A Systematization of Knowledge on DeFi Vaults: Architectures, Curation Mechanisms, and Strategy Design

A Systematization of Knowledge on DeFi Vaults: Architectures, Curation Mechanisms, and Strategy Design Davide Mancino†1 [0000-0002-9559-8476] and Luca Pennella†2 [0009-0006-2721-1248]

arXiv:2610.01300v1 [cs.CR] 1 Oct 2026

1

University of Milano-Bicocca, Milan, Italy davide.mancino@unimib.it 2 University of Luxembourg, Luxembourg luca.pennella@uni.lu

Abstract. Decentralized finance (DeFi) vaults are smart-contract-based asset management systems that pool deposits, execute programmable strategies, and mint tokenized shares representing claims on underlying assets and strategy performance. As vault designs have evolved from early yield aggregators to modular, actively managed systems, a new control layer, curation, has emerged to select strategies, configure risk parameters, and coordinate operational execution, introducing principal–agent dynamics and new failure modes. This paper systematizes DeFi vault architectures and curator-mediated control planes through (i) a unified system model and formal definitions for share accounting, roles, and operational dependencies, and (ii) three complementary taxonomies covering vault exposures and objectives, curator governance and accountability mechanisms, and strategy execution patterns together with their failure modes. We further map a representative set of production protocols to the proposed dimensions. The frameworks in this work aim to support rigorous analysis and safer design of blockchain-based financial applications. Keywords: decentralized finance · vaults · yield aggregation · ERC-4626 · curators · SoK.

1

Introduction

Decentralized finance (DeFi) vaults implement a programmable form of asset management, where deposits are pooled and represented by transferable shares, and capital allocation rules are enforced by smart contracts rather than discretionary intermediaries. In their simplest form, vaults accept an underlying asset, mint shares, and expose standardized entry/exit functions; this design has been codified by the ERC-4626 tokenized vault interface, which aims to unify accounting and interoperability across yield-bearing contracts [45,54]. Vaults generalize early DeFi interactions that required users to manually allocate capital across lending markets and liquidity pools. Yield aggregators and strategy vaults emerged to automate reallocation, compounding, and operational tasks, reducing user overhead while increasing composability and strategy complexity [16]. Contemporary deployments often rely on privileged roles to manage strategy configuration and operational execution, introducing additional trust and liveness assumptions beyond on-chain accounting [65,64]. From a macro perspective, DeFi has operated at a scale of 1011 USD in total value locked (TVL) in early 2025, while the TVL attributable to yield-farming and aggregator categories is substantially smaller and more cyclical [14]. This gap highlights a measurement challenge: what should be counted as a “vault system” depends on whether the definition is restricted to yield aggregators, or broadened to vault-like wrappers that underpin large sectors such as liquid staking, restaking, lending, and structured products. As vault strategies became more complex, a second layer of intermediation has emerged: curation. In curated vault systems, specialized entities select strategies or markets, configure risk parameters, and set fee schedules, with users delegating both execution and risk choices [41,42]. Curation can improve usability and safety through specialization, but introduces principal-agent dynamics: curators control deployment decisions while depositors bear downside risk and face limited transparency over underlying exposures [5], with a small set of curators intermediating a disproportionate share of system TVL [66]. Without a clear taxonomy of design patterns, strategy classes, and governance/operational dependencies, users and protocol designers lack a common framework to reason about security, composability, incentives, and measurable risk. †

These authors contributed equally to this work.

2

D. Mancino and L. Pennella

Prior academic work has addressed specific DeFi primitives without providing a unified vault framework. Cousaert et al. [16] systematized yield aggregators across four major protocols, but that work predates the emergence of curator systems, ERC-4626 standardization, and the diversification of vault types into restaking, delta-neutral, and RWA categories. Werner et al. [62] provided a broad DeFi survey covering lending, trading, and derivatives without addressing vault-specific architectural patterns or the curation layer. Pennella et al. [49] recently systematized DeFi derivatives protocols through a unified comparative framework, an approach complementary to ours but focused on derivatives rather than vault-based asset management. Zhang et al. [67] systematized cross-chain bridge security, relevant to cross-chain vault strategies but not covering vault design. Atzei et al. [4] and Perez and Livshits [50] studied smart contract vulnerabilities broadly, without vault-specific analysis of share inflation, rounding exploits, or PPS drift. On the MEV side, Daian et al. [18] characterized frontrunning and miner-extractable value in DEXs, establishing the foundation for understanding adversarial transaction ordering. Mancino and Sevim [38] recently systematized the evolution of Maximal Extractable Value from miners to cross-chain settings, and complementary measurement work has analyzed MEV strategies and decentralization implications in Ethereum [37] and cross-chain MEV detection across bridge ecosystems [39]; all of these are directly relevant for vault harvest, rebalancing, and bridge-mediated operations. Liu et al. [35] analyzed oracle risks in DeFi, and Loesch et al. [36] analyzed the structure of impermanent loss in Uniswap v3 and provided descriptive pool-level statistics, complementing earlier analytical results, providing grounding for LP vault strategy risks. Our work extends these foundations by providing, to the best of our knowledge, one of the first structured systematizations that unifies vault architectures, curator systems, and strategy design (including failure modes) into a single coherent framework. This systematization is organized around three research questions, one per taxonomy: RQ1 (Vault Exposure Taxonomy): How can DeFi vaults be classified by primary exposure, leverage model, and target outcome, and what risk–yield profile characterizes each class? RQ2 (Curator Governance Taxonomy): How do curator-mediated control planes operate in practice, and what scope, fee structures, and accountability mechanisms govern curator behavior? RQ3 (Strategy and Failure-Mode Taxonomy): How can strategies be classified by execution model, capital allocation, and operational dependencies, and what failure modes and mitigations characterize each class? This paper makes three main contributions. First, we provide formal definitions and a unified system model for DeFi vault architectures, covering deposit and withdrawal mechanics, share accounting, fee accrual, and operational roles. Second, we develop three complementary taxonomies for vault exposures, curator systems, and strategy design coupled with failure modes; for each taxonomy we identify recurring patterns, design tradeoffs, and observable on-chain indicators. Third, we map a representative set of production protocols to the proposed dimensions, providing a snapshot of the current ecosystem. We focus on on-chain vault systems in which deposits, share accounting, and strategy interactions are at least partially observable through blockchain state and events. We use vault broadly to include ERC-4626-compliant systems and non-standard implementations such as credit vaults, LP/range managers, structured-product vaults, and modular asset-management platforms with explicit curator layers. We exclude purely off-chain asset-management products and centralized yield programs. A key limitation is that many production vaults depend on partially off-chain components (keepers, oracle operations, governance processes) that are not fully observable on-chain and therefore require careful threat modeling.

