1/ Me and @martinetlee accidentally dove into @iearnfinance yCRV yVault code and found some parts that aroused our concerns. We quickly had a discussion with @AndreCronjeTech. More details in the following thread. TL;DR Your WAIFU is SAFU.
2/ Although there is no current risk in the existing vault, we still want to record our discovery and point out some gotchas. We hope this document will be useful to future devs who plan to contribute to the yearn ecosystem.
3/ First discovery is "poisoning baby vault". It could potentially break a vault at the beginning. Yet, it can be detected and resolved if paying attention when a new vault is released.
4/ Second discovery is "apples and oranges". It mixes up different units in the implementation. If a new strategy is developed without care, it could lead to 3 issues under reasonable assumptions. Therefore, when a new strategy is deployed, carefully check the assumptions.
5/ Please see our full gotcha notes here hackmd.io/@martinetlee/r…. Thanks @AndreCronjeTech again for discussing and synchronizing with us back and forth. Diving into the design of yearnV2 has been a pleasant journey. Looking forward to seeing how the yearn protocol evolves!
