How We’re Maximizing Safety & Yield With Zyfai

Every Friday, I’ll help you grow your knowledge base of the most influential apps and teams in DeFi by providing a high-level overview of projects that provide true value to the industry.  

About 3 weeks ago, Resolv’s USR stablecoin experienced a depeg event in which its price fell from $1 to $0.20 in a matter of hours.

The attacker used a vulnerability in Resolv’s architecture that allowed new USR tokens to be minted against collateral that didn’t exist. Overall, ~$80M worth of uncollateralized USR was minted against only $200K in USDC collateral.

The problem was further exacerbated by certain vault curators using oracles that continued to show stable prices for USR while it had fallen by more than 40% – this allowed users to borrow stablecoins like USDC against their USR as if no depeg had occurred. 

For more details, I covered the USR depeg in this issue of Mid-Week Market Check.

 Drift: A $285M+ Social Engineering Scheme

Just 10 days later, Drift was hit with an even bigger attack. Overall, $285M was drained from the platform after months of alleged scheming from a group that gained the project’s trust.

While the full details of “how” are still unknown, the attackers were able to get 2 out of the 5 entities on Drift’s multisig to change the protocol’s admin to an account owned by the attacker. This gave them access to creating new markets, assigning oracles (price data feeds), and withdrawal limits.

In a single transaction, they: 

Before the attack, Drift was among the top perps DEXes on Solana, generating over $90B in volume in 2025. 

The magnitude of this attack extends far throughout the Solana ecosystem. Drift is a major platform on Solana, and many other Solana-based DeFi apps tapped into its liquidity and yield opportunities to enhance the performance of their own products. 

This article from Chaos Labs April 2nd tallied the known victims at the time: 13 apps had disclosed up to $37M in affected funds, with another 5 apps reporting undisclosed damages.

Chaos Labs’ breakdown of the top 20 crypto exploits shows that billions of dollars has been lost to operational issues, just like Drift and Resolv. 

Here’s a quick breakdown of issues tied to operations/security vs smart contracts:

So far, no path to reimbursing affected users/projects has been made public. With hundreds of millions of dollars lost, it’s unlikely users will ever see a majority of their stolen funds again, unless Drift is essentially bailed out like Wormhole was (for $320M) in 2022.

Now more than ever, it’s clear that more focus must be placed on operational security if DeFi is to succeed long-term. Exploits such as Drift’s involve sophisticated tactics that involve far more than simple technical skills. However, these types of attacks are constantly at play against major tech firms.

While the attack itself could’ve been stopped by measures such as timelocks, (better-constructed) multisigs, parameter bounds, and admin action rate limits, it’s critical that DeFi teams take the most thorough precautions possible, even when dealing with partners and close associates.

AI agents have become a major interest from the world’s leading tech and payments companies, including Google, Stripe, Visa, Amazon, and many more. 

While there are many promising use cases for agents, Zyfai’s focus is using them as automated, dynamic onchain asset managers.

Zyfai’s platform gives users a straightforward way to deposit funds on the chains and apps where they want to earn yield, as well as real-time stats to show the opportunities for each one.

Here’s how it works:

When someone deposits into Zyfai, their funds enter a new self-custodial wallet called a Safe Smart Account. Rather than combine funds in a central pool, Zyfai minimizes vulnerability by giving each user their own secured wallet.

While the depositor retains the ability to withdraw anytime, the wallet’s transactions are handled 24/7 by an agent, which constantly scans dozens of pools across multiple networks to find the best risk-adjusted opportunities. 

When the agent decides to deploy capital into any given pool, it verifies that the pool and address, as well as the action the agent is taking, have all been whitelisted by the Security Proxy Gateway – the infrastructure designed to keep agents constrained to specific behaviors.

Finally, when a transaction goes through, a permanent cryptographic proof is created to show that all rules were followed as intended.

Specifically, Zyfai uses a massive group of more than 13,300 agents to generate the best possible risk-adjusted return on USDC. 

So far, these agents have amassed over $2.3B in trading volume, and they currently manage over $9M in deposits.

During Q1, Zyfai has significantly outperformed the competition when it comes to stablecoin yields. Here’s a look at their monthly performance: 

Overall, Zyfai’s Q1 APY was 7.14% – almost 70% higher than their 4.23% benchmark (the average APY of static pools). 

While these metrics are impressive, what separates Zyfai from other platforms is its inherent risk protection.

Right now, generating yield on stablecoins is one of the most competitive areas of DeFi.

In bear markets, onchain yields become infamously low due to lack of demand. Many base yields on popular stables like USDT and USDC are well below the Fed Funds Rate, which begs the question: why earn yield onchain in the first place?

The marketplace has answered this question with the rise of onchain Risk Curators (essentially onchain money managers). Curators have seen AUM increase almost 20x in the past 18 months to its current level of $6.9B.

It’s curators responsibility to outperform base lending rates for onchain assets while taking the least amount of risk possible. However, we’ve seen holes forming in some strategies that were perceived as “safe” (e.g. Stream) as well as shortfalls relating to manual handling of risk mitigation (e.g. Resolv, Drift).

