Yield Farming Risks
Originally published · 4 min read · Updated
Yield farming risks include contract failure, admin control, oracle errors, liquidation, depegs, impermanent loss, bridges, and blocked withdrawals.
TL;DR: A 30% APR earns only 7.40% over 90 days; one 8% depeg can erase the entire period before contract, oracle, bridge, or withdrawal losses.
Table of contents
A 30% simple APR earns 7.40% over 90 days; an 8% stablecoin depeg can erase that entire return before smart-contract, oracle, bridge, or withdrawal losses are counted.
What are the risks of yield farming?
Yield is payment for at least one scarce resource: capital, liquidity, duration, leverage capacity, operational work, or risk absorption. Identify the payer and the risk transferred before comparing APY.
| Yield farming risk | Failure path | Evidence to inspect |
|---|---|---|
| Smart contract | Logic or accounting bug loses funds | Deployed code, audit scope, bug bounty, incident history |
| Admin and upgrade | Key changes logic, fees, collateral, or withdrawals | Owner, multisig threshold, timelock, pause roles |
| Oracle | Bad or stale price triggers insolvency or liquidation | Feed source, heartbeat, deviation, fallback |
| Liquidation | Collateral falls or debt grows | Mark price, maintenance margin, penalty, liquidity |
| Depeg | Receipt or stable asset trades below redemption | Redemption path, reserves, market depth |
| Impermanent loss | AMM rebalances into the weaker asset | Pool curve, range, relative price scenarios |
| Reward dilution | TVL grows or emissions fall | Emission schedule, denominator, vesting, sell depth |
| Bridge and chain | Cross-chain message or destination chain fails | Bridge trust model, finality, wrapped token issuer |
| Withdrawal | Queue, cooldown, pause, or liquidity blocks exit | Contract path, historical timing, emergency controls |
Audits reduce uncertainty about a defined code version. They do not insure funds, validate future upgrades, or guarantee economic solvency.
Yield farming smart-contract risk
Confirm the live implementation, not only the proxy address. Then identify who can:
- upgrade code;
- pause deposits or withdrawals;
- add collateral or reward tokens;
- change oracles and risk parameters;
- mint receipt assets;
- rescue or transfer funds.
A 48-hour timelock matters only if users can exit inside 48 hours. A seven-day withdrawal queue can make a two-day governance delay operationally useless.
Use crypto due diligence for the contract and control review. The OWASP Smart Contract Top 10 provides a current taxonomy, not a protocol endorsement.
Yield farming liquidity and depeg risk
Dashboard value often uses an oracle or nominal redemption rate. Exit value uses available bids.
Stress every receipt or stable asset at 0.99, 0.95, and 0.90 of its reference value. For a $10,000 position:
- 20% APR over 30 days produces about $164.38;
- a 2% discount costs $200;
- the position is already behind before gas and fees.
Do not call two correlated receipt tokens diversification. If both depend on the same base asset, validator set, oracle, or bridge, their labels do not create independent risk.
Leveraged yield farming risks
Looping collateral increases both nominal yield and path dependence. Borrow rates can rise while collateral falls, shrinking health factor from both sides.
Model at least:
- collateral down 10%, 25%, and 50%;
- borrowed asset up against collateral;
- borrow APR at 2x and 5x its current rate;
- oracle lag or a one-block price spike;
- liquidation penalty plus slippage at position size;
- inability to bridge or add collateral during congestion.
Our rule: if the position survives only because a wallet can add collateral instantly, it does not survive. Networks, RPCs, bridges, and humans fail at the same time volatility rises.
Impermanent loss and reward risk
An LP can be profitable in dollars and still underperform holding the original assets. Compare:
LP ending value + fees + sold rewards - costs against original assets held
Use the impermanent loss calculator with rewards for the full example. Count rewards at executable sale value after vesting; count unreleased points at zero.
APY assumes reinvestment. If rewards are claimed monthly, gas is high, or the rate falls with TVL, the displayed compounded result may be impossible to realize.
How to reduce yield farming risk
Reject a farm before deposit if any answer is missing:
- What cash flow pays the yield?
- Which deployed contracts hold or control funds?
- Who can upgrade, pause, mint, or change the oracle?
- What is the worst executable exit price at my size?
- How long does a full withdrawal take?
- Which asset, bridge, and chain must work during the exit?
- What observable event forces me to close?
Then cap loss per shared failure domain. Five pools using the same stablecoin and bridge are one concentrated risk, not five positions.
Use the yield health checker as a prompt, not a safety certificate. Record sources and exit triggers in the crypto tracking spreadsheet.
