A user deposited 100 ETH into a vault on Curve, but due to a missed harvest over a month, the APY ended up 30% lower than projected. This is a typical scenario: without auto-compounding, compound interest doesn't work, and manual reward collection (harvest) requires time and gas costs. We build yield vaults — smart contracts that automatically reinvest yields, eliminating manual harvest. This key DeFi component addresses challenges like who pays for compound, how to avoid slippage when selling reward tokens, and how to protect against reentrancy via tokens with hooks. Our engineers, with 5+ years of experience in DeFi, have launched 10+ vaults on mainnet, and we're ready to share best practices.
How Does a Yield Vault with Auto-Compounding Work?
A yield vault accepts user funds, places them in a protocol (Aave, Compound, Curve, Convex), collects accumulated reward tokens, and reinvests them back. In practice, non-trivial issues arise: who pays for compound, how to avoid slippage when selling rewards, and how to not fall victim to reentrancy via tokens with hooks.
Who Calls Harvest and Who Pays?
Auto-compounding requires periodic calls to the harvest() function — collecting rewards and reinvesting. Someone must pay for this transaction.
-
Permissionless harvest: Anyone can call
harvest()and receive a bounty (typically 0.5-1% of collected rewards). This is 10x cheaper than a keeper but less reliable for low TVL. With low vault TVL, harvest happens rarely, APY is lower than advertised. -
Keeper-based harvest: According to Chainlink Automation documentation (https://docs.chain.link/chainlink-automation), configuring a trigger takes minutes. Chainlink Automation or Gelato Network calls
harvest()on a schedule or when a reward threshold is met. More reliable than permissionless, but requires LINK funding. Gelato deducts payment from the rewards themselves via theIAutomateinterface. - Harvest on each deposit/withdraw: The simplest option, but on the first deposit into a new vault, you pay gas for harvesting zero rewards.
We typically use a hybrid: scheduled keeper with permissionless harvest as fallback.
Compounding Math and Accumulation Errors
APY with compounding: (1 + r/n)^n - 1, where r is the annual rate and n is the number of compounding periods per year. With daily compounding (n=365) and 20% APR, APY is 22.13%. With weekly compounding (n=52), APY is 21.94%. The difference is small, but incorrect frequency on the frontend disappoints users.
Rounding error: each compound operation shares * pricePerShare does not always divide evenly by totalAssets. The cumulative error over thousands of compounds can become significant. Solution: store totalAssets as an exact value, update it atomically on each operation. The compound interest effect works without loss.
How to Set Up a Chainlink Automation Keeper
- Deploy the vault contract and register an upkeep on Chainlink Automation.
- In
checkUpkeep(), returntruewhen accumulated rewards exceed a threshold (e.g., 1000 tokens). - In
performUpkeep(), callharvest()and burn the keeper fee. - Set the check interval (minWaitSeconds) and budget in LINK.
This guarantees regular compound even at low TVL.
Strategy — The Core of the Vault
Integration with Curve + Convex
Classic strategy: deposit USDC → Curve 3pool (USDC/USDT/DAI) → receive 3CRV → stake in Convex Finance → get CRV + CVX rewards → sell CRV/CVX for USDC → add back to 3pool. The interaction curves in Solidity:
// Deposit into Curve
ICurvePool(POOL_3CRV).add_liquidity([amount, 0, 0], minLpTokens);
// Stake LP in Convex
IConvexBooster(BOOSTER).deposit(pid, lpAmount, true);
// Claim rewards
IConvexRewardPool(REWARD_POOL).getReward(address(this), true);
// Sell CRV via Uniswap V3
ISwapRouter(UNISWAP_ROUTER).exactInputSingle(params);
Risk of slippage when selling rewards: if the vault accumulates 50,000 CRV and sells them all in one swap, price impact is 2-5%. Solution: split the sale into multiple parts (slicedSell) or use 1inch for optimal routing through multiple pools.
Fee Management
Standard fee structure for a yield vault:
- Performance fee: 10-20% of accumulated yield per harvest. Goes to the protocol treasury. For a vault with $10M TVL, a 15% fee generates $1.5M annually.