2

Methodology

This systematization combines literature review, protocol documentation analysis, and security-incident evidence. We surveyed prior work on DeFi yield aggregation, automated market makers, tokenized vault standards, and smart-contract security to identify candidate analytical dimensions and recurring design concerns [16,62,67,4,50,38,49]. We then reviewed documentation, whitepapers, and audit materials for more than 20 production vault systems. Protocols were included if they (i) manage pooled user capital through smart contracts, (ii) expose deposit and withdrawal interfaces, and (iii) deploy capital into yield-generating strategies. The resulting corpus is representative rather than exhaustive: it spans yield aggregators, lending and credit vaults, liquidity-management vaults, options and structured-product vaults, liquid staking vaults, and modular asset-management platforms. The taxonomies in Sections 5 to 7 were derived iteratively through bottom-up feature coding and a final validation pass ensuring representative systems map cleanly to the

Decentralized Vaults: Architectures and Curator Systems

3

proposed dimensions. The security analysis in Section 8 synthesizes audit reports, incident post-mortems, and prior smart-contract security literature.

3

Background and Definitions

Vault System An on-chain contract system that pools deposits, tracks proportional ownership through shares, allocates capital to one or more strategies, and allows users to redeem shares for underlying assets according to a defined conversion rule. We use vault system as an umbrella term that includes both ERC-4626 tokenized vaults and multi-asset or modular vault architectures not covered by the ERC-4626 specification [54]. ERC-4626 Tokenized Vault A standardized single-asset vault interface extending ERC-20 shares with deposit/mint and withdraw/redeem entrypoints, plus standardized asset-share conversion and accounting queries [54]. The standard does not standardize fee structures, strategy disclosure, or risk parameters, leaving these critical design dimensions to individual implementations [45]. Share Accounting and Conversions Shares represent a pro-rata claim on vault-reported assets At . A canonical conversion maps an asset deposit d to minted shares s = d · St /At when At , St > 0, with an initial 1:1 convention otherwise; redemption of s shares returns a = s · At /St . In ERC-4626 these are exposed via convertToShares and convertToAssets [45]. Price Per Share (PPS) The vault share exchange rate, defined as the ratio between total vault assets At and outstanding vault shares St , increases with net gains and decreases with net losses as reflected in At ; however, it may temporarily differ from the vault’s economic net asset value because of reporting latency or unrealized profit and loss [65]. Strategy A capital deployment pattern that interacts with one or more external protocols (lending markets, liquidity pools, derivatives venues) to generate yield, manage risk, or provide liquidity. Strategies may be embedded in the vault contract, implemented through adapter contracts, or operationally triggered by off-chain agents [65]. Curator, Allocator, Keeper A curator selects strategies/markets for inclusion, configures risk parameters, and monitors execution; curators may be governance-driven or independent and may be compensated through fee splits [41]. An allocator determines capital distribution across strategies in a multi-strategy vault [65]. A keeper is an off-chain agent that monitors vault state and external conditions, submitting transactions to trigger rebalancing, compounding, or other strategy actions [64,11]; keeper liveness is a critical operational dependency. Fee Mechanisms Management fees are typically charged as an annualized rate on assets under management and are often implemented via share inflation (minting shares to a fee recipient), diluting existing holders [45]. Performance fees are charged on gains, often above a high-water mark (HWM) defined over PPS, and are realized via asset transfers or share minting depending on the implementation [42]. Deposit and Withdraw Flows Deposits transfer assets to the vault and mint shares. Withdrawals may be (i) immediate, (ii) queued if positions must be unwound, or (iii) subject to lockups/cooldowns. Gating mechanisms may limit withdrawal size/frequency under stress to preserve solvency [34,52]. Risk Concepts Smart contract risk: exploitable vulnerabilities in vault, strategy, or adapter contracts leading to loss of funds or incorrect accounting [4,50]. Market risk: adverse price movements affecting underlying assets or strategy positions [62]. Liquidity risk: inability to satisfy withdrawals at reasonable cost [16]. Oracle risk: inaccurate, stale, or manipulated price feeds causing incorrect execution or valuation [35,12]. Governance and privileged access risk: malicious, negligent, or compromised governance/curators causing harmful parameter changes or emergency actions [62,7]. Operational risk: off-chain dependencies (keepers, RPC, monitoring) failing to execute required actions in time. Cross-chain/bridge risk: bridge or messaging dependencies being exploited or suffering liveness failures, impacting cross-chain strategies. Counterparty and legal risk: off-chain custodians or legal structures backing RWA strategies failing, creating losses not enforceable on-chain.

4

4

D. Mancino and L. Pennella

System Model and Architectural Patterns

System Model We model a vault system as a tuple (V, U, A, S, C, K) where: V is the vault contract managing deposits, shares, and asset accounting; U = {u1 , . . . , un } is the set of users; A is the set of supported underlying assets (typically a single token under ERC-4626); S = {s1 , . . . , sm } is the set of strategy modules; C is the curator set; and K is the set of keepers/automation agents. Deposit and Withdraw User ui calls deposit(amount) to transfer d assets, receiving s = d · Stotal /Atotal shares; redemption of s shares returns a = s · Atotal /Stotal , immediately if liquid assets suffice, otherwise via strategy unwinding or withdrawal queue [54,34]. Strategy Execution and Fee Accrual Curator C selects strategies sj ∈ S and configures parameters; the vault allocates capital directly or via adapters, and keepers k ∈ K submit transactions to trigger strategy actions. Strategy actions may affect the vault’s economic NAV before the reported asset value At is updated, creating temporary accounting drift due to reporting latency, oracle updates, or unrealized P&L [64]. Management fees accrue periodically; performance fees apply on gains above HWM [42]. Monolithic vs. Modular Vaults In monolithic vaults, strategy logic is embedded directly in the vault contract; upgradeable proxy patterns may still enable evolution. Early Yearn vaults exemplified this approach with strategy code tightly coupled to vault accounting [63]. Modular vaults interact with strategy contracts via adapter interfaces, enabling strategies to be added, removed, or upgraded without redeploying the vault; this pattern is increasingly common (e.g., Yearn v3, ERC-4626-based implementations) [65,45]. Modular designs enable rapid iteration and faulty-module deactivation, but do not guarantee loss isolation and can expand the attack surface at adapter/allowance boundaries. Single-Strategy vs. Multi-Strategy Vaults Single-strategy vaults deploy most capital to one strategy, with PPS primarily driven by that strategy and straightforward attribution. Multi-strategy vaults allocate across multiple strategies, diversifying exposures when correlations are controlled but introducing allocator risk and more complex attribution [30]. Poor allocator logic can concentrate rather than diversify risk, particularly when decisions are based solely on recent yield without risk adjustment. Share Accounting Models Global share accounting applies a single share class across all depositors with uniform strategy exposure; this is the ERC-4626 default and provides maximum simplicity and composability [54]. Tranched share accounting divides deposits into senior and junior tranches with different risk/return profiles, typically via separate share classes or vault instances [30,28]. Per-user accounting tracks positions separately, enabling heterogeneous entry prices but sacrificing share fungibility.

