at the end of the day because D5 is open and decentralized.

And last question to leave everyone with is do you know where your money is? It's 1:00 p.m. Do you know where your money is? Do you know? Check it on chain. So with that, thank you for coming to my talk. Okay.