defirisk.co
rubric v1.7.0

External keeper/relayer not redundant

Yearn Finance's assessment for RD-F-062 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

V3 TokenizedStrategy uses a single-keeper model: one keeper address stored in StrategyData struct, updatable by management via setKeeper(). report() restricted to management or keeper (onlyKeepers modifier) — only two entities can call report. If keeper fails and management is unresponsive, strategy cannot harvest. Gelato/Chainlink Automation/Keep3r can be set as keeper but only one at a time. REPORTING_MANAGER permissionless Keeper at vault level for process_report does not substitute for per-strategy keeper for TokenizedStrategy report(). Protocol can function (degraded — no harvest, yield stalls) but users face opportunity cost. V2 strategies historically used Keep3r network for harvest automation. Yellow: single keeper per strategy with no built-in redundancy, though management can update keeper and protocol is not fully halted without it.

Sources #

Methodology #

Determine whether the protocol depends on a single keeper or relayer (Gelato, Chainlink Automation, custom) with no redundancy or failover.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol yearn-finance factor RD-F-062 score yellow collected_at 2026-05-16 08:34:32