5

Taxonomy 1: Vault Types by Exposure

We classify vaults by primary exposure, yield source, and target risk–return profile. Categories are not strictly mutually exclusive: several production vaults combine multiple exposures. Table 1 summarizes the taxonomy. Lending Vaults Lending vaults deploy capital into lending protocols such as Aave, Compound, and Morpho [1,15,43], with sophisticated implementations optimizing across venues to capture rate differentials [30]. Yield derives from borrower interest. Risks include smart contract vulnerabilities in vault and underlying protocols, as illustrated by the March 2023 Euler Finance exploit with approximately $197 million in losses [24], liquidity risk at high utilization, and oracle manipulation that can induce incorrect liquidations and propagate bad debt to suppliers. Liquidity Provider (LP) Vaults LP vaults provide liquidity to AMMs such as Uniswap, Curve, and Balancer, often implementing automated range management for concentrated liquidity [2,17,6]. Yield derives from trading fees and liquidity mining rewards; concentrated positions can earn substantially higher yields than full-range but require active management. Key risks are impermanent loss [36], execution/MEV losses during rebalances [18,37], and parameterization risk (range selection, rebalance thresholds) which can amplify inventory risk.

Decentralized Vaults: Architectures and Curator Systems

5

Table 1. Vault type taxonomy by exposure, yield source, and risk profile. Vault Type Yield Source

Indicative APY

Primary Risks & Key Metrics

Lending Interest LP/AMM Fees, rewards Delta-Neutral Funding Options Premium Liq. Staking Consensus Restaking AVS incentives RWA Off-chain yield Stablecoin Rate differ.

2–10% [1,43] Regime-dependent 5–20% [23] 5–20% [52,57] 3–8% [33,53] Regime-dependent 3–10% [28,40] 1–5% [17,65]

Protocol exploit [24], high util.; utilization, liq. depth IL [36], MEV [18]; IL%, rebalance freq., net fee yield Liquidation, funding flip; net delta, margin util. Adverse exercise; capture rate, strike dist. Slashing, depeg; peg stability, validator uptime Slashing, operator; AVS health, operator perf. Counterparty, legal; attestation freq., redemp. time Depeg [13], gas erosion; net yield, rate persistence

Note: APY ranges are indicative and regime-dependent; they reflect typical observed/documented ranges rather than guaranteed returns.

Delta-Neutral Vaults Delta-neutral vaults construct positions with minimal directional exposure, typically combining long spot with short perpetuals to earn funding rates [23,49], requiring sophisticated margin management across decentralized venues (GMX, dYdX) and potentially centralized exchanges, introducing counterparty risk [27,20]. The primary failure mode is liquidation from insufficient margin during volatility spikes; funding regimes can flip negative, requiring reserve buffers. Monitoring tracks net delta deviation, margin utilization, and realized versus expected funding. Options Vaults Options vaults sell options to earn premium income, with covered calls and cash-secured puts the most common structures [52,57]. Yield reflects implied volatility, time to expiration, and strike distance. The risk profile is asymmetric: covered call vaults underperform buy-and-hold in strong rallies when options are exercised; put vaults face downside exposure when puts are exercised above market [47]. Illiquidity in on-chain options markets can prevent execution at fair prices. Liquid Staking and Restaking Vaults Liquid staking vaults stake native assets via protocols such as Lido or Rocket Pool, receiving consensus rewards while maintaining liquidity through liquid staking tokens (LSTs) [33,53,32]. Restaking vaults extend this model by restaking LSTs through layers like EigenLayer to earn additional incentives from actively validated services (AVSs) [21]. The composability of LSTs enables layered yield strategies but compounds risk through multiple slashing conditions and protocol dependencies. The risk surface includes slashing if underlying validators misbehave [8], depegging of LSTs, and smart contract risk across multiple protocol layers. Real-World Asset (RWA) Vaults RWA vaults invest in tokenized off-chain assets such as Treasury bills, credit instruments, real estate, or trade finance [28,10,40,61]. They introduce significant counterparty and legal risk: the enforceability of on-chain claims on off-chain assets depends on legal structures, jurisdiction, and custodian reliability. Insolvency or fraud by off-chain custodians can result in total loss with limited recourse for on-chain depositors [10]. Additional risks include valuation latency, redemption KYC constraints, and jurisdictional enforceability. Stablecoin Yield-Arbitrage Vaults Stablecoin yield-arbitrage vaults exploit rate differentials between stablecoin lending markets, liquidity pools, or yield protocols [17,65], with typically modest but stable yields. Risks include depeg events (the March 2023 USDC depeg demonstrated that even major stablecoins face significant dislocations [13]) and gas cost erosion of thin spreads.

6

Taxonomy 2: Curator Systems and Curation Markets

The curator role represents a significant evolution from early vaults where protocol governance directly controlled all parameters, toward specialized intermediaries who accept compensation in exchange for expertise and risk selection [41]. We classify curator systems by their decision-rights structure (who can approve/configure strategies and parameters), the scope of control (what can be changed), and the incentive/accountability layer (how curators are compensated and constrained). Table 2 summarizes the dimensions.

