Why this deserves a full write-up
curation.yearn.fi looks like a DeFi protocol rating site on the surface. Scores run 1.0 to 5.0 — Fluid at 1.1 ("Minimal Risk") at one end, Resolv RLP tagged 5.0 ⚠ HACKED — DO NOT USE at the other. That's the least interesting view of the product.
The interesting view is the on-chain risk desk behind the site: 12 live Morpho vaults, rebalancing hourly, reading DEX liquidity multiple times a day, auto-zeroing supply caps when alerts fire. The scores aren't commentary — they're capital-allocation decisions that directly determine which markets accept deposits, how much, and which get shut down. Every tier-1 rating you see is a Morpho market supply cap. Every ⚠ HACKED tag is the output of Yearn's monitoring scripts first setting caps to zero on-chain, then updating the static report page.
Yearn's 2025 year-end recap letter stated the number plainly: Yearn Curation grew from zero to approximately $150M TVL in 2025, primarily from organic deposits rather than short-term incentives. That number works because they aren't writing research reports — they're running an allocator.
1. The 5-dimension framework (it's not scoring, it's allocation)
Each Yearn Curation report reads like a due-diligence document. The Fluid report walks through 8 audits across 4 firms, 722 days in production with zero incidents, a $500K Immunefi max bounty, audit remediation logs, GovernorBravo + 1-day timelock governance (≈4 days end-to-end to execute) — then computes a final 1.1 / 5.0.
The weighting is published on each report page (see the Fluid report at https://curation.yearn.fi/report/fluid/), five dimensions:
| Dimension | Weight | What it evaluates |
|---|---|---|
| Audits & Historical Track Record | 20% | Audit count/brand, remediation rate, formal verification, bug bounty size, production duration, incident history |
| Centralization & Control | 30% | Admin powers, multisig threshold, timelock length, upgradeability, who can pause/change params |
| Funds Management | 30% | ERC-4626 compliance, exchange-rate mechanics, reentrancy protection, oracle design, collateral quality, reserve transparency |
| Liquidity Risk | 15% | TVL concentration, DEX liquidity for liquidation, redemption gates, withdrawal caps |
| Operational Risk | 5% | Team record, jurisdiction, upgrade cadence, delivery consistency |
Centralization and Funds Management together total 60% of the weight, which tells you what Yearn is actually afraid of. Most DeFi losses between 2024 and 2026 weren't code bugs — they were governance abuse, compromised admin keys, or deposit architecture with hidden custody risk. Drift's $285M, Radiant's social engineering, Resolv's non-timelocked operational parameters all fall inside those two dimensions.
The Resolv RLP report is the cleanest illustration. Yearn named the exact risk that later materialized:
"3-of-5 multisig can immediately change pausing, role grants, price updates, whitelist with no timelock delay"
"RLP price is entirely offchain, no onchain price oracle or slippage protection in the contract"
That report was published when Resolv had 14+ audits across 4 firms (MixBytes, Pashov, Sherlock, Pessimistic), a 495M total protocol TVL. Yearn gave it a 5.0 high-risk score anyway (before it was later tagged HACKED). When Resolv was exploited in March 2026, the report was updated with the HACKED tag.
2. Why run this on Morpho?
Yearn chose Morpho Vaults (MetaMorpho) as the substrate for engineering reasons:
- Vaults are immutable ERC-4626. Yearn doesn't own the vault contracts — they own the curator role on a vault. Their work is purely composition and monitoring; they don't carry smart-contract risk for the vault itself.
- Market isolation. Morpho Blue makes each market an isolated pair (one collateral, one loan asset, one oracle, one IRM). A broken collateral can't contaminate adjacent markets.
- Curator economics already work. Morpho's standard model is a 5–15% curator fee on vault earnings. Gauntlet, Steakhouse, RE7, MEV Capital all operate on the same economic rails.
Yearn's curator address on-chain is 0xe5e2Baf96198c56380dDD5E992D7d1ADa0e989c0. You can open app.morpho.org/ethereum/curator/yearn and read every vault config without trusting a document.
3. Four roles, not one admin
Morpho Vault splits vault authority across four on-chain roles. Yearn's setup, after the 2025-11-19 update:
| Role | Who | What it can do |
|---|---|---|
| Owner | Yearn SAM 4/7 multisig | Full vault config (add/remove markets, change caps, rotate roles) |
| Curator | 2/3 multisig (was address(0)) | Propose new markets, queue cap changes |
| Guardian | yChad multisig | Pause the vault in emergency; revoke pending timelocked actions |
| Reallocator | Bots (EOAs) | Reallocate between already-approved markets, bounded by caps |
| Timelock | 72 hours | Delay on owner/curator config changes |
The 2025-11-19 change moved the Curator slot from address(0) to a 2/3 multisig. The stated reason is one line — "to enable flexibility and speed in managing Morpho vaults." Translation: previously only the 4/7 Owner could queue changes, too slow for daily ops. A 2/3 can now queue changes, but the 72-hour timelock still applies (Owner or Guardian can revoke). This trades off response speed against irreversibility more gracefully than "everything goes through a 4/7 multisig."
The practical result of this role separation: even if the Curator multisig is compromised, funds can't move in under 72 hours; the Guardian can hit pause during that window; the Owner 4/7 can rotate the Curator out entirely. That combination — speed, response capability, and irreversibility all handled — is rare in DeFi risk architecture.
