BlackHartBlackHart
Scores/Beefy Finance

Beefy Finance

TEMPERED

Yield Aggregator · Multi-chain · $300M+ TVL · 20 contracts

Official site: beefy.finance ↗

721
3004756508251000
Confidence67%
Z-Factor0.85
Updated 2026-05-27Public score

Security Profile

Access Ctrl
55
Economic
60
Oracle
75
Compos.
35
Govern.
50
Maturity
80
Resilience
50
Supply Ch.
65
OpSec
54
Cascade
100
Min
35
Avg
62
Max
100

Audit History

Certik
2021-01
Peckshield
2022-06

Bug Bounty Program

$75,000
Max payout on Immunefi
View Program

Assessment

Beefy is architecturally simple per-vault (positive) but has critical third-party farm dependency that transfers all risk externally (negative). 67-month maturity and survival through one exploit provide solid track record. The D4 compositional risk score of 35 is the anchor -- each vault is only as safe as its underlying farm. No cross-vault contagion limits systemic risk. Comparable to Yearn V2 in architecture but with wider chain surface.

Dimension Breakdown

Methodology
Access Control
Weight 18% · 70% confidence
55
+14Owner-based ACL (no role separation: owner controls strategy migration, token rescue, fee config)
+14Strategy has separate keeper/strategist/manager roles but all controlled by same Beefy team
-45No on-chain timelock for most admin functions (only strategy migration has approvalDelay)
+14Vault owner can call inCaseTokensGetStuck (rescue) but cannot touch want token
Provenance
Economic Soundness
Weight 13% · 65% confidence
60
+12Simple share/asset model (deposit/withdraw). getPricePerFullShare should be monotonic.
+12No flash loan surface in vault itself
+12First-depositor inflation attack possible on fresh vaults without dead shares
+12Performance fee capped but fee config is external contract (modifiable)
Provenance
Oracle Integrity
Weight 13% · 50% confidence
75
+15Vault does not use price oracles directly (no liquidation, no collateral)
+15Strategy swap routing relies on DEX spot prices (no TWAP protection in base)
+15getPricePerFullShare is an implicit oracle used by external integrators
+15Some strategies use Chainlink for swap path optimization (varies per strategy)
Provenance
Battle-Tested Maturity
Weight 12% · 80% confidence
80
+16Beefy live since October 2020 (67+ months)
+16Vault V7 is latest iteration, evolved from V1-V6
+16~$350M TVL across 20+ chains, hundreds of vaults
-20One significant exploit in 2022 (Fantom strategy vulnerability, ~$11M)
Provenance
Governance & Upgradeability
Weight 10% · 60% confidence
50
+10Beefy operates as a DAO with BIFI token governance
+10Core team controls strategy deployments and vault parameters
+10Strategy migration has timelock (approvalDelay) but owner controls
+10No formal on-chain governance for parameter changes
Provenance
Adversarial Resilienceredacted
Weight 10% · 30% confidence
50
  • Immunefi bounty program active
  • Multiple community audits but no top-tier formal audit of core vault
  • Simple per-vault architecture limits blast radius
  • Third-party farm dependency is the weakest adversarial link
Provenance
Operational Security
Weight 10% · 60% confidence
54
-23No branch protection detected
+14Active CI/CD (100% success rate)
-23Weak PR review coverage (17%)
+14Low development activity (4 commits/month)
Provenance
Compositional Risk
Weight 5% · 75% confidence
35
-22CRITICAL DIMENSION: Each vault depends entirely on its underlying farm protocol
-22Strategy calls external farm.deposit/withdraw/getReward -- any farm exploit = total loss
+12Swap via unirouter: external DEX dependency for every harvest
+12Multi-chain deployment means different farms, routers, bridges per chain
Provenance
Cascade Exposure
Weight 5% · 55% confidence
100
+33Appears in 1 cross-protocol cascade chain(s)
+33Member of 2 dependency cluster(s)
+33Source: cross_protocol_composition.json dependency analysis
Provenance
Supply Chain
Weight 4% · 55% confidence
65
+13Uses OpenZeppelin for ERC20, Ownable, ReentrancyGuard
+13Solidity 0.8.x (overflow protection built-in)
+13Strategy code is templated but each farm integration is custom
+13Hundreds of strategy contracts, each a potential supply chain entry point
Provenance

Top Score Drivers

Dimensions with the greatest marginal impact on BRI.

Access Control
55+47.8 potential
No on-chain timelock for most admin functions (only strategy migration has approvalDelay)
Governance & Upgradeability
50+30.2 potential
Beefy operates as a DAO with BIFI token governance
Adversarial Resilience
50+30.2 potential
Economic Soundness
60+28.9 potential
Simple share/asset model (deposit/withdraw). getPricePerFullShare should be monotonic.
Operational Security
54+26.8 potential
No branch protection detected

Adversarial Risk Signals

Publicly verifiable security posture indicators.

Disclosure HistoryNot Assessed
Remediation VelocityNot Assessed
Bug Bounty ProgramNot Assessed
Audit CoverageNot Assessed
Incident HistoryNot Assessed
Deployed 2020-10-0810 dimensionsProvenance Ledger
methodology v2.1formula v1.1weights v1.1evidence sha256:sha256:0...

Score History & Verification

Score provenance tracking begins with the next reassessment.

Full provenance ledger

On-Chain Data

Protocol Slug
"beefy"
Oracle
BRORegistry (Base)
Evidence
IPFS (pinned)
Staleness Threshold
24 hours
Read Score
registry.getScore("beefy")
Reduce exploitable risk

Continuous adversarial analysis, vulnerability detection, and verified reassessment.

View PlansMethodology

Embed this score

Live, updates automatically. Free for any site. Click-through links open the full report on BlackHart.

Public
Style
Theme
Format
Preview
Copy iframe code
<iframe
  src="https://blackhart.io/embed/oracle/beefy?variant=card&theme=dark"
  title="BlackHart Risk Index: Beefy Finance"
  width="340"
  height="290"
  frameborder="0"
  loading="lazy"
  style="border:0; max-width:100%;"
></iframe>
Believe this score contains a factual error? Submit evidence for review