Yield Farming Risks Explained — Impermanent Loss, Smart-Contract Risk, and the Math Behind a 200% APY

A protocol shows you 247% APY on a USDC/ETH pool. The math on the page is correct. Six months later your dollar position is down 18%. Nothing got hacked, no rug pull happened, the protocol is still live and the APY is still 240-something. You just learned what yield farming actually costs, the hard way. This piece walks through the four risks that turn high-APY farms into losses, the math behind each one, and the filters that separate sustainable yield from temporary inflation.

What yield farming really is

Yield farming, at its core, is providing capital to a DeFi protocol in exchange for token rewards. The capital can be a single asset (lending it on Aave, staking it on Lido) or a pair of assets (LPing on Uniswap, Curve, Balancer). The rewards can be in the same token you deposited (real yield) or in a separate emission token (incentive yield).

The headline APY is almost always the second kind: token emissions paid to bootstrap liquidity. That makes it economically very different from a savings account, even though the page presents it like one.

You can model the headline math with our compound interest calculator. Plug in 247% APR, daily compounding, $10,000 starting balance. The calculator shows you'd end the year with $116,500. The calculator is right. The number in your wallet will not be $116,500. The gap is the risk.

Risk 1 — Impermanent loss

Impermanent loss (IL) is the loss you take by holding two tokens in an LP rather than holding them separately. It applies whenever you're providing liquidity in a pair (BTC/ETH, USDC/ETH, etc.) and it's purely a function of the price ratio between the two assets moving.

The math, for a standard 50/50 constant-product pool (Uniswap V2 style):

IL = (2 × √k) / (1 + k) − 1

Where k is the ratio of the new price to the old price. Some real numbers:

| Price change of one token | Impermanent loss | |---|---| | ±10% | 0.06% | | ±25% | 0.6% | | ±50% | 2.0% | | ±100% (2×) | 5.7% | | ±200% (3×) | 13.4% | | ±400% (5×) | 25.5% | | ±900% (10×) | 49.4% |

That's not the fee yield. That's a position loss compared to just holding the two tokens individually outside the pool. To break even on a position where ETH 2× against USDC, the LP needs to earn 5.7%+ in fees and rewards over that period. To break even on a 5× move, 25.5%+.

Stablecoin pairs almost never have IL because the prices barely move. Volatile pairs (ETH/altcoin, ETH/memecoin) have catastrophic IL during big moves.

The thing most yield farm pages don't tell you: IL is realised when you withdraw. While the position is open, it's unrealised — a paper loss that can swing back. If ETH doubles and then halves back, your IL goes to roughly zero. The catch is that this is symmetric and unpredictable, and most LPs withdraw at the wrong moment.

Mitigation: stable-to-stable pools (USDC/USDT, DAI/USDC) have negligible IL. Concentrated liquidity (Uniswap V3) gives you more fees but more IL if you set the range wrong. If you're farming a volatile pair, do the math on a 2× and a 0.5× move before depositing. If those scenarios make the position unprofitable, the headline APY isn't enough.

Risk 2 — Smart-contract risk

DeFi protocols are software. Software has bugs. The bugs in DeFi protocols get exploited for hundreds of millions of dollars each time.

Notable exploits by year:

• 2022: Ronin Bridge ($625m), Wormhole ($325m), Nomad Bridge ($190m), Wintermute ($160m), Beanstalk ($182m)
• 2023: Mixin Network ($200m), Euler Finance ($197m), Multichain ($126m), Curve ($73m)
• 2024: PlayDapp ($290m), Munchables ($62m), Penpie ($27m)
• 2025: ByBit (cold wallet, $1.5b — exchange, but adjacent)

The pattern: the exploit is almost never something simple. It's a logic flaw nobody noticed for two years until someone read the code carefully enough.

For a yield farmer, smart-contract risk shows up two ways:

1. The protocol you're farming on gets exploited. Direct loss, anywhere from partial to total.
2. A protocol your funds are routed through gets exploited. Many yield aggregators (Yearn, Convex) route funds through 3–5 underlying protocols. Any of them being compromised compromises you.

Audits help and don't help. Most exploited protocols had been audited by reputable firms. An audit reduces the probability of a bug, but the residual risk on any unaudited code is much higher.

Mitigation: prefer protocols that are 2+ years old, have $1B+ in TVL, have multiple audits from credible firms, and have at least one public bug-bounty payout (a bug paid out means a bug was found and disclosed responsibly, which is the system working). Avoid protocols where the same dev team has had multiple incidents.

Risk 3 — Token-price erosion

This is the killer. Most yield farm APYs are paid in a project-specific reward token (e.g., $PNDA, $CAKE, $JOE). That token's price is held up entirely by demand from people who want to farm with it. The moment the farms shut off the emissions, the token price collapses.

Empirical pattern across hundreds of farm tokens since 2020: the median emission-funded farm token loses 60–90% of its USD value within 12 months of launch. Some lose 99%+.