6

D. Mancino and L. Pennella

Curator Types and Strategy Inclusion Protocol governance curation approves strategies via token-weighted voting or multisig decisions [65]: decentralized but slow, subject to voter apathy and governance capture, and often lacking domain expertise. Delegated curation delegates authority to vetted curators who operate within governance-defined limits, enabling faster iteration while maintaining accountability through reputation, bonds, or insurance [41]; this model introduces curator-cartel and collusion risks. Third-party curator systems typically feature permissioned allocation with explicit strategy whitelisting and user opt-in, while permissionless curation with risk scoring allows any strategist to submit strategies subject to automated risk scores or allocation caps [22,26]: maximal innovation but reliant on robust scoring infrastructure. Closely related is the strategy-inclusion policy. In permissionless onboarding, any strategy meeting interface requirements can be proposed, while activation may still be gated by curator caps or governance approval. Permissioned systems require explicit curator whitelisting after review, reducing risk but centralizing control [41]. Hybrid approaches combine open submission with curator veto or risk-adjusted allocation caps; the inclusion policy directly shapes the vault’s risk surface and trust assumptions. Scope of Curation Curators vary in what they control. Strategy curation selects which contracts the vault can deploy to. Market and venue curation determines whitelists for lending pools, AMMs, and derivatives venues. Collateral curation sets accepted collateral types and LTV ratios. Risk limit curation establishes exposure caps, slippage tolerances, and leverage limits. Oracle curation determines approved price feeds [41,26]. Fee Structures and Economic Incentives Management fees are commonly set in the low single digits in major vault systems, providing stable income but weak performance sensitivity; some platforms enforce protocol-level caps on curator-configurable fees [42,65]. Performance fees (typically 5–20% of gains above HWM) align curator incentives with user returns but can amplify short-horizon risk-taking; Ribbon charges 10% [52], Morpho caps performance fees at 50% of yield [42], and Gauntlet-curated vaults apply fees in the 0–20% range [26]. Curator take rates allocate a percentage of total vault fees specifically to curators; referral fees compensate distribution channels; token emissions distribute governance or incentive tokens, potentially creating unsustainably high advertised APYs that compress once emissions decline [16,31]. Custody and Emergency Controls Vault designs differ markedly in privileged control over user funds. In minimal-control designs, users enter/exit via contract-defined functions and no privileged role can arbitrarily transfer user assets, improving decentralization but limiting incident response. Governance multisig or timelocked admin models grant privileged control over pausing, parameter updates, strategy migration, and emergency exits [65]. Curator with timelock models enable parameter changes after a delay so users can exit if they disagree. Guardian models grant a guardian narrow powers to pause the vault or halt specific strategies but prohibit fund withdrawal [46]. Emergency actions commonly include pause functions, strategy deactivation, and emergency exit procedures whose effectiveness depends on the liquidity and constraints of underlying protocols. Accountability and Principal-Agent Dynamics Reputation and scoring systems track curator performance and surface scores to users [22]; challenges include gamification, lack of standardized metrics, and attribution ambiguity when losses result from external factors. Slashing mechanisms require curators to post collateral reducible upon rule violations [21]; few vault systems currently implement meaningful curator slashing. Insurance and underwriting provide coverage for losses from negligence [44], with challenges in pricing risk and managing moral hazard. Transparency and disclosure requirements mandate curator reporting of strategy details, parameters, conflicts of interest, and execution reports [5]; trade-offs exist between transparency and alpha protection. The curator–depositor relationship exhibits classic principal-agent problems partially observable through on-chain metrics. Moral hazard in performance fees: curators may pursue volatile strategies to maximize upside capture while users bear downside; observable proxies include PPS volatility, drawdown depth/frequency, and large single-period losses. Allocation to affiliated strategies: capital directed toward curator-owned strategies; proxies include affiliated-strategy share and comparative performance. Delayed risk disclosure: lag between external exploit signals and vault exits provides a measurable proxy. Curator centralization: few curators controlling disproportionate TVL creates systemic risk; HHI and top-k curator TVL shares quantify concentration [26].

Decentralized Vaults: Architectures and Curator Systems

7

Table 2. Curator system taxonomy by type, scope, fees, and accountability.

7

Dimension

Categories

Key Considerations

Type

Protocol Gov. Delegated Third-Party Permless+Scoring

Decentralized, slow, capture risk Faster iteration, requires selection, cartel risk Market competition, reputation needed Max innovation, requires scoring infra

Scope

Strategies Markets/Venues Collateral Risk Limits Oracles

Which contracts receive capital Approved lending pools, AMMs, perps Accepted collateral types and LTVs Exposure caps, leverage, slippage Approved price feeds and data sources

Fees

Mgmt (typical low single digits) Perf. (typical 5–20% [52,65]) Take Rate Emissions

Stable income; weak performance sensitivity Aligns upside; may encourage volatility Curator-specific fee share Token incentives; sustainability concerns

Custody

Minimal Privilege Gov. Multisig/Timelock Curator+Timelock Guardian

Decentralized, limited incident response Privileged control with delay Parameter changes with user exit window Pause-only powers, no fund withdrawal

Accountab.

Reputation Slashing Insurance Disclosure

Performance tracking; gamification risk Collateral at risk; requires objective triggers Coverage for losses; moral hazard concerns Transparency reqs; verifiability challenges

Taxonomy 3: Strategy Design and Execution

We categorize strategies by execution model, capital allocation pattern, reinvestment, and liquidity management. Failure modes specific to each class are analyzed in Section 8. Table 3 summarizes the dimensions. Strategy Execution Models Static strategies deploy capital once and hold positions until withdrawal, with minimal operational and oracle requirements [33]; they suit exposures like liquid staking where positions need no active management. Rule-based strategies employ deterministic logic triggered by observable on-chain conditions [65], with keepers monitoring conditions and submitting transactions; cost structures include periodic gas and keeper incentives scaling with trigger frequency. Adaptive strategies dynamically adjust parameters based on market signals such as volatility, liquidity depth, or relative-value indicators [25]; range management for concentrated liquidity exemplifies this model, often requiring off-chain computation and multiple oracle feeds. Keeper-driven discretionary strategies grant keepers flexibility within defined bounds, suited to situations where optimal actions cannot be fully specified in advance but can be bounded by risk limits [55]. MEV-aware execution augments any execution model with private transaction submission, batching, and strict slippage bounds to reduce adversarial ordering losses during harvests and rebalances [18,37]. Rebalancing Triggers Strategy execution requires a trigger model. Time-based rebalancing executes at fixed intervals, providing predictability but potentially suboptimal timing [9]. Threshold-based rebalancing fires when a metric (allocation drift, IL, price deviation) exceeds a threshold, more efficient but requiring continuous keeper monitoring [25]. Oracle-conditioned rebalancing uses external feeds, introducing oracle dependency [12]. Keeper/automation-based rebalancing relies on off-chain agents to execute predefined triggers, introducing liveness and execution risk [11]. Governance-based rebalancing relies on curators or governance to manually trigger changes, providing flexibility but introducing latency and human-error risk. Capital Allocation Patterns Single-venue allocation directs all capital to one protocol or pool, maximizing simplicity but concentrating risk [33]. Multi-venue fixed splits capital with static allocations [9]. Multi-venue dynamic shifts capital between venues based on yield, risk, or capacity signals, capturing higher returns but

8

D. Mancino and L. Pennella Table 3. Strategy design taxonomy by execution, allocation, reinvestment, and liquidity management. Dimension

Category

Compl.

