Security Notice

​

Security & Incident History

Last Updated: October 2026 Yield.xyz operates with security as a first-class design principle. We hold a SOC 2 Type II report, available on the Trust Center, and follow a layered, defense-in-depth security model across infrastructure, transactions, and protocol integrations.

---

​

Zero Security Breaches

---

​

Safeguards Against Malicious Transactions

Yield.xyz follows a zero-trust transaction model. All transactions returned by the API are unsigned and must be explicitly reviewed and signed by the client’s custody or signing infrastructure. We provide Yield.xyz Shield, a transaction validation layer that allows clients to programmatically verify:

• Target contract addresses
• Function selectors and calldata
• Token approvals and spend limits

Shield is specifically designed to prevent man-in-the-middle and payload-tampering attacks, including attack classes similar to recent industry incidents (e.g., Kiln / SwissBorg vulnerabilities), where malicious calldata or altered approvals could be injected between transaction construction and signing. By validating intent and call data before custody signing, Shield ensures only expected, deterministic transactions are ever approved. When combined with institutional custody systems (e.g., Fireblocks), this provides strong defense-in-depth protection across the full transaction lifecycle.

---

​

Protection Against Compromised Protocols

Yield.xyz continuously monitors protocol health, integration behavior, and validator performance. For validator-based staking, we maintain SLAs with our preferred validator partners covering uptime and operational reliability.

​

Key Safeguards

• Non-custodial architecture: Yield.xyz does not autonomously execute transactions or move client funds. All capital movements require explicit client-side review and signing through the client’s custody or signing infrastructure (e.g., MPC, HSM, custodians).
• Access controls: Access to Yield.xyz APIs and dashboards is restricted to authenticated and authorized users, with permissions scoped per client and per environment.
• Change management: New protocol and yield integrations are introduced through a documented review and change-management process prior to production deployment.

​

If a Protocol Becomes Unsafe

If a protocol or yield becomes unsafe, paused, or compromised:

1. The yield is marked as maintenance / deprecated / disabled via metadata
2. New deposits are blocked where appropriate
3. Clients are proactively notified through designated communication channels

If a protocol risk or security issue is identified after deployment, Yield.xyz follows a documented incident response and escalation process, including containment actions and proactive client communication. Affected yields remain accessible for position monitoring and safe exits, and are only re-enabled once the protocol is deemed safe to operate again.

​

Third-Party Monitoring

As an additional fail-safe mechanism, clients may integrate third-party on-chain risk and monitoring tools such as Hypernative, enabling independent detection of DeFi protocol incidents or abnormal behavior alongside Yield.xyz controls for layered risk management.

---

​

Fines and Penalties

Yield.xyz has not incurred any fines or penalties related to security incidents.

---

​

Volume and Scale

Yield.xyz operates at production scale across multiple institutional and enterprise clients: More granular metrics, such as per-client volumes and request breakdowns, can be shared as ranges or exact figures under NDA, depending on disclosure requirements.

---

​

External Audits and Validation

Security is reinforced through a combination of internal controls, external audits, and regulatory engagement:

​

Regulatory Engagement

Yield.xyz views proactive coordination with regulators as a key part of its compliance approach and has engaged in discussions aligned with applicable requirements of the French Monetary Authority (Autorité des marchés financiers, AMF) in connection with an integration for a French neobank.

​

Third-Party Security Audits

Audit reports include:

• Zellic: Smart Contract Security Assessment (OAV), Q1 2025
• Zellic: Smart Contract Security Assessment (Fee Wrapper), Q3 2024

​

Ongoing Security Practices

• Penetration testing and vulnerability assessments
• Remediation cycles
• Engagement with in-house white-hat security engineers
• External security researchers

Audit summaries, penetration test reports, and supporting documentation can be shared under NDA as part of due diligence.

---

​

Trust Center

For additional transparency, security posture, and trust artifacts, please refer to our Trust Center:

---

​

Security Notices

This section lists active security notices for Yield.xyz deployments. It is part of our ongoing commitment to transparency and security; check back regularly for updates and additional guidance on protecting your deployments.

​

API Key Exposure (Low Risk)

In widget deployments and native frontend integrations, the Yield.xyz API key is accessible to anyone interacting with the widget or with a frontend that calls the Yield.xyz API directly. The risks below apply to these deployments, along with the mitigation strategies that follow.

​

Risk Overview

​

Mitigation Strategies

• Proxy server: Set up a proxy server that securely stores the API key and authorizes requests based on additional authentication mechanisms. This can limit unauthorized access and control the rate of requests.
• Rate limit monitoring: Yield.xyz actively monitors the usage of your API key to detect and respond to any unusual activity, such as spikes in request volume that could indicate an attack.
• Certificate pinning: Contact Yield.xyz for assistance in implementing certificate pinning to enhance security.
• Origin validation: Yield.xyz can implement origin validation to restrict the use of the API key to its intended deployment environment. Note that this measure can be bypassed if requests are made from non-browser environments. Contact Yield.xyz for assistance.

While the exposure of the API key presents some risks, these can be managed through careful assessment and the implementation of appropriate security measures. Review these risks and strategies to ensure that your widget deployments remain secure and functional.

---

​

Reporting Security Issues

If you discover a security vulnerability, please report it responsibly.

​

Contact

Email: security@yield.xyz

​

What to Include

• Detailed description of the vulnerability
• Steps to reproduce
• Potential impact assessment
• Any suggested mitigations

​

Our Commitment

• We will acknowledge receipt within 24 hours
• We will provide an initial assessment within 72 hours
• We will keep you informed of remediation progress
• We recognize responsible disclosures (with permission)

---

​

Contact

Security Team: security@yield.xyz General Support: support@yield.xyz