Detailed answer
A DeFi protocol team built a yield aggregator targeting institutional stablecoin yields. Audit identified 1 critical finding: race condition in harvest function that would have caused double-counting rewards. Fixed before launch. At 6 months: $28M TVL, 18% APY, zero incidents. Project cost: $148,000. Timeline: 18 weeks.
The Technical Challenge
Yield aggregators are deceptively complex — they compose with multiple external DeFi protocols (Aave, Compound, Curve, Convex), creating an aggregated attack surface. A vulnerability in any integrated protocol can drain the aggregator's vault.
The architecture: USDC vault contract (receives deposits, issues vault shares) → strategy contracts (each deploying to a different yield source) → keeper network (harvests rewards and compounds). Vault and strategy contracts were Arbitrum-native.
The Critical Audit Finding
The harvest function processed rewards in a non-atomic sequence: (1) claim rewards from Curve/Convex, (2) sell rewards for USDC, (3) record reinvestment amount in vault.
The critical finding: a malicious actor could call harvest() multiple times in the same block (before the state update from step 3 was recorded) — causing the vault to add the reward amount to the share price multiple times for a single reward event. Attackers with timed transactions could extract significantly more than their fair share.
The fix: add a mutex (re-entrancy guard) and a minimum harvest interval of 1 block to the harvest function. The fix took 4 hours to implement and was re-audited and confirmed clean.
Results at 6 Months
| Metric | Value |
|---|---|
| TVL | $28.4M |
| Average net APY to depositors | 18.2% |
| Security incidents | 0 |
| Harvest frequency | Every 4 hours (automated) |
| Strategies active | 4 (Aave USDC, Convex FRAX, Curve 3pool, Compound USDC) |
Project cost: $148,000. Timeline: 18 weeks.