TL;DR
YieldBasis takes a Curve Cryptoswap LP position, borrows crvUSD against it to hold a constant 2x leveraged position, and lets arbitrageurs trade against its quotes so that rebalancing happens for profit and impermanent loss cancels. The LP keeps clean 1:1 spot exposure and still collects fees. Worth correcting one common assumption: the leverage is not an admin dial. LEVERAGE is a hard-coded Factory constant, and reading it on-chain returns exactly 2e18, so no vote can lever you up. The engineering is careful, the market contracts are non-upgradeable Vyper, the audit list is real rather than decorative, and there is no exploit on record. Three things hold this at caution. Insider and treasury contracts hold 65% of current YB supply, measured on-chain today rather than read off a tokenomics chart. The protocol has rebuilt its markets twice in eleven months, so the contracts holding today's $132.5M are eleven weeks old. And the fee engine that is supposed to pay unstaked LPs has been running thin, with net fees negative on 18 of the last 30 days.
Checklist
Audits & contracts. The audits page numbers its engagements Audit #1 through Audit #9 and adds a Sherlock contest, and every one checks out against a real report artifact: Statemind (2025-02-24 to 2025-05-22), ChainSecurity (2025-07-07), Quantstamp (2025-04-01 to 2025-04-16), MixBytes (2025-08-11), Electisec (2025-08-03) and Pashov (2025-03-26 to 2025-04-01) on core; a Sherlock contest scoped to the full protocol (2025-08-01 to 2025-09-30); MixBytes and ChainSecurity on the Hybrid Vaults, both 2026-03-26; and a Firepan AI review of the FeeDistributor (2026-04-23 to 2026-04-26). No invented firms, and the AI review should not be counted as a human firm. Core contracts are Vyper 0.4.3 and cannot be upgraded. Two gaps matter. The newest core-scoped work closed on 2025-09-30, the Hybrid Vault audits landed 2026-03-26, and Firepan looked only at the FeeDistributor, yet the v3 markets now holding all the money were deployed 2026-05-25. Nothing on that page is scoped to them. Separately, the bug bounty was still described as "in preparation" in the 2026-05-19 note, roughly eleven months after launch. DefiLlama still records zero audits, so the list rests on the project's own page. The docs decline to summarize per-finding remediation and explicitly warn readers not to infer it from a report link, which is unusually honest and should be taken at face value.
Admin control. Resolved this run by reading the chain rather than the docs. Factory.admin() returns the HybridFactoryOwner proxy at 0xb8BA33CD, whose immutable ADMIN decodes to the Aragon OSx DAO at 0x42F2A41A, and whose FACTORY points back at the Factory, closing the loop. The voting plugin returns minDuration 604800 seconds, supportThreshold 550000 and minParticipation 300000, exactly the 7 days, 55% and 30% the docs claim. Through that single address the DAO can add markets, change the implementations used for future markets, replace the crvUSD price aggregator, set the borrow rate up to a 100% APR ceiling, set AMM fees up to 10%, and size each market's crvUSD allocation. Now the part the last version could not confirm: the same plugin returns votingMode() = 1, and Aragon's own source defines that enum as EarlyExecution, meaning a proposal can execute before its end date once the outcome is mathematically settled. The 7-day window is therefore a ceiling, not a delay, and that is read off the plugin rather than inferred from one reported proposal. There is no post-vote timelock either. Then there is the second key. Factory.emergency_admin() returns 0x467947EE, which is not a YieldBasis multisig at all. It is Curve's Emergency DAO, labelled as such on Etherscan, and I confirmed getThreshold() = 5 over 9 owners on a Safe live since 2021-07-26. It can kill a YieldBasis market with five signatures and no token vote. The docs present "YB's emergency_admin" and "the Curve Emergency DAO" as two separate caveats; on-chain they are one address. One detail cuts the right way: when an emergency admin or the admin force-exits a stuck position, the contract requires receiver == owner, so that key can block and unwind but cannot redirect funds. Note also that the DAO itself sits behind a UUPS proxy, so the governance layer is upgradeable even though the markets are not.
Oracle. LP price is computed locally as 2 x virtual_price x sqrt(price_scale) x p_agg, combined with a crvUSD aggregator that EMA-samples several pools. Factory.agg() reads 0x18672b1b, which is Curve's own AggregatorStablePrice, and calling it returns crvUSD at 0.9998 with the correct stablecoin wired in. So the entire price path is Curve infrastructure, and the EMA is what stops single-block manipulation. The 0.90 to 1.10 band is exclusive at both ends and enforced at factory init and inside the aggregator setter, and nowhere else. Routine deposits, withdrawals and swaps never re-check it. A passing vote can also point set_agg at a different aggregator, subject only to that band check at the moment it is set.
