Apr 24, 2026

Yearn Curation vs My DeFi Risk Skill: Overlap, Gaps, and Who Should Use Which

Why this comparison is worth doing

Honest bottom line up front: the two aren't doing exactly the same thing. Yearn Curation is a curator with on-chain multisigs, a vault-fee revenue line, and a capital-allocation mandate. The crypto-project-security-skill I maintain is a research tool any individual can run on their own laptop and get a report in minutes. Incentives, use cases, and output depth all diverge. On most axes Yearn Curation is clearly better; on a few, my skill fills space Yearn won't touch.

The companion deep-dive covers what Yearn Curation does and how. This piece puts Yearn side by side with my skill (94 DeFi risk analysis reports produced so far) across the axes that actually matter.

1. Scoring framework

Yearn Curation: 5-dimension weighted average.

Dimension	Weight
Audits & Historical Track Record	20%
Centralization & Control	30%
Funds Management	30%
Liquidity Risk	15%
Operational Risk	5%

Output: one 1.0–5.0 final score, mapped to tiers (Minimal / Low / Medium / Elevated / High). Each dimension also gets a 1.0–5.0 sub-score.

My skill: 3-dimension hierarchical aggregation.

Dimension	Sub-categories
Smart Contract Risk	Code quality & audit coverage, audited-vs-deployed drift, oracle, economic mechanism, token contract (GoPlus), cross-chain & bridge
Off-Chain Risk	Governance & admin rights, team & operations, key management & certifications
Track Record	Security incident history, battle-tested duration, audit recency, TVL stability, incident response capability

Output: each sub-category rated LOW/MEDIUM/HIGH/CRITICAL. Dimension rating = MAX of sub-categories, with weighting rules (Governance counts 2x in Off-Chain; Cross-Chain counts 2x in Smart Contract if deployed on 5+ chains). Overall = CRITICAL if any dimension CRITICAL; HIGH if 2+ dimensions HIGH; and so on.

What's different:

Axis	Yearn	Me
Scale	1.0–5.0 continuous	LOW/MEDIUM/HIGH/CRITICAL discrete
Aggregation	Weighted average	MAX + weighting rules
Who dominates the score	Five roughly equal-weighted dimensions	Any CRITICAL sub-category decides the overall

These reflect different philosophies. Weighted averages let one CRITICAL dimension be diluted by safer ones. MAX ensures a CRITICAL will always surface. For capital-allocation decisions, the weighted score maps naturally to allocation percentages. For research-grade judgment, MAX reflects the reality that "if one thing can blow up, it can blow up."

Worked example: a protocol with excellent audits (1.0) but an EOA managing all admin keys (5.0). Yearn's weighted average might land around 2.2 (Low Risk band). My skill would rate it CRITICAL (because Governance & Admin is CRITICAL). Yearn's score is useful for deriving supply caps. My rating is useful for go/no-go decisions.

2. Methodology depth

Yearn Curation: each report is a structured due-diligence document. The Fluid report lists every audit firm, every audit date, every remediation status; breaks down GovernorBravo governance step by step; analyzes TVL concentration down to the top-5 asset percentage; reads reserves directly on-chain. Human-written with script assistance. Update cadence: low — major assets are hand-maintained and refreshed when new information or incidents appear.

My skill: 10-step pipeline (Triage / Gather / Governance / Oracle / Economic / Smart Contract / Cross-Chain / Operational / On-Chain Verify / Report). Reports come out in minutes. Data sources: DeFiLlama, GoPlus, Etherscan family, Safe Transaction Service, Solana RPC, rekt.news, Immunefi. Automation helpers: goplus-check.sh, onchain-check.sh. Update cadence: each run is real-time.

