Skip to content
PROTOCOL RESEARCH

YieldBasis risk

Well-audited immutable Curve-adjacent protocol from the Curve founder that cancels LP impermanent loss with 2x leverage, but constant leverage, a crvUSD dependency, a ~9-month unproven-in-crisis track record, a live emergency-admin kill key, and concentrated insider supply now unlocking keep it at caution.
CautionResearched Jul 1, 2026

Scorecard

strong: Audits & contractsSix firms (Statemind, ChainSecurity, Quantstamp, MixBytes, Electisec, Pashov) named in the protocol's own risk docs, plus a Sherlock contest; core Vyper 0.4.3 contracts immutable. DefiLlama tracks zero audits for it, so the list is docs-sourced.
watch: Admin controlveYB DAO governs (30% quorum, 55% support, 7-day vote), but a live emergency_admin can set_killed a market and the upstream Curve Emergency DAO can pause the pool; exact signers _refresh_.
watch: OracleComposite Curve LP oracle plus crvUSD EMA aggregator, with a 0.90-1.10 crvUSD band enforced only at factory init and on the aggregator setter, not per deposit/withdraw/swap.
watch: Liquidity & exitemergency_withdraw stays open even on a killed market, but redemption value fluctuates block-to-block via the Temporary Redemption Discount and can widen sharply in fast markets.
watch: Yield (real vs emission)Unstaked LPs earn real trading fees; staked LPs forfeit fees and earn only YB emissions, and YB is down ~91% from ATH, so the emission path is a soft bet.
weak: Holder concentrationTeam 25% plus Investors 12.1% plus large reserves vs a 2.5% public sale; 6-month cliffs already passed (deploy ~Sept 2025) and 2-year vests are dripping now. On-chain top-holder split _refresh_ (Etherscan Pro required).
weak: Track recordLive only since mid-to-late Sept 2025 (~9 months); no hack in DefiLlama's record, but the leverage/rebalance engine has not been stress-tested through a deep BTC crash and TVL has already fallen ~50% from its ~$247M Jan peak.
🟢 strong🟡 watch / caveat🔴 weak / fund-loss risk
Verdict is a gate (worst flaw wins), not an average. Our read, not financial advice.

Live facts

auto-sourced now
TVL$133.7M
30d↑2%
Audits5
Last hacknone

DeFiLlama + our exploits feed. Cross-check the dated report against today.

TL;DR

YieldBasis is the newest protocol from the Curve founder: it takes a Curve Cryptoswap LP position, levers it 2x with crvUSD debt, and uses arbitrage-driven rebalancing to cancel impermanent loss so an LP keeps full one-to-one price exposure and still collects fees. It started on Bitcoin but is no longer BTC-only: live markets are cbBTC, WBTC, tBTC, and WETH, plus a WETH-only Hybrid Vault with a $25M cap. The engineering is careful (immutable Vyper contracts, six named audit firms, a Sherlock contest) and there is no exploit on record. The reasons this is caution and not solid are structural, not sloppy: constant 2x leverage on volatile assets, a hard dependency on crvUSD staying near peg, an emergency-admin key that can kill a market, concentrated insider supply now vesting, and a track record under a year old that has not seen a violent drawdown. The token is also down about 91% from its October 2025 high, which matters for anyone staking for YB emissions.

Checklist

Audits & contracts. The protocol's risk docs name six audit firms (Statemind, ChainSecurity, Quantstamp, MixBytes, Electisec, Pashov) plus a public Sherlock contest, and the audit page's metadata and auditor logos corroborate that set. Core contracts are Vyper 0.4.3 and immutable (not upgradeable). Note two things: DefiLlama's own record lists zero audits for the protocol, so this list rests on the project's own docs, not a third-party aggregator; and the docs are internally inconsistent on remediation, the risks page states "all identified issues have been remediated" while the audits page explicitly declines to summarize per-finding status and warns readers not to infer full remediation from a report link. A bug bounty was still "in preparation" as of the docs' 2026-05-19 note. Admin control. Governance runs through a veYB DAO (30% quorum, 55% support, 7-day vote). But an emergency_admin can call set_killed on a market to block normal deposits/withdrawals (forcing emergency_withdraw), and because markets sit on Curve pools, the Curve Emergency DAO can pause the underlying pool. Immutable code, live emergency keys. The exact emergency_admin signer set is refresh. Oracle. LP price is computed locally as 2 x virtual_price x sqrt(price_scale) x p_agg, combined with a crvUSD aggregator that EMA-samples multiple pools. A 0.90-1.10 crvUSD band is enforced at factory init and on aggregator updates, but routine deposits, withdrawals, and swaps do not re-validate that band each time. Liquidity & exit. You can always exit: even a killed market keeps emergency_withdraw open, independent of oracle/AMM health. The catch is the Temporary Redemption Discount, the amount you get out varies between blocks with the leverage-vs-spot gap and widens during rapid price moves. Use preview_withdraw and set min_assets. Yield: real vs emission. Two distinct returns. Unstaked yb-LP earns organic trading fees (real yield, seen as fundamental-value growth). Staked yb-LP forfeits that and earns only YB token emissions from the gauge. With YB near $0.07 and down ~91% from ATH, the staked path is an emissions bet, not organic yield. Holder concentration. Supply is a 1B hard cap split across 11 categories: Team 25%, Investors 12.1%, Ecosystem Reserve 12.5%, Protocol Development Reserve 7.4%, Curve Licensing 7.5%, versus a 2.5% public sale. Team and investor allocations carried 6-month cliffs and 2-year vests from deployment; with deployment around September 2025, those cliffs have already passed and the 2-year vests have been dripping for a few months. On-chain top-holder distribution is refresh (the Etherscan top-holders endpoint requires a Pro key this run). Track record. The YB token contract was deployed around 15 September 2025 and DefiLlama began tracking TVL on 25 September 2025, so the protocol is roughly nine months old. TVL climbed from ~$3M to ~$150M by mid-October 2025, later peaked near $247M in mid-January 2026, and has since fallen to ~$112M, a drawdown of roughly half from the peak. No hack is listed on DefiLlama and the protocol's own risk pages describe no realized loss event, but an independent live incident and sentiment scan could not be completed this run (refresh), and the leverage engine has not been stress-tested through a sharp crash.