Key Characteristics

Execution

Static Rule-Based Adaptive Discretionary

Minimal Low–Med Med–High Variable

Deploy once, hold; no keepers Deterministic triggers; keeper monitoring Dynamic params; off-chain computation Keeper flexibility within bounds

Trigger

Time-Based Low Threshold-Based Med Oracle-Conditioned Med Governance-Based Variable

Fixed intervals; predictable timing Metric-driven; continuous monitoring External feeds; oracle dependency Manual triggers; latency risk

Allocation

Single-Venue Multi-Venue Fixed Multi-Venue Dyn. Cross-Chain

Minimal Low Med–High High

Maximum simplicity; concentrated risk Static diversification Yield optimization; frequent rebalancing Bridge risk; operational complexity

Medium Low Minimal

Max growth; gas costs per harvest Operator-triggered; timing risk Distribute or hold rewards

Reinvestment Auto-Compound Manual Harvest No Reinvestment Liquidity

Withdrawal Queue Medium Partial Withdrawal Medium Buffer Cash Low Redeem in Kind Low–Med

Run protection; reduced user liquidity Immediate up to buffer; remainder queued Immediate access; cap. efficiency loss Preserves vault liq.; user complexity

requiring allocator logic and more frequent rebalancing [30]. Cross-chain allocation deploys capital across multiple blockchain networks, enabling access to chain-specific opportunities but introducing bridge risk and substantial operational complexity [67,39]. Dynamic and cross-chain allocations are particularly sensitive to transaction costs, slippage, and MEV, which can offset theoretical gains. Reinvestment, Hedging, and Liquidity Management Auto-compounding automatically harvests and reinvests rewards, maximizing compound growth but incurring gas costs per harvest [9]; manual harvesting relies on operators or users to trigger collection; no reinvestment distributes rewards as separate tokens. Hedging primitives include futures/perpetuals for directional hedging [23], options for asymmetric protection or income generation [52], and stable-swap rebalancing for depeg cascades. Liquidity-side mechanisms include withdrawal queues processing redemptions as positions unwind [34], buffer cash reserves enabling immediate withdrawals at the cost of capital efficiency [65], partial withdrawals combining immediate redemption with queued remainders, and redemption in kind returning pro-rata underlying positions and transferring complexity to users.

8

Security, Risk, and Failure Modes

This section analyzes security vulnerabilities and risk factors specific to vault systems, mapping failure modes to mitigation controls and observable on-chain indicators. Effective risk management requires understanding both vault-level vulnerabilities (affecting share accounting and user funds) and strategy-level risks (affecting deployed capital). Table 4 provides a comprehensive mapping. Reentrancy in Deposit and Withdraw Vaults that perform external calls before updating internal accounting can be vulnerable to reentrancy [4]; attackers can re-enter deposit/withdraw logic to exploit transient inconsistencies in share accounting. Mitigations include checks-effects-interactions, reentrancy guards, and minimizing external calls in sensitive paths. Share Inflation Attacks An attacker may manipulate PPS by donating assets directly to the vault without minting shares, exploiting rounding asymmetries for subsequent deposits/withdrawals [46]. This is most

Decentralized Vaults: Architectures and Curator Systems

9

acute when total share supply is small. Mitigations include initial seeding/locked shares, virtual share offsets, minimum initial liquidity, and conversion logic aligned with ERC-4626 rounding conventions. Rounding Errors in Share Calculation Integer arithmetic in conversions can introduce systematic rounding leakage exploitable via repeated small operations [45]. Mitigation requires high-precision math, consistent rounding rules aligned with ERC-4626 preview functions, and virtual share offsets at low supply. Sandwich and Execution Attacks Around User Actions When deposits/withdrawals trigger price-impacting actions (swaps, liquidity adjustments, harvests) or rely on in-block price signals, MEV bots can sandwich the execution, worsening the effective conversion rate for users [18,37]. Mitigations include explicit slippage bounds, batching or delayed execution, private transaction submission for rebalances, and cooldown/queue mechanisms for price-sensitive paths. Oracle Manipulation Vaults depending on external feeds for valuation, risk checks, or oracle-conditioned rebalancing are vulnerable to manipulation or stale data [35], which can force mispricing, unsafe rebalances, or favorable withdrawals when accounting relies on oracle-derived valuations. Mitigations include TWAP, multi-source aggregation, staleness bounds, and sanity checks against on-chain liquidity. PPS Accounting Drift and Insolvency Unrealized strategy gains/losses may not be immediately reflected onchain, causing PPS to diverge from true NAV [65]; mitigations include regular NAV updates and conservative mark-to-market. Extreme strategy losses can cause vault assets to fall below liabilities, preventing full redemption [24]; mitigation includes strategy risk limits, stop-loss triggers, tranched structures absorbing losses in junior tranches first, and external insurance coverage. Strategy-Level Risks Liquidation cascades: leveraged positions forcibly closed, potentially triggering further liquidations; mitigation via conservative LTV, automated deleveraging, and monitoring [1]. Depeg events: pegged-asset price deviations; mitigation via diversification and active peg monitoring with exit triggers [13]. Bridge exploits: cross-chain strategies remain a major source of large losses [67,51,39]; mitigation includes minimizing bridge usage, per-bridge exposure limits, well-audited canonical bridges where possible, continuous health monitoring, and rapid de-risking. MEV exploitation: value extraction via frontrunning and sandwiching [18,38]; mitigation via private mempool submission, transaction splitting, and MEV-aware execution. Keeper failure: off-chain keepers failing to execute required actions [11]; mitigation via redundancy, competitive keeper networks, and incentive design. Admin key compromise: enabling unauthorized parameter changes or fund extraction [46]; mitigation via multisig, timelocks, and key-management best practices. Governance and Curator Risks Malicious or negligent parameter changes can alter vault behavior unfavorably; timelocks delaying parameter changes and bounded parameter ranges allow users to exit before changes take effect [65]. Malicious curator behavior includes directing capital to inappropriate strategies for personal benefit; reputation systems, slashing bonds, and transparent allocation policies provide mitigation [41], with rapid allocation to untested strategies a leading indicator. Delayed disclosure of risks or incidents is partially mitigated by automated monitoring and standardized reporting [5]; lag between public incident reports and vault exit actions quantifies information asymmetry.