What's different:

Axis	Yearn	Me
Depth	10K+ words per report, human-written	2K–5K words per report, structured auto-generation
Coverage vs depth	25 human-written DDs backing real capital in ~1 year	94 structured auto-generated reports in ~2 months — broader, shallower
Data freshness	Semi-passive after publication	Current at every run
Automation vs judgment	Human depth + monitoring scripts	Scripts gather, LLM judges

The time-depth tradeoff differs. Yearn is optimized for deep assessment of a small asset universe (25 reports supporting 12 vaults). My skill is optimized for fast scans of many protocols to find the ones worth deeper analysis.

3. Who can do this

Yearn Curation: Yearn's internal team. Individual identities are pseudonymous; behind the product sit the Yearn SAM (Security and Monitoring) group + yChad multisig + (post 2025-11-19) a 2/3 curator multisig. New curators join through internal Yearn processes.

My skill: anyone. MIT-licensed, open source. Install Claude Code + an Anthropic API key and you can run it. The repo currently has 94 example reports (8 LOW / 47 MEDIUM / 27 HIGH / 12 CRITICAL) covering DeFiLlama's top 100 protocols + every major perp DEX.

What's different: this is the biggest structural gap. Yearn Curation is the product of a specific organization. My skill is a methodology implementation — anyone can use it, modify it, fork it, add their own rules. A Yearn Ondo report might take three weeks; my skill runs in ten minutes. But being explicit: Yearn's 10K+ word hand-written DD, backing real supply caps, is higher quality, deeper, and more accurate than anything my skill produces in a single run. "Runs more, runs faster" is not "runs better."

4. Incentive structure (the most important axis)

This is the difference I think matters most to name clearly.

Yearn Curation's incentives:

Primary customer is Yearn V3 itself. A misrated asset → Yearn V3 loses capital → Yearn fees drop and governance credibility suffers.
Secondary revenue is Morpho curator fees (5–15% industry standard).
Both incentives point toward scoring accuracy. Resolv was a Yearn V3 counterparty and Yearn still tagged the report HACKED. Protecting the brand would have meant continuing to let Yearn's own strategies lose money.

My skill's incentives:

More users → skill gets known → brand benefit.
No capital allocation responsibility, no fee revenue, no investors to answer to.
Incentive points toward broad coverage, public transparency, and catching signals before major incidents — because that's what makes the skill memorable.

What's different: incentive structure determines where effort lands. Yearn goes extremely deep on the 25 assets Yearn V3 needs to allocate to. My skill scans every protocol with TVL > $500M, including ones Yearn will never touch (Justin Sun protocols, anon-team perps, dead protocols).

5. Concrete real-world differences

Comparison through specific cases:

Resolv:

Yearn Curation: published a near-5.0 high-risk rating before the exploit, explicitly naming the two fatal design flaws ("operational parameters with no timelock" + "RLP price is entirely offchain"). Post-exploit, added HACKED tag.
My skill: docs/examples/resolv-stablecoin.md rated CRITICAL — $25M stolen, USR depegged and not restored, protocol paused, single-key failure. Same direction on both sides.

Kelp DAO (leading with the miss, because this is my skill's most visible one):

Yearn Curation: not in the 25 public reports (Kelp isn't in Yearn V3's allocation universe).
My skill: post-hack CRITICAL (kelp-post-hack-20260419.md). But the pre-hack kelp-liquid-restaking.md rated overall MEDIUM: governance got LOW (6/8 multisig + 10-day timelock, genuinely strong), Cross-Chain got MEDIUM (LayerZero OFT across 16 chains, centralized relayer dependency). The skill saw the LayerZero exposure — it just didn't rate it high enough to actually warn anyone before the bridge message spoofing exploit. Kelp's $292M is the largest "saw it, didn't call it" miss my skill has had in 2026.

Aave:

Yearn Curation: not on curation.yearn.fi (Yearn doesn't curate Aave; Aave is a peer / customer of the curator ecosystem).
My skill: aave-top-protocol.md LOW, "Gold standard; dual timelock + 6yr track record".