4. What the Reallocator bot does every hour
The Reallocator EOA is the interesting piece of the stack. It runs hourly and rebalances capital across already-approved markets, maximizing risk-adjusted APY subject to:
- No market above its supply cap
- No single market can hold >95% of vault TVL (guarantees exit liquidity)
- Utilization ceiling target of 95%
- Projected APY improvement must clear a gas-cost threshold before executing
Supply caps themselves aren't static. Yearn's scripts run multiple times per day, aggregating liquidity across Uniswap V2/V3/V4, Curve, Balancer, Aerodrome, SushiSwap; analyzing borrower positions near liquidation; and simulating liquidation slippage. If slippage exceeds thresholds, internal caps drop immediately (no timelock required to tighten). Only when caps need to loosen does the change route through the on-chain 72-hour timelock. Restrictions are instant; relaxations are deliberate.
Alert thresholds: bad-debt ratio > 0.5%, utilization > 95%, oracle deviation, LST/stablecoin depeg (stETH, ezETH, pufETH, rsETH, USDe, USDS, USD0). Critical alerts zero caps and pull funds to idle with no human in the loop. High-severity alerts open a PR for human review.
The whole stack is open source at github.com/yearn/monitoring. Compared to Gauntlet or Chaos Labs — SaaS black boxes by design — that's Yearn's differentiator.
5. Actual TVL and distribution
Live on-chain as of 2026-04-24 (Morpho GraphQL, curator == "Yearn"): 12 vaults, ~$32.57M aggregate TVL. Top five:
| Chain | Vault | Asset | TVL |
|---|---|---|---|
| Katana | Yearn OG ETH | vbETH | $17,060,958 |
| Katana | Yearn OG USDC | vbUSDC | $8,425,351 |
| Katana | Yearn OG USDT | vbUSDT | $2,934,823 |
| Ethereum | Yearn OG USDC | USDC | $1,636,587 |
| Ethereum | Yearn OG WETH | WETH | $893,976 |
The Katana ETH vault alone is 52% of the total. That concentration deserves more than a passing mention — Katana is a new chain where Yearn's own VaultBridge routes liquidity. This isn't organic Morpho demand; it's Yearn's V3 allocator pushing flow into Yearn's own curated vault, on a chain Yearn itself helps anchor. 52% of curation TVL in one vault, on one new chain, bridged by the curator's own infrastructure — that's a structurally adverse selection pattern any honest risk desk ought to flag in its own report.
Growth trajectory:
- June 2025 (first month after Morpho whitelist): crossed $30M
- 2025 peak: ~560M in September 2025)
- 2026-04-24: $32.57M direct-on-Morpho — down ~78% from peak. Yearn's framing is that peak flow was routed through V3 allocator vaults, so the on-Morpho number understates user-facing exposure. That framing is not externally verifiable, so the fact remains: direct Morpho TVL has fallen sharply from the peak, and the explanation is Yearn's own
Public report distribution (25 reports as of 2026-04-24):
| Risk band | Count | Examples |
|---|---|---|
| Minimal (1.0–1.9) | 3 | Fluid (1.1), Yearn yvUSDC-1 (1.2), Origin ARM (1.5) |
| Low (1.9–2.5) | 8 | Reserve ETH+, Spectra, Maple syrupUSDC, Paxos USDG |
| Medium (2.5–3.5) | 8 | InfiniFi, Midas mHYPER, Mezo MUSD, 3Jane USD3 |
| Elevated (3.5–4.5) | 2 | Re Protocol reUSD, Royco Dawn |
| High (4.5–5.0) | 4 | Apyx apxUSD, BUCK, Unit Bitcoin UBTC |
| ⚠ HACKED | 2 | Resolv RLP, Resolv wstUSR |
6. Where Yearn sits among Morpho curators
Meaningful Morpho curators include Gauntlet, Steakhouse Financial, Block Analitica, RE7 Labs, MEV Capital, Chaos Labs. Each is an independent risk/quant/research team managing multiple vaults. Yearn's differentiation comes down to four things:
- Long-form DD reports, not dashboards. Each asset report is ~10K+ words of structured due diligence. Gauntlet and Chaos Labs publish methodology + interactive dashboards, not per-asset long-form.
- Monitoring scripts are publicly readable.
github.com/yearn/monitoringis directly inspectable; Gauntlet's and Chaos Labs' monitoring stacks are closed-source. - They flag their own counterparties. Resolv was a Yearn V3 strategy counterparty — Yearn still tagged the report HACKED. No brand-protection discount.
- Vertical integration. Yearn Curation's first customer is Yearn V3 itself. Misrated risk translates directly into P&L losses on Yearn's own strategies, so the incentive is rating accuracy, not curator-fee capture.
7. What this signals
Put the pieces together and DeFi risk analysis is moving from "a research function" to "asset-management infrastructure."
The 2020–2022 canonical actor here was the audit field on a DeFiLlama page — passive disclosure. 2022–2024 was Gauntlet and Chaos Labs tuning parameters for Aave and Compound — SaaS consulting. With Morpho's ecosystem maturing in 2025, the shape changed: you can own the curator multisig on-chain, allocate real capital, and capture vault fees as a direct business. Yearn Curation is the most transparent and vertically integrated version of this shape I've seen.
For researchers, independent analysts, and security auditors looking at this space, the architecture is copyable: public methodology → per-asset long-form reports → open-source monitoring → on-chain vaults → vault-fee revenue. Compared to shipping a Twitter thread or starting a Substack, this is a slower but much more durable compounding loop — you own the capital, the fees, and the brand.
References
- Yearn Curation site
- Yearn Curation docs
- Yearn Curation methodology (Morpho governance forum, 2025-05-05)
- Fluid Lending report (1.1 example)
- Resolv RLP report (HACKED example)
- Yearn curator page on Morpho
- Yearn monitoring repo
- Curator address:
0xe5e2Baf96198c56380dDD5E992D7d1ADa0e989c0