- Management fee: 0.5-2% annual on TVL. Accrued continuously by increasing totalAssets in favor of the treasury.
- Withdrawal fee: 0-0.1%. Optional, to discourage short-term deposits.
Implementation of management fee without separate transactions: on each totalAssets() call, calculate elapsed_seconds * annualFeeRate / SECONDS_IN_YEAR * tvl and subtract from the return value. Treasury shares are minted on harvest.
Harvest Model Comparison
Harvest Model Comparison
| Model | Advantages | Disadvantages | Gas Costs |
|---|---|---|---|
| Permissionless bounty | Zero keeper costs | Unpredictable frequency | OPEX on bounty (0.5-1% rewards) |
| Keeper (Chainlink) | Guaranteed periodicity | LINK costs | $2-5 per upkeep per day |
| On deposit/withdraw | Simplicity, no external dependencies | Rare harvest at low TVL | Included in user's gas |
What Risks Arise When Working with Yield Vaults?
Reentrancy via ERC-777 and Callback Tokens
The harvest function makes several external calls: claim → swap → deposit. ERC-777 tokens call the tokensReceived hook on the recipient. If the vault accepts ERC-777, during claim the hook may call deposit or withdraw before harvest completes. Protection pattern: nonReentrant on harvest, deposit, withdraw.
Sandwich Attacks on Harvest Swaps
Public harvest() is visible in the mempool. MEV bots execute a sandwich: buy CRV before the harvest swap, sell after. Mitigation: deadline on swap (max 1-2 blocks), strict minAmountOut using a TWAP oracle instead of spot price. TWAP price is 3x more accurate than spot price in volatile markets. amountOutMin = twapPrice * amount * (1 - maxSlippage). TWAP over 30 minutes — Uniswap V3 observe(). Alternative: Flashbots Private Transactions.
Price Manipulation via Flash Loans
A strategy that reads spot price from an AMM to compute the compound ratio is vulnerable: a flash loan temporarily shifts the price. Solution: never use spot AMM price for decision-making on amounts. Only use TWAP or Chainlink for price calculations.
Development Stack
Solidity 0.8.x + OpenZeppelin 5.x (ERC-4626, ReentrancyGuard, Pausable, AccessControl). Foundry for testing with fork tests on mainnet. Chainlink Automation for keeper. 1inch Fusion API for optimal swaps.
| Risk | Vector | Protection |
|---|---|---|
| Reentrancy | ERC-777 hooks in claim | nonReentrant on all state-changing functions |
| Sandwich | Public harvest | TWAP minAmountOut + Flashbots |
| Price manipulation | Spot AMM prices | Chainlink / TWAP for calculations |
| Accumulative fee error | Imprecise totalAssets | Exact accounting, update on every operation |
| Too rare compound | Insufficient TVL | Keeper + permissionless with bounty |
Work Process
- Analysis (2-3 days). Target protocols, fee structure, compound frequency, keeper requirements.
- Design (3-5 days). ERC-4626 vault architecture, separate strategy contract for upgradeability, fee accounting.
- Development (2-4 weeks). Vault → strategy → keeper integration → frontend (wagmi + viem).
- Testing. Foundry fork tests: full cycle deposit → earn → harvest → withdraw on mainnet state. Fuzz on amounts and timing.
- Audit. External audit required when TVL > $500k. Our vaults undergo formal verification.
What's Included in the Result?
- Source code of smart contracts (verified on Etherscan)
- Architecture documentation and deployment instructions
- Configured Chainlink Automation keeper
- Integration with 1inch for optimal swaps
- Audit report (if required)
- Team training and support during launch
Time and Cost Estimates
Simple vault on one protocol with Chainlink Automation — 1-2 weeks. Multi-strategy vault with optimal reward routing and sandwich protection — 4-8 weeks. Cost is determined after the strategy and security requirements are defined. Discuss the details — we'll prepare a custom proposal.
Order yield vault development with auto-compounding — get a free consultation. Our engineers with 5+ years of DeFi experience have implemented 10+ vaults for well-known protocols. Describe your task, and we'll offer the optimal solution.