Liquidity & exit. You can always get out, but read the mechanics before you need them. Even on a killed market emergency_withdraw stays open and bypasses the oracle-driven rebase, so it works when the oracle is reverting. Two costs the marketing does not mention. First, that path returns a pair, and when the debt leg comes back negative the contract pulls crvUSD from your wallet via transferFrom to settle it, so you may need to bring stablecoins in order to leave, and you must approve them first. Second, that path exposes no min_* slippage parameter at all. On the normal path, redemption value moves between blocks with the Temporary Redemption Discount, which widens exactly when prices are moving fast and normally resolves within hours; there you should use preview_withdraw and set min_assets. Two newer wrinkles. The v3 migration was manual, announced 2026-05-25, and LPs who never acted are sitting in markets the docs label deprecated, one of which has Hybrid Vault deposits already disabled. And once ADMIN flags a market disabled, anyone at all can shrink its crvUSD allocation down to a 75% floor of oracle-priced collateral, which is designed for orderly wind-down but means the wind-down does not wait for you.
Yield (real vs emission). Unstaked LPs earn organic trading fees, and this is genuinely real yield: DefiLlama's methodology records no protocol take, with value flowing to yb-LP holders through pricePerShare and to veYB through admin fees. Note that "no protocol take" means no company treasury cut, not that nothing is skimmed; Factory.min_admin_fee() reads 10%, and that admin fee moves value from staked LPs to veYB holders. The problem is the level. Across the four live markets, pricePerShare reads 1.0062, 1.0071, 1.0043 and 1.0111 against deployment on 2026-05-25, so 0.43% to 1.11% in 78 days, which annualizes to roughly 2.0% on tBTC and 5.2% on WETH. Net fees were negative on 18 of the last 30 days and on each of the last seven, with the trailing 30 days at about +$124k against +$293k in the prior 30. This is the PPS drag the protocol itself documents, where rebalance losses outrun fee inflow, and it is not a migration artifact: March 2026 was net negative by $2.58M and April 2026 by $53k, both before the v3 markets existed, and August is negative month-to-date. Staked LPs give up all of that and receive only YB emissions. YB is down about 90% from its October 2025 high and set a fresh all-time low on 2026-07-30, so the staked leg is a bet on the token, not a yield.
Holder concentration. The last version left this open because the Etherscan top-holder endpoint needs a Pro key. Reading the published vesting contracts directly gets there anyway. Against a measured supply of 746.3M YB: Team holds 200.0M (26.8%), Investors 89.3M (12.0%), the Protocol Development Reserve 74.0M (9.9%), Curve Licensing 63.9M (8.6%), the Ecosystem Reserve 46.8M (6.3%), and YB Pair Rewards 11.2M (1.5%). That is 485.2M YB, or 65.0% of current supply and 48.5% of the 1B cap, in insider and treasury contracts, broadly consistent with CoinGecko's 253.8M circulating once the smaller buckets are netted off. The protocol's own risk page concedes the point, warning that "veYB voting weight concentration at launch creates a vote-centralisation risk until distribution matures." Since a 30% quorum with early execution governs a contract set that controls rates, market creation and the oracle, the question that decides everything is who holds the 105.4M YB locked in veYB. I can now narrow it: none of the vesting or treasury contracts hold any veYB themselves, so insider participation, if it exists, runs through separate wallets that this run could not attribute. Until someone does that attribution, governance capture cannot be ruled out on arithmetic alone.
Track record. The Factory was deployed 2025-09-15 and DefiLlama began tracking on 2025-09-25, so about eleven months of contract life and ten and a half months of measured history. The incident record is clean: DefiLlama's hacks array is empty, and an X scan from 2026-07-01 forward surfaced no exploit, no stuck withdrawals, no migration complaints and no governance dispute, only product and proposal traffic. Against that, TVL is $132.5M, down 46.4% from the $247.3M peak on 2026-01-15 and down 17.3% over 90 days, though it has stabilized and is up about 4% on the month. The markets have been redeployed twice, most recently to follow a Curve pool upgrade, so operational maturity is younger than the calendar suggests. And the central claim, that arbitrage-driven rebalancing cancels IL, has still not been tested by a violent BTC drawdown.