9

Protocol Landscape

Table 5 maps a representative snapshot of 22 production vault systems to the taxonomy dimensions developed above, organized by category, control model, chain coverage, and salient design features. The mapping illustrates how modular architectures, heterogeneous curator and manager roles, and stronger dependence on off-chain coordination, keeper execution, and cross-protocol composability now shape the ecosystem, blurring the boundary between asset management, market-neutral structuring, and protocol-layer infrastructure.

10

D. Mancino and L. Pennella Table 4. Failure modes mapped to mitigation controls and observable on-chain indicators. Failure Mode Cat.

Mitigation

Observable Indicator

Reentrancy SC Share Inflation Acct Rounding Acct Sandwich MEV Oracle Manip. Ext PPS Drift Acct Insolvency Sys Liq. Cascade Str Depeg Mkt Bridge Exploit Infr MEV Extract. Exec Keeper Failure Ops Admin Compr. AC Curator Malice Gov Delayed Discl. Transp

Guards, CEI pattern Virtual shares, min deposit Precision, vault-favor rnd TWAP, cooldowns, slip. chk TWAP, multi-source, stale chk Regular NAV updates Risk limits, stop-loss, insurance Conservative LTV, deleverage Diversification, peg monitor Multi-bridge, health monitor Private mempool, splitting Redundancy, incentives Multisig, timelocks Reputation, slashing, bonds Auto-monitoring, standards

Multi dep/wd in single tx High PPS on first deposit Repeated small txs, PPS drift Adjacent block patterns PPS spike + large wd Uncorrelated PPS change PPS collapse, wd failures Liq. events, price drops Peg below threshold Bridge incidents Elevated slippage Missed rebalances Unexpected param changes Alloc. to untested strats Lag: incident to vault exit

Table 5. Protocol catalog with taxonomy classifications (representative snapshot, 01/2026). Control model: Gov=governance; DAO=DAO gov; Str=strategist layer; Manager=external manager; Delegate=credit delegate; Backers=junior backers; Operator=operator set; Config=configurable parameters.

10

Protocol

Category

Control model Chains

Yearn [65] Beefy [9] Idle [30] Sommelier [55] Morpho [41] Maple [40] Goldfinch [28] TrueFi [60] Centrifuge [10] Gamma [25] Arrakis [3] Steer [56] Ribbon [52] Thetanuts [57] Enzyme [22] dHEDGE [19] Tokemak [58] Lido [33] Rocket Pool [53] EigenLayer [21] Ethena [23] OUSD [48]

Aggregator Aggregator Aggregator Aggregator Lending Credit Credit Credit RWA LP Mgmt LP Mgmt LP Mgmt Options Options Platform Platform Platform Staking Staking Restaking Delta-Neutral Stablecoin

Gov+Str DAO+Str Gov 3rd-party Curator Delegate Backers Gov (stakers) SPV Protocol Config Protocol Gov Gov Manager Manager Gov DAO Operator Operator Protocol Protocol

Key Features

Multi ERC-4626 v3, modular 20+ Auto-compound, no mgmt fee ETH,POLY Best Yield, tranches Multi Off-chain computation ETH,BASE Curator markets, caps ETH,SOL Institutional lending ETH Sr/jr tranches ETH Token-based voting Multi RWA pools, SPVs Multi Hypervisor vaults Multi Parametric LP mgmt Multi Multi-DEX coverage ETH,AVAX Weekly epochs Multi Multi-chain options ETH,POLY Policy contracts Multi Discretionary trading ETH Liquidity direction ETH LST infrastructure ETH Permissionless operators ETH AVS yield, slashing Multi Funding-rate carry ETH Auto-yield, peg

Conclusion

This systematization provides a structured view of DeFi vaults as smart-contract-based asset management systems. We introduced three taxonomies (vault types by primary exposure and target outcome, curator systems by decision rights and accountability, and strategies by execution model and operational dependencies) and mapped a representative snapshot of 22 production protocols to these dimensions. Our security analysis organized vault-relevant failure modes into actionable mitigations and on-chain monitoring proxies, spanning accounting exploits, oracle-conditioned execution risks, MEV-sensitive operations, keeper liveness dependencies, and privileged-role failures.

Decentralized Vaults: Architectures and Curator Systems

11

Three takeaways emerge. First, adapter-based modular designs are increasingly prevalent to enable strategy iteration but expand the attack surface at strategy–vault boundaries. Second, curator-mediated control planes introduce principal–agent dynamics with heterogeneous and often weakly enforceable accountability. Third, operational dependencies (keepers, oracles, execution pathways, and cross-chain components) frequently dominate realized risk in actively managed strategies. Several open directions emerge from this analysis and motivate continued research. Standardized and independently verifiable curator disclosure schemas would enable cross-vault comparison of fee policies, risk posture, and conflicts of interest [5]. Reproducible measurement of depositor-level MEV externalities, with counterfactual execution baselines, remains an open challenge given the diversity of harvest, rebalance, and bridge operations [18,38,39]. Cross-chain accountability and canonical state-reconstruction tooling are needed to attribute losses across non-atomic execution, divergent finality assumptions, and bridge infrastructure [67,39]. Calibrated bond, slashing, and clawback-compatible fee mechanisms would strengthen curator incentive alignment with long-term depositor welfare. Finally, composability-aware systemic-risk tooling is needed to monitor recursive vault-on-vault constructions, shared oracles, common bridges, and concentrated curator control, which together create contagion pathways that are not continuously observable in practice [29,59]. Overall, the frameworks and mappings provided here aim to support rigorous analysis, safer smart-contract design, and more informed participation in blockchain-based financial applications.

Acknowledgement The contribution of Luca Pennella was funded in part by the PayPal-FNR PEARL Chair in Digital Financial Services, FNR grant reference 13342933/Gilbert Fridgen, and by the FutureFinTech National Centre of Excellence in Research and Innovation, FNR grant reference 16570468, with the support of Luxembourg’s Ministry of Finance.

