Design Yield Aggregator

Problem Statement: Auto-Compounding Yield Vaults

A yield aggregator takes user deposits, routes them into DeFi yield strategies (lending markets, Curve/Convex LP positions), and auto-compounds the returns: keeper bots periodically harvest reward tokens, swap them back into the vault asset, and reinvest — so a depositor's balance grows without ever clicking 'claim.' Ownership is tracked by shares under the ERC-4626 tokenized-vault standard, where pricePerShare = totalAssets / totalShares rises as yield accrues. This is the model behind Yearn, Convex, and Beefy.

Why it is hard: real money on adversarial infrastructure. Vaults hold pooled user funds (reference scale: ~$4B TVL, ~200 vaults across 6 chains) sitting in external protocols you don't control. A bug in a strategy contract, an exploited allowance, or an oracle mispricing the share NAV during a reward-token dump can drain the pool irreversibly. So the hardest parts are share-accounting correctness and strategy risk containment, not throughput.

The central abstraction: pricePerShare. Deposits mint shares at the current PPS; withdrawals burn shares for shares × PPS of assets. Harvesting yield increases totalAssets (and thus PPS) without minting shares, so every holder's value rises pro-rata automatically. The invariant: on-chain `totalAssets/totalShares` is authoritative for every withdrawal; the APY numbers on the marketing billboard are trailing projections that must reconcile to actual harvested events.

The monotonicity rule. PPS rises monotonically except for explicitly realized loss events (a strategy taking a documented loss). A PPS that silently drops is either a loss the system failed to surface or, worse, an accounting bug. Surfacing loss explicitly is a core correctness property.

The defining failure stories. Harvest Finance ($24M flash-loan oracle manipulation, 2020) and Pickle Finance ($20M) came from the same class: a strategy or oracle assumption an attacker turned against the pool. So the design carries a strategy risk budget — max exposure per protocol, a timelock on strategy migration, and an emergency shutdown that blocks deposits while still allowing proportional withdrawal. Safety dominates yield.

Scale to anchor on: ~$4B TVL, 200 vaults, 6 chains, time-to-harvest p95 < 6h, PPS monotonic except realized loss. The engineering bar is exact share math, honest loss reporting, and containment of strategies you cannot fully trust.