Worst case
A fast BTC or ETH drop while crvUSD is off peg. The protocol documents the mechanism honestly: under extreme volatility or gas congestion, arbitrage rebalancing gets delayed and effective leverage drifts from 2x, and a crvUSD dislocation distorts the leverage ratio even when arbs are active. There is a further dependency the earlier read missed entirely: that rebalancing arbitrage runs on flash loans through the lender configured at Factory.flash, so if flash infrastructure goes down or its fees spike, the correction mechanism degrades precisely when it is needed. Sustained rebalance losses that outrun fees drag pricePerShare for unstaked LPs and push staked LPs below their watermark, with recovery dependent on future fees that may not arrive. The recent fee series shows this is not theoretical; it is the normal state of the system during quiet markets, just at small magnitude. There is no protocol pause to protect you mid-event. What exists is a kill switch held by Curve's Emergency DAO and an always-open emergency exit that may return a poor print and may demand crvUSD from you before it lets you out. Funds are not designed to be takeable, and the receiver == owner check on forced exits is a real guard, but you can exit into a bad number, and a crvUSD or wrapper depeg hits the affected market's LPs in full while leaving other markets isolated. The concentration risk compounds it: with 65% of supply in insider and treasury hands, no timelock, and early execution enabled, a captured or simply mistaken decision on the rate or the aggregator lands as soon as the arithmetic settles. Governance is not dormant either, and it has moved in the direction of more risk per unit of collateral: proposal 49, which passed on 2026-06-09, raised Hybrid Vault capital efficiency so that 1 crvUSD unlocks about $2.20 of deposit capacity instead of $1.81. And the Curve coupling is not one dependency but five. crvUSD is the debt asset, Curve pools are the venue, Curve's aggregator is the oracle, Curve's Emergency DAO holds the kill switch, and Curve Licensing holds 8.6% of the token. We rate Curve caution and Curve LlamaLend avoid; this is a leveraged position stacked on the former.
Bottom line
Caution, same verdict as 2026-07-01 but on much firmer evidence. The contract story is strong and the design choices are deliberate rather than sloppy: fixed leverage proven constant on-chain, no upgradeability, an exit path that survives a dead oracle, and an emergency key that cannot redirect funds. What holds it back is everything around the contracts. Two thirds of the token sits with insiders and the treasury, the governing DAO can execute early with no timelock, the money is in eleven-week-old markets that no published audit covers, the real yield is low single digits and frequently negative, and the protocol has never met a crisis. Treat it as a high-conviction experimental position sized accordingly. Prefer the unstaked leg, which at least earns real fees, over staking for a token at all-time lows. Watch the crvUSD peg, check the TRD before you exit, keep some crvUSD on hand in case the emergency path ever asks for it, and if you deposited before late May, confirm you have actually migrated to the v3 market.
Data appendix
- TVL: $132.53M (DefiLlama, verified). Ethereum only. 90d: $160.16M on 2026-05-14, so down 17.3%. 30d: $127.73M, up 3.8%. ATH $247.30M on 2026-01-15, so down 46.4%. Post-peak low $106.73M on 2026-06-07. First tracked 2025-09-25 at $3.10M. Methodology: value of LP tokens in Curve pools minus borrowed crvUSD. Category: Leveraged Farming.
- Markets: four live (cbBTC, WBTC, tBTC, WETH),
is_killed()= false on all four this run.Factory.market_count()= 11, matching the docs' four active plus seven deprecated across two prior generations. crvUSD allocated totals 213,206,033 (cbBTC 84.81M, WBTC 64.24M, tBTC 35.74M, WETH 28.42M), and in every marketstablecoin_allocatedequalsstablecoin_allocation, so all four sit at their ceiling, which is why capacity proposals keep recurring. pricePerShare 1.006239 / 1.007127 / 1.004289 / 1.011138 respectively, all deployed 2026-05-25 (yb-cbBTC 07:23 UTC, yb-WETH 07:24 UTC). Live borrow rate 0.818% APR on the three BTC markets and 10.0% APR on WETH; AMM fee 1.30% on all four;Factory.min_admin_fee()10%. - Token: YB $0.0779 (CoinGecko) and $0.0791 (DefiLlama), market cap $19.8M, circulating 253.8M, total supply 746,268,613 measured on-chain, max 1B. FDV $58.2M as CoinGecko computes it on total supply, or about $77.9M at the 1B cap. ATH $0.8185 on 2025-10-15, down 90.5%. All-time low $0.0619 on 2026-07-30. 30d +6.1%, 60d -12.6%. Ethereum 0x01791F726B4103694969820be083196cC7c045fF, also on BNB Chain.
- Fees: trailing 30d net +$123,995 against +$292,945 the prior 30d; 18 of the last 30 days negative, including the last seven consecutively; net-negative calendar months are March 2026 (-$2,584,402), April 2026 (-$53,261) and August 2026 month-to-date (-$66,397), the first two pre-dating the v3 markets. Trailing 1y $27.6M. DefiLlama methodology records zero protocol revenue, with fees going to yb-LP holders via pricePerShare and to veYB via the FeeDistributor.