References 1. Aave: Aave v3 documentation. https://docs.aave.com/developers (2024), accessed 2026-02-03 2. Adams, H., Zinsmeister, N., Salem, M., Keefer, R., Robinson, D.: Uniswap v3 core whitepaper. https://uniswap. org/whitepaper-v3.pdf (2021), accessed 2026-02-03 3. Arrakis Finance: Arrakis finance documentation. https://docs.arrakis.fi/ (2024), accessed 2026-02-03 4. Atzei, N., Bartoletti, M., Cimoli, T.: A survey of attacks on Ethereum smart contracts (SoK). Lecture Notes in Computer Science 10204, 164–186 (2017). https://doi.org/10.1007/978-3-662-54455-6_8 5. Awyong, A.: The role of disclosure in decentralized finance markets: Evidence from twitter. https://papers.ssrn. com/sol3/papers.cfm?abstract_id=5150613 (2024), accessed 2026-02-03 6. Balancer Labs: Balancer documentation. https://docs.balancer.fi/ (2024), accessed 2026-02-03 7. Barbereau, T., Smethurst, R., Papageorgiou, O., Rieger, A., Fridgen, G.: DeFi, not so decentralized: The measured distribution of voting rights. In: Proceedings of the 55th Hawaii International Conference on System Sciences (HICSS). pp. 6043–6052 (2022). https://doi.org/10.24251/HICSS.2022.734, https://hdl.handle.net/10125/ 80074 8. beaconcha.in: Beacon chain slashings dashboard. https://beaconcha.in/validators/slashings, accessed 202602-03 9. Beefy Finance: Beefy finance documentation. https://docs.beefy.finance/ (2024), accessed 2026-02-03 10. Centrifuge: Centrifuge documentation. https://docs.centrifuge.io/ (2024), accessed 2026-02-03 11. Chainlink: Chainlink automation documentation. https://docs.chain.link/chainlink-automation, accessed 2026-02-03 12. Chainlink: Chainlink data feeds documentation. https://docs.chain.link/data-feeds, accessed 2026-02-03 13. Circle: USDC depeg event analysis. https://www.circle.com/blog/an-update-on-usdcand-silicon-valley-bank (2023), published 2023-03-11; accessed 2026-02-03 14. CoinGecko: 2025 Q1 Crypto Industry Report. https://www.coingecko.com/research/publications/ 2025-q1-crypto-report (2025), updated 2025-04-16; accessed 2026-02-03 15. Compound Labs: Compound iii documentation. https://docs.compound.finance/ (2024), accessed 2026-02-03 16. Cousaert, S., Xu, J., Matsui, T.: SoK: Yield Aggregators in DeFi. arXiv preprint arXiv:2105.13891 (2021), https://arxiv.org/abs/2105.13891, accessed 2026-02-03 17. Curve Finance: Curve finance documentation. https://resources.curve.fi/ (2024), accessed 2026-02-03

12

D. Mancino and L. Pennella

18. Daian, P., Goldfeder, S., Kell, T., Li, Y., Zhao, X., Bentov, I., Breidenbach, L., Juels, A.: Flash boys 2.0: Frontrunning in decentralized exchanges, miner extractable value, and consensus instability. In: IEEE Symposium on Security and Privacy (SP). pp. 910–927 (2020). https://doi.org/10.1109/SP40000.2020.00040 19. dHEDGE: dhedge documentation. https://docs.dhedge.org/ (2024), accessed 2026-02-03 20. dYdX: dydx documentation. https://docs.dydx.exchange/ (2024), accessed 2026-02-03 21. EigenLayer Team: EigenLayer: The restaking collective. https://docs.eigenlayer.xyz/assets/files/ EigenLayer_WhitePaper-88c47923ca0319870c611decd6e562ad.pdf (2023), EigenLabs whitepaper; accessed 202602-03 22. Enzyme Finance: Enzyme finance documentation. https://docs.enzyme.finance/ (2024), accessed 2026-02-03 23. Ethena Labs: Ethena documentation. https://docs.ethena.fi/ (2024), accessed 2026-02-03 24. Euler Finance: Euler finance exploit post-mortem. https://blog.euler.finance/ euler-protocol-attack-post-mortem-f9d1d8b254a2 (2023), published 2023-03-13; accessed 2026-02-03 25. Gamma Strategies: Gamma strategies documentation. https://docs.gamma.xyz/ (2024), accessed 2026-02-03 26. Gauntlet: Gauntlet VaultBook: Vault curation framework and risk methodology. https://vaultbook.gauntlet. xyz (2025), accessed 2026-03-10 27. GMX: Gmx documentation. https://docs.gmx.io/ (2024), accessed 2026-02-03 28. Goldfinch: Goldfinch protocol documentation. https://docs.goldfinch.finance/ (2024), accessed 2026-02-03 29. Gudgeon, L., Werner, S., Perez, D., Knottenbelt, W.J.: DeFi protocols for loanable funds: Interest rates, liquidity and market efficiency. In: Proceedings of the 2nd ACM Conference on Advances in Financial Technologies (AFT). pp. 92–112 (2020). https://doi.org/10.1145/3419614.3423254 30. Idle Finance: Idle finance documentation. https://docs.idle.finance/ (2024), accessed 2026-02-03 31. Kivilo, S., Norta, A., Hattingh, M., Avanzo, S., Pennella, L.: Designing a token economy: Incentives, governance, and tokenomics (2026), https://arxiv.org/abs/2602.09608 32. Kraner, B., Pennella, L., Vallarano, N., Tessone, C.J.: Money in Motion: Micro-Velocity and Usage of Ethereum’s Liquid Staking Tokens. In: 7th Conference on Advances in Financial Technologies (AFT 2025). Leibniz International Proceedings in Informatics (LIPIcs), vol. 354, pp. 9:1–9:18 (2025). https://doi.org/10.4230/LIPIcs.AFT.2025.9 33. Lido: Lido documentation. https://docs.lido.fi/ (2024), accessed 2026-02-03 34. Lido: Lido withdrawals. https://docs.lido.fi/contracts/withdrawal-queue-erc721 (2024), accessed 2026-0203 35. Liu, B., Szalachowski, P., Zhou, J.: A first look into defi oracles. In: IEEE International Conference on Decentralized Applications and Infrastructures (DAPPS). pp. 39–48 (2021). https://doi.org/10.1109/DAPPS52256.2021.00010 36. Loesch, S., Hindman, N., Richardson, M.B., Welch, N.: Impermanent loss in uniswap v3. arXiv preprint arXiv:2111.09192 (2021), https://arxiv.org/abs/2111.09192 37. Mancino, D., Leporati, A., Viviani, M., Denaro, G.: Decentralization or favoritism? An analysis of Ethereum transactions and maximal extractable value strategies. In: 2025 IEEE International Conference on Blockchain and Cryptocurrency (ICBC). pp. 1–9 (2025). https://doi.org/10.1109/ICBC64466.2025.11114553 38. Mancino, D., Sevim, H.O.: Sok: The evolution of maximal extractable value, from miners to cross-chain (2026), https://arxiv.org/abs/2603.07716 39. Mancino, D., Sevim, H.O., Gonzalez, O.S.: Bunny hops and blockchain stops: Cross-chain MEV detection with N-hops. In: 2025 7th Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS). pp. 1–4 (2025). https://doi.org/10.1109/BRAINS67003.2025.11302948 40. Maple Finance: Maple finance v2 documentation. https://docs.maple.finance/ (2024), accessed 2026-02-03 41. Morpho: Curators explained. https://morpho.org/blog/curators-explained/ (Dec 2025), published 2025-12-22; accessed 2026-02-03 42. Morpho: Fees. https://docs.morpho.org/curate/concepts/fee/ (2026), updated 2026-01-02; accessed 2026-0203 43. Morpho Labs: Morpho blue whitepaper. https://docs.morpho.org/morpho/ (2024), accessed 2026-02-03 44. Nexus Mutual: Nexus mutual documentation. https://docs.nexusmutual.io/ (2024), accessed 2026-02-03 45. OpenZeppelin: ERC-4626 (openzeppelin contracts documentation). https://docs.openzeppelin.com/contracts/ 5.x/erc4626, accessed 2026-02-03 46. OpenZeppelin: Openzeppelin security best practices. https://docs.openzeppelin.com/contracts/5.x/api/ security (2024), accessed 2026-02-03 47. Opyn: Opyn whitepaper: Decentralized options trading. https://opyn.gitbook.io/opyn/ (2020), accessed 202602-03 48. Origin Protocol: Origin dollar documentation. https://docs.ousd.com/ (2024), accessed 2026-02-03 49. Pennella, L., Saggese, P., Pinelli, F., Galletta, L.: A unified framework and comparative study of decentralized finance derivatives protocols. Electronic Markets 36(1), 70 (2026). https://doi.org/10.1007/ s12525-026-00925-9