Worst case

A fast BTC or ETH drawdown combined with a crvUSD wobble is the scenario to fear. The protocol itself flags that in extreme volatility or network congestion, arbitrage rebalancing can be delayed and effective leverage can drift from the 2x target; a meaningful crvUSD depeg distorts the leverage ratio even while arbs are active. Sustained rebalance losses that outrun fees drag fundamental value for unstaked LPs and push staked LPs below their watermark, with recovery dependent on future fees. There is no protocol-level pause to protect you mid-event, only the emergency_admin kill switch (which stops normal flow) and the always-open emergency_withdraw (which may return a poor amount). Funds are not designed to vanish, but you can exit into a bad print, and a crvUSD or wrapped-collateral (cbBTC/WBTC/tBTC/WETH) depeg would hit the affected market's LPs in full. Layered on top is the supply overhang: insider allocations are past their cliffs and vesting into a token already down ~91%.

Bottom line

Caution. The contract-security story is genuinely strong and the mechanism is thoughtful, so this is not an "avoid." But it is a young, leveraged, crvUSD-dependent product with concentrated insider supply that is now unlocking, a battered token, and no crisis-tested history. Size it as a high-conviction experimental position, prefer the unstaked (real-fee) leg over the emissions bet, and watch the crvUSD peg and the leverage/TRD state on exit.

Data appendix

  • TVL: ~$112M (DeFiLlama, live, matches the latest history point). History: ~$3.1M at listing 2025-09-25, to ~$150M mid-Oct 2025, peak ~$247M mid-Jan 2026, then decline to ~$112M now (~50% off peak). Ethereum-only TVL. Category: Leveraged Farming. TVL method: value of LP tokens in Curve pools minus borrowed crvUSD.
  • Markets: cbBTC, WBTC, tBTC, WETH live, plus a WETH-only Hybrid Vault ($25M cap). Not BTC-only.
  • Token: YB ~$0.0712, market cap ~$15.8M, FDV ~$52.7M, circulating ~222M of 1B max, down ~91% from ATH $0.82 (2025-10-15). Deployed on Ethereum (0x01791f726b4103694969820be083196cc7c045ff) and also on BNB Chain per CoinGecko. (CoinGecko, live.)
  • Audits: Statemind, ChainSecurity, Quantstamp, MixBytes, Electisec, Pashov + Sherlock contest (named in protocol risk docs; audit-page metadata/logos corroborate). DefiLlama tracks 0 audits. Remediation: risks page claims all issues remediated; audits page declines per-finding evidence. Bug bounty: "in preparation" per docs (2026-05-19).
  • Admin/governance: veYB DAO (30% quorum / 55% support / 7-day vote); core contracts immutable (Vyper 0.4.3). Live emergency_admin set_killed per market; Curve Emergency DAO can pause underlying pool. Exact emergency_admin/DAO signer config: refresh.
  • Oracle: Curve Cryptopool LP oracle (2 x virtual_price x sqrt(price_scale) x p_agg) + crvUSD EMA aggregator; 0.90-1.10 crvUSD band at init/setter only (protocol docs).
  • Holder concentration: Team 25%, Investors 12.1%, Ecosystem 12.5%, Protocol Dev 7.4%, Curve Licensing 7.5%, Public Sale 2.5% (docs tokenomics, 11 categories). 6-month team/investor cliffs from ~Sept 2025 deploy already passed; 2-year vests dripping. On-chain top-holder split: refresh.
  • Provenance: YB token contract created ~2025-09-15 (block 23370923) by 0xa39e4d6b...dddc80d. Curve founder attribution is consistent with heavy Curve allocations (Curve Licensing 7.5%, Curve Governance 0.5%) and Curve infrastructure dependency, but no primary founder statement was fetched this run (X/news blocked).
  • Recent-news / incident scan: No hack listed on DefiLlama protocol record. Independent live news/X scan: refresh (news source returned Payment Required, X search timed out on every call this run). Maintained monthly. Methodology: DeFi Research Instruction v2.

← all protocols