Skip to main content

Security and Risk Management

The security of user funds and the overall financial stability of the Yeap Finance protocol are paramount. A multi-faceted approach to risk management is employed, leveraging the Move language's safety features.

Smart Contract Security​

  • Move Language Benefits: Resource-based model, reentrancy protection, formal verification capabilities, and type safety inherently reduce attack surfaces.
  • Rigorous and Continuous Audits:
    • Internal Review: Ongoing peer review and comprehensive testing.
    • Multiple External Audits: Core smart contracts will undergo audits by multiple reputable third-party firms prior to launch and for significant upgrades. Reports will be public.
  • Formal Verification: Critical components will be subject to formal verification processes.
  • Bug Bounty Program: A post-launch program to incentivize discovery and responsible disclosure of vulnerabilities.
  • Modularity and Compartmentalization: Helps contain the potential impact of vulnerabilities.
  • Security-First Development Culture: Prioritizing security at every stage of the development lifecycle.

Financial Risk Mitigation​

  • Overcollateralization: Primary defense against borrower default in Position and Leveraged LP Token Protocols. Vault creators set conservative LTV and LLTV ratios.
    • Leveraged LP Tokens: LTVs for LP tokens require extra caution, considering impermanent loss, asset volatility, liquidity depth, and oracle reliability.
  • Efficient Liquidation Mechanism: Protects lenders' capital by automatically closing risky positions. Third-party liquidators are incentivized.
  • Oracle Security and Robustness: Dependence on reputable, manipulation-resistant oracle networks. Specialized oracles or TWAPs for LP tokens.
  • Interest Rate Risk Management: Dynamic and variable IRMs help vaults adjust to market conditions.
  • Liquidity Risk for Lenders (Bank Run Risk Mitigation): High utilization can temporarily prevent withdrawals. IRMs incentivize new deposits or repayments. Optional withdrawal queues/caps may be considered.
  • Vault-Specific Reserve Funds: Vaults can allocate a portion of fees to a reserve fund as a first line of defense against unexpected losses.

Flash Loan Security​

  • Atomic Execution Guarantee: Loans and repayments must occur in the same transaction, enforced by the Move VM, eliminating direct capital loss from non-repayment.
  • Reentrancy Protection: Move language design protects against common reentrancy attacks.
  • Potential Indirect Risks (Ecosystem Risk): Flash loans can be used to exploit vulnerabilities in other protocols. Yeap Finance aims to be robust against direct manipulation.

Governance Risks​

  • Vault-Level Governance Risks: Malicious or incompetent creators could set up risky vaults. Users must perform due diligence.
  • Protocol-Level Governance Risks (Future DAO): Standard DAO risks like voter apathy or malicious proposals apply if a $YEAP token and DAO are implemented.

User Responsibility and Due Diligence: A Critical Note​

Given the permissionless and customizable nature of Yeap Finance:

  • "Do Your Own Research" (DYOR) is Paramount: Users are solely responsible for conducting thorough due diligence before interacting with any specific vault or Borrow Protocol. This includes scrutinizing parameters, understanding asset risk profiles, assessing creator reputation, and understanding specific risks of Leveraged LP Token Protocols.
  • No Endorsement Implied by the Platform: The Yeap Finance core team or future DAO does not endorse, vet, or guarantee the safety or performance of individual user-created vaults.
  • Understanding Inherent DeFi Risks: Users must acknowledge and accept risks including smart contract vulnerabilities, market volatility, oracle failures, impermanent loss, and specific vault configuration risks.

Yeap Finance will strive to provide clear educational materials and risk disclaimers, but ultimate responsibility rests with each user.