Lighter (the protocol my skill flagged as most structurally dangerous in April 2026):

Yearn Curation: not in the list. Yearn's mandate is allocating capital into Yearn V3; Lighter isn't in that universe. Curating Lighter would be negligent, not fulfilling a duty — so the absence is a product-definition boundary, not an evasion.
My skill: HIGH, "21-day timelock can be bypassed to 0 seconds by a 3/6 multisig". I wrote a dedicated piece putting it in Tier 1. The coverage gap here isn't "Yearn should cover this and doesn't" — it's that the two products serve different jobs: Yearn evaluates only what Yearn allocates to; my skill evaluates anything with meaningful TVL regardless. Long-tail protocols need independent public scoring that doesn't collect a curator fee from them — a niche Yearn's economic model can't fill.

6. Who each tool is for

Concrete decision rules:

About to deposit >$50K into a Morpho vault? Check whether Yearn Curation has a report on the underlying asset first. If not, pick a tier-1 asset they have covered.
Evaluating a protocol with $100M–$ 1B TVL that Yearn hasn't covered? Run my skill. Ten minutes gets you a triage score + 3-dimension report.
Doing deep Morpho ecosystem research? Yearn's long-form DD reports are primary source material — faster than re-doing the work yourself.
Building a curator business? Read Yearn's Morpho-forum methodology post, then fork my skill's attack-pattern checklist. Together that's the starting toolkit.
Looking for risk signals in the long tail (TVL > $500M with contested governance)? Most of the skill's 94 reports live in exactly this zone.

7. What each can learn from the other

What I can take from Yearn:

On-chain verification depth. Yearn reads reserves on-chain, reads multisig members, reads timelock configs. My skill does this but script coverage can expand.
Quantitative supply-cap analysis. Yearn computes DEX liquidation depth and slippage per asset — hard quantitative work that belongs in my economic mechanism step.
Monitoring as its own phase. My skill runs once and stops. Half of Yearn's value is continuous monitoring. I should add a "continuous monitoring recommendations" step as Step 11.

What my skill makes explicit that Yearn's published reports don't separately label (which isn't the same as "Yearn doesn't do this" — they almost certainly do it internally; they just don't break it out as a named check on the public page):

Attack-pattern cross-reference. Every report runs 8 historical attack patterns (Drift / Euler / Ronin / Beanstalk / Cream / Curve / UST / Kelp) with explicit per-pattern indicators — so the reader can see "this protocol matches 3/8 of the Kelp indicators."
Audited-vs-deployed drift detection. A dedicated sub-step for "the team claims they're audited, but the contract running in production was upgraded after that audit" — reads EIP-1967 Upgraded event logs and audit-report commit hashes.
GoPlus token-layer automation. Runs GoPlus on every EVM protocol with a token to catch contract-level red flags (honeypot, hidden owner, owner-can-change-balance, slippage-modifiable).

LLMs have a natural advantage on this kind of mechanical, every-report-the-same-format check — runs consistently, cheap to repeat, user can compare across protocols at a glance.

Bottom line

Yearn Curation is an on-chain risk management firm whose output is capital-allocation decisions. My skill is a risk-research methodology implementation whose output is a report anyone can reproduce.

These aren't substitutes. They're complementary. Yearn Curation's customers would benefit from running my skill on the Lighter / Aster / edgeX tier of high-TVL protocols Yearn won't curate. My skill's users would benefit from reading Yearn's deep DDs on blue chips like Fluid.

In the bigger frame, this is DeFi risk analysis shifting from a research function to asset-management infrastructure — viewed from two sides. Yearn is putting this work on-chain and monetizing it. I'm open-sourcing it and automating it. Both directions are going to keep running through 2026, and both will spill out of Morpho into Euler, Aave's new version, Spark, and any protocol that adopts the curator model.

If you want to run a report yourself, install crypto-project-security-skill. If you want to deposit into a vault where a professional curator has already done the scoring, pick a Minimal Risk tier on curation.yearn.fi. Either path beats picking a vault purely by APY.