YieldFi security record
As of 21 Oct 2026, YieldFi has 4 audit reports by 3 security firms on Trustblock; the latest is by Sherlock, dated 14 Jan 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| YieldFi audit | Security firm: Sherlock | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| YieldFi PR19: vyToken Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| YieldFi Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Original removed |
| yieldfi-contracts-v1. | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
Findings38
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 14 |
| Low | 0 | 1 | 20 |
CriticalAll CCIP messages reverts when decodedYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportCriticalMissing source validation in CCIP message handlingYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportHighIncorrect owner passed to Manager::redeem in YToken withdrawal flowYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportMediumCannot add a user to greenlist of the global vaultYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportMediumDecimal Mismatch in LimitsFeature Causes Deposit Limit BypassYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportMediumdeposit function in Manager contract lacks slippage protectionYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportMediumDeposits using lagging Vested NAV (currentNav) causes dilution of existing shareholdersYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportMediumFlawed on-chain performance fee check in updateNav causes transaction reversionYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportMediumImproper L2 Sequencer Check Implementation in Chainlink Oracle AdapterYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportMediumIncorrect redemption amount when MIN_NAV feature is enabledYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportShow 10 more
MediumL2 Sequencer Status Check Logic Inversion Leading to Denial of Service (DoS)YieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportMediumCommented-out blacklist check allows restricted transfersYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportMediumDirect YToken deposits can lock funds below minimum withdrawal thresholdYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportMediumManager::_transferFee returns invalid feeShares when fee is zeroYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportMediumMissing L2 sequencer uptime check in OracleAdapterYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportMediumYtokenL2::previewMint and YTokenL2::previewWithdraw round in favor of userYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportMediumCooling Period Reset on Multiple Requestsyieldfi-contracts-v1. · Cantina · 12 Nov 2024Fixed
The report gives no description here.
Open the reportLowCannot cancel a redemption with blacklisted receiverYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportLowChainlinkOracleAdapter Initialization Bypasses Parent Initialization MethodYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportLowFee receiver cannot fully redeem sharesYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowGreenlist/blacklist check can be bypassed by depositing through a vaultYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportLowIncorrect constant percentsYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportLowPerformance fee guardrail calculation uses real-time total supply leading to incorrect capYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportLowUse of Deprecated answeredInRound CheckYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportLowUser KYC date can be updated to future timestampYieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportLowVault fee guardrail bypass when feeRate = 0 or totalSupply = 0YieldFi audit · Sherlock · 14 Jan 2026Fixed
The report gives no description here.
Open the reportLowBalance check for yield claims in PerpetualBond::_validate can be easily bypassedYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportLowChainlink router configured twiceYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportLowHardcoded CCIP feeToken prevents LINK discount usageYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportLowHardcoded extraArgs violates CCIP best practicesYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportShow 7 more
LowMissing vesting check in PerpetualBond::setVestingPeriodYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportLowStatic gasLimit will result in overpaymentYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportLowUnverified _receiver can cause irrecoverable token lossYieldFi Audit Report · Cyfrin · 24 Apr 2025Fixed
The report gives no description here.
Open the reportLowGas Inefficiency from Uncached Variableyieldfi-contracts-v1. · Cantina · 12 Nov 2024Fixed
The report gives no description here.
Open the reportLowMisleading Variable Nameyieldfi-contracts-v1. · Cantina · 12 Nov 2024Fixed
The report gives no description here.
Open the reportLowUnused functionyieldfi-contracts-v1. · Cantina · 12 Nov 2024Fixed
The report gives no description here.
Open the reportLowWrong initializer usedyieldfi-contracts-v1. · Cantina · 12 Nov 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="yieldfi"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us