- Audits: core, Statemind (2025-02-24 to 2025-05-22), ChainSecurity (2025-07-07), Quantstamp (2025-04-01 to 2025-04-16), MixBytes (2025-08-11), Electisec (2025-08-03), Pashov (2025-03-26 to 2025-04-01); Sherlock contest scoped to the full protocol (2025-08-01 to 2025-09-30); Hybrid Vaults, MixBytes and ChainSecurity, both 2026-03-26; FeeDistributor, Firepan AI audit (2026-04-23 to 2026-04-26). All nine plus the contest carry published report artifacts. DefiLlama tracks 0 audits. Bug bounty "in preparation" per the 2026-05-19 note. Coverage of the 2026-05-25 v3 market redeploy: refresh.
- Admin/governance:
Factory.admin()= 0xb8BA33CD1Ccb091a8468572950bD3669723FA5C6 (HybridFactoryOwner, deployed 2026-06-03), whose immutableADMIN= 0x42F2A41A0D0e65A440813190880c8a65124895Fa and whoseFACTORYpoints back to 0x370a449FeBb9411c95bf897021377fe0B7D100c0. The DAO is an Aragon OSx contract behind a UUPS proxy (EIP-1967 implementation slot reads 0x58c1f7bc62bb63fb137bc8f6d8ea6321a0501d29). Voting plugin 0x2be6670DE1cCEC715bDBBa2e3A6C1A05E496ec78 reads minDuration 604800s, supportThreshold 550000, minParticipation 300000, minProposerVotingPower 1, and votingMode 1 (Aragon EarlyExecution, confirmed against Aragon OSx v1.3.0 source).Factory.emergency_admin()= 0x467947EE34aF926cF1DCac093870f613C96B1E0c, Etherscan-labelled "Curve.fi: eDAO",getThreshold()= 5 over 9 owners, Safe deployed 2021-07-26. ADMIN powers: add_market, set_implementations (future markets only), set_agg, set_flash, set_allocator, set_fee_receiver, set_min_admin_fee, lt_set_rate (bounded by MAX_RATE, 100% APR), lt_set_amm_fee (bounded by MAX_FEE, 10%), lt_set_killed, lt_allocate_stablecoins, lt_distribute_borrower_fees, set_limit_setter, transfer_ownership_back. No post-vote timelock. Forced emergency withdrawals requirereceiver == owner. Factory deployed 2025-09-15. - Oracle: Curve Cryptopool LP oracle (2 x virtual_price x sqrt(price_scale) x p_agg) plus
Factory.agg()= 0x18672b1b0c623a30089A280Ed9256379fb0E4E62, Curve's AggregatorStablePrice, which returned 0.999795 this run withstablecoin()= crvUSD and sigma 0.001. Band 0.90 to 1.10 exclusive, enforced at factory init and inset_aggonly.Factory.STABLECOIN()= 0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E (crvUSD, trading at $0.9988), confirming the debt-asset dependency on-chain.Factory.flash()= 0x26de7861e213a5351f6ed767d00e0839930e9ee1, the flash lender the rebalancing arbitrage depends on.Factory.LEVERAGE()= 2000000000000000000, a constant. - Holder concentration (on-chain, this run): current supply 746,268,613 YB. Team 200,044,932 (26.81%); Investors 89,255,900 (11.96%); Protocol Development Reserve 74,000,000 (9.92%); Curve Licensing 63,902,044 (8.56%); Ecosystem Reserve 46,793,505 (6.27%); YB Pair Rewards 11,212,793 (1.50%); Vest Early LP S1 1,691,685; DAO treasury 887,207; GaugeController 26,341; Vest Curve 4,246; CliffEscrow 0. veYB holds 105,400,336 (14.12%), and its
supply()confirms the same figure. Insider and treasury total 485,209,175, being 65.0% of current supply and 48.5% of the 1B cap. None of the vesting or treasury contracts hold veYB directly. Insider share of veYB: refresh. - Recent-news / incident scan: no hack in DefiLlama's record (hacks array empty). X scan from 2026-07-01 returned no exploit, loss, depeg, stuck-withdrawal or migration complaint. Activity is governance and product: manual v3 migration announced 2026-05-25 following a Curve pool upgrade with over 70% of TVL migrated by 2026-06-16, proposal 49 passed 2026-06-09 raising Hybrid Vault capital efficiency from $1.81 to about $2.20 of capacity per crvUSD, proposals 50 to 52 in July 2026 adding ETH and WBTC capacity, and proposal 54 on 2026-08-10 updating WBTC pool parameters after a Curve upgrade. Maintained monthly. Methodology: DeFi Research Instruction v2.