When it comes to bringing institutional capital onchain, the importance of onchain safety cannot be overemphasized.

This is where Zyfai really has a chance to prove itself and potentially capture a large slice of the growing curator market. While the platform hasn’t lived long enough to see many exploits, their track record is already being built. 

In the moments leading up to the Resolv exploit, Zyfai sensed an irregularity in USR activity and successfully moved user funds in time to avoid losses.

How? Automation. 

While curators like Gauntlet struggled to react in time to USR’s price collapse, Zyfai’s 24/7 agents perceived the danger and acted immediately. Here’s an example of someone who directly benefitted from this.

While the market is still processing the magnitude of these 2 major exploits, the timing couldn’t have been better for Zyfai’s most recent product release – Agent Vaults. 

Rather than rely on manual processes to protect users, these vaults are completely managed by AI agents which divert funds from any perceived threats immediately. The first Agent Vault is a USDC yield optimizer – playing into Zyfai’s existing proven strength.

Currently, the Agent Vault has almost $200K in deposits, which have been deployed on Morpho to find yield opportunities. The current APY is just under 8% (4.57% + incentives):

Essentially, Agent Vaults make Zyfai’s traditional infrastructure more accessible and easier to use. Instead of relying on users to go to the Zyfai app to deposit, Agent Vaults can be seamlessly integrated into other apps (like any other vault). Imagine getting Zyfai yield in your banking app!

It’s worth noting that this added convenience comes with extra trust. When someone deposits into the Agent Vault, they opt into a trust model – instead of controlling their own Smart Account, the upgrades, asset reallocation, parameter changes are controlled by a group of Multisig signers.

Overall, Zyfai’s Smart Accounts and Agent Vaults automate potential attack vectors that manual asset managers leave vulnerable, including NAV updates, withdrawal processing, strategy rebalancing, claim fulfillment, and more. 

Beyond Agent Vaults, Zyfai has several exciting developments to expand the reach and functionality of the platform.

First, Zyfai will soon be available to use on Solana and Hyperliquid – two of the most active networks in all of Web3 which generate billions of dollars in volume every day. This furthers their expansion from the EVM ecosystem, reaching some of the most active and opportunistic users in crypto.

Second, more products are coming! Agent Vaults is just the beginning of a longer string of new products and available opportunities for Zyfai users. Specifically, the team is working on adding additional pools to give users exposure to additional strategies. 

Another exciting product in the works is agent-monitored borrowing, which can bring more safety and 24/7 monitoring to popular yield strategies such as looping. Currently, the largest risk to looping strategies for correlated assets (e.g. lending one stablecoin to borrow another) is borrowing rate volatility. If the rate to borrow increases significantly, it could cause the debt position to exceed the LTV parameters for the loan, which could ultimately result in the position being liquidated. But with agents monitoring and adjusting these positions around the clock, that risk is significantly reduced.

Now that we’ve covered Zyfai’s infrastructure and roadmap, let’s see how we can use it to put our money to work!

To put some funds to work, we took two separate actions to simultaneously capture yield and price appreciation.

deposited USDC into Zyfai on Base earlier this week – here’s the transaction to show it!

This can be done in 3 simple steps:

As soon as our agent was deployed, it started looking for ways to earn yield across 62 pools on 8 platforms. 

Another interesting feature is that once your agent is deployed, you can interact with it on Telegram:

By clicking the Zyfai Metrics button at the bottom of the Telegram app, you can get a look at the platform’s live stats:

You can also see how your capital is being put to work at any time: 

Finally, you can check your position on the app at any time to see how much you’re earning in USDC and rZFI (which can be redeemed for the native ZFI token):

Over time, we’ll redeem the rZFI that we earn via the agent for ZFI; 20% of earned rZFI is instantly redeemable, and the remaining 80% vests linearly over 6 months.

In addition to creating a yield agent on Zyfai, we’ve also taken a position in the project’s ZFI token, then staked it to earn more yield.

ZFI has a FDV of ~$3.3M and its market cap is only ~$1.3M, which means 2 things:

The only DEX with enough liquidity to even place a small trade is Uniswap, where we managed to buy a small amount with almost no slippage – and here’s the transaction to prove it!

Then, we staked it by simply clicking the “Staking” tab on the Zyfai website.

In return for staking ZFI tokens, we received stZFI tokens, which are locked in a smart contract that receives fees from the platform. So, in addition to ZFI’s upside potential, it’s also generating its own USDC yield in addition to our agent. 

But before you stake, make sure you’re aware that staked tokens have a 2-week cooldown period. When you create an unstaking transaction, you must wait an additional 2 weeks before you have access to your ZFI tokens.

Whenever Zyfai’s 13.3K+ agents generate yield for their Smart Accounts, Zyfai takes a 10% performance fee. And 50% of that fee goes directly to ZFI stakers – paid in USDC.

As Zyfai pointed out, the combination of deploying an agent and staking ZFI creates a major flywheel: 

With Zyfai’s incredible track record of stablecoin yield generation, as well as their solid tokenomics, we’re excited to see how this position plays out!