Harvest Risk

Harvest risk is an underappreciated category of DeFi risk that affects users of auto-compounding vaults like Yearn, Beefy, and Convex. It's distinct from the underlying strategy risk and arises specifically from the act of claiming and reinvesting accumulated rewards.

**Why harvesting creates risk:**

Auto-compounding vaults periodically execute "harvest" transactions: claim accumulated reward tokens → sell them for the base asset → reinvest into the yield strategy. Each of these steps creates attack surface and economic risk.

**Specific harvest risks:**

**1. Sandwich attack on reward sales:** When a vault sells a large batch of accumulated reward tokens (e.g., selling $200K of CRV for USDC), MEV bots can sandwich the transaction — front-running with their own buys and back-running the sell. This price impact reduces the vault's compounding yield. Professional vault operators (Yearn, Convex) use MEV protection and split large harvests into smaller tranches to minimize this.

**2. Harvest timing and gas costs:** Harvesting requires gas. If gas prices spike (e.g., during a major market event), a harvest that would normally cost $50 might cost $500. For small vaults with limited capital, this can make harvesting unprofitable. Vault operators must balance harvest frequency (more frequent = more compounding, but more gas) with gas costs. Beefy uses harvest thresholds: only harvest when accumulated rewards exceed a minimum value relative to gas cost.

**3. Smart contract risk during harvest:** The harvest call interacts with multiple external contracts (the reward pool, the swap router, the strategy reinvestment). Each interaction is an opportunity for reentrancy attacks or exploit-triggering callback sequences. Several yield aggregator exploits have been triggered during harvest transactions.

**4. Reward token price risk:** Between harvest events, reward tokens (CRV, CVX, COMP) accumulate in the vault but are not yet sold. If the reward token price drops sharply before the next harvest, the vault receives less base asset per unit of reward, reducing the effective APY. Users bearing harvest risk in volatile reward tokens should check harvest frequency.

**5. Griefing attacks:** Malicious actors can trigger a harvest at a suboptimal time (e.g., when gas is expensive or reward token price is temporarily depressed), reducing vault efficiency. Well-designed vaults have keeper networks with economic incentives to harvest at optimal times.