Harvest Finance (FARM) is an automated yield optimization protocol on Ethereum — one of the most prominent DeFi Summer 2020 yield aggregators — that harvests (hence the name) yield from lending protocols and liquidity pools on behalf of depositors by pooling capital, compounding rewards, and switching between highest-yield opportunities, notable for suffering a $33.8 million flash loan arbitrage attack in October 2020 (the attacker manipulated Curve stablecoin prices via flash loans and extracted profit from Harvest’s