Decentralized Vaults: Architectures and Curator Systems

13

50. Perez, D., Livshits, B.: Smart contract vulnerabilities: Vulnerable does not imply exploited. In: 30th USENIX Security Symposium. pp. 1325–1341 (2021), https://www.usenix.org/conference/usenixsecurity21/ presentation/perez 51. Rekt News: Rekt leaderboard. https://rekt.news/leaderboard/, accessed 2026-02-03 52. Ribbon Finance: Ribbon finance documentation. https://docs.ribbon.finance/ (2023), accessed 2026-02-03 53. Rocket Pool: Rocket pool documentation. https://docs.rocketpool.net/ (2024), accessed 2026-02-03 54. Santoro, J., t11s, Jadeja, J., Cañada, A.C., Señor Doggo: ERC-4626: Tokenized vaults. https://eips.ethereum. org/EIPS/eip-4626 (2021), created 2021-12-22; accessed 2026-02-03 55. Sommelier: Sommelier finance documentation. https://docs.sommelier.finance/ (2024), accessed 2026-02-03 56. Steer Protocol: Steer protocol documentation. https://docs.steer.finance/ (2024), accessed 2026-02-03 57. Thetanuts Finance: Thetanuts finance documentation. https://docs.thetanuts.finance/ (2024), accessed 2026-02-03 58. Tokemak: Tokemak documentation. https://docs.tokemak.xyz/ (2023), accessed 2026-02-03 59. Tolmach, P., Li, Y., Lin, S.W., Liu, Y.: A survey of DeFi composability attacks and quantitative approaches. arXiv preprint arXiv:2312.14979 (2023), https://arxiv.org/abs/2312.14979 60. TrueFi: Truefi documentation. https://docs.truefi.io/ (2024), accessed 2026-02-03 61. Vella, G., Pennella, L., Ballandies, M.C.: A taxonomy of real-world asset tokenization for blockchain-based financial infrastructure (2026), https://arxiv.org/abs/2606.08534 62. Werner, S.M., Perez, D., Gudgeon, L., Klages-Mundt, A., Harz, D., Knottenbelt, W.J.: SoK: Decentralized Finance (DeFi). In: Proceedings of the 4th ACM Conference on Advances in Financial Technologies (AFT). pp. 30–46 (2022). https://doi.org/10.1145/3558535.3559780 63. Yearn Finance: Yearn v2 documentation. https://docs.yearn.fi/developers/v2/ (2023), accessed 2026-02-03 64. Yearn Finance: Vault factory (v2) — calling harvest / keepers. https://docs.yearn.fi/developers/v2/ vault-factory (2025), last updated 2025-12-16; accessed 2026-02-03 65. Yearn Finance: Vaultv3. https://docs.yearn.fi/developers/smart-contracts/V3/VaultV3 (2025), last updated 2025-12-16; accessed 2026-02-03 66. Zbandut, A., Goldstein, C.: Institutionalizing risk curation in decentralized credit (2025), https://arxiv.org/ abs/2512.11976 67. Zhang, M., Zhang, X., Zhang, Y., Lin, Z.: Security of cross-chain bridges: Attack surfaces, defenses, and open problems. In: Proceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2024). pp. 298–316 (2024). https://doi.org/10.1145/3678890.3678894, https://dl.acm.org/doi/10. 1145/3678890.3678894, Padua, Italy, September 30–October 2, 2024; accessed 2026-02-03

Related documents

• A Systematization of Knowledge on DeFi Vaults: Architectures, Curation Mechanisms, and Strategy Design#1156572
• A review of Blockchain Technology applications for financial services#421599
• The Use of Agents by Digital Financial Services Providers : Technical Note#8560
• SEC Proposes ”Regulation Crypto Assets”#683274
• Fortifying Financial Systems: Exploring the Intersection of Microservices and Banking Security#88108