What this means for your effective yield:

You deposit $10,000 at 200% APY paid in $FARM. Over one year:

• You earn $20,000 worth of $FARM tokens (at the deposit-time price).
• Over that year, $FARM loses 75% of its value.
• The actual dollar value of your rewards: $20,000 × 0.25 = $5,000.
• That's a 50% return, not 200%.

If you reinvest the $FARM tokens back into the farm (compounding), you're compounding a depreciating asset. Most yield farmers underperform their headline APY by 60–80% on this risk alone.

Mitigation: sell rewards regularly (weekly, daily if gas allows). The strategy "auto-compound everything" sounds smart but is only smart if the reward token holds value, which it almost never does. The classic farmer playbook: stake, claim, swap-to-stablecoin, then maybe redeposit the stable, never reinvest the volatile.

Even better: prefer protocols that pay yield in established assets (ETH, BTC, stablecoins) rather than project tokens. Yields are usually lower in nominal terms but realistic in actual dollars. Lido staking pays 3-4% in stETH — those numbers are real. A farm advertising 60% APY paid in $XYZ is almost certainly going to deliver 5–20% in dollar terms.

Risk 4 — Liquidity and exit risk

Higher APYs almost always live on smaller pools. Smaller pools mean thinner liquidity. Thinner liquidity means it costs more to exit.

Concrete example: a $5m pool offering 80% APY on a stablecoin pair. You deposit $250,000 (5% of the pool). Six months later, you want out. The pool is now $3.2m because the APY dropped to 25% and farmers left. Your $250,000 is now 7.8% of pool TVL. When you exit, the slippage on a non-stable pair could cost you 1–2% of your withdrawal. Worse: if you're trying to swap the reward token to stables, the token's own liquidity has thinned in parallel with TVL — slippage of 5–10% to exit a large reward position isn't uncommon.

This is why "exit before everyone else" is the actual game in mercenary farming. The farmers who entered first and left first capture most of the headline APY. The ones who stayed too long lose to slippage on the way out.

Mitigation: size your position relative to TVL. A rule of thumb: never be more than 1% of a pool's TVL. Don't farm on chains where DEX liquidity for the reward token is below $1m. Check what the exit path looks like (reward token → ETH → stablecoin) before depositing, not after.

The four-filter check before any farm

Before depositing into any yield farm in 2026, run through these filters:

1. Is the APY paid in a token you'd hold otherwise? If not, expect to lose 50–80% of the headline value to token erosion.

2. What does the math say about a ±50% price move? If the position is upside-down after a normal move, the APY isn't compensating for IL.

3. Has this protocol survived two years and one major market downturn? If not, smart-contract risk is unquantifiable.

4. Could I exit at full size in under 10 minutes with under 1% slippage? If not, your "liquid" position isn't actually liquid.

A farm that passes all four is rare. A farm that passes three is usable. A farm that passes two or fewer is a coin flip — fine as a small position you can lose entirely, not fine as a meaningful allocation.

If you want the math on APR-to-APY conversion at any of these advertised rates, our APR vs APY in crypto post walks through how the headline number relates to what you actually earn. For broader return strategies that don't require navigating any of this, the best crypto ROI strategies piece compares yield farming against simpler alternatives.

The mistakes that compound

1. Treating APY as a forecast. It's a snapshot rate at one moment, on assumptions that rarely hold for a year. Plan for half.

2. Auto-compounding emission tokens. Compounding a depreciating asset is reverse-compounding.

3. Chasing the highest APY. The single best predictor of a farm's risk is its headline APY. Above 50%, almost always emission-funded. Above 200%, almost always a coin flip on survival.

4. Ignoring gas costs. On Ethereum mainnet, claiming + restaking once a week at $5 per transaction is $260/year. On a $5,000 position that's a 5% drag before any other risk.

5. Concentrating on one protocol. Even a top-tier protocol can have a one-day bug. Split across at least 2–3 different protocols for any sizeable farm allocation. Diversification isn't optional in a sector where 5–10% of protocols experience an exploit per year.

6. Locking up funds. Many farms have unbond/withdrawal periods (7 days, 28 days, sometimes longer). If you can't exit in a panic, you can't exit at the price you see today. Avoid long lockups unless the yield premium is at least 2× a liquid equivalent.

The shortcut

If you want a one-line filter: real yield on established assets at single-digit-to-low-double-digit APR is a market. Anything quoted in three or four digits is a story. Stories end.

The protocols that have paid sustainable yield over multiple years (Aave, Compound, Lido, Curve on stable pools) are still doing it in 2026. The protocols promising 1000% APY in 2021 are mostly gone. There's a signal in that.

DeFi yield is real. It's also one of the few places in retail finance where the marketing number and the realistic outcome differ by a factor of 5 or more. Treat the headline as the upper bound on what's possible if everything goes right — not as a forecast — and your decisions get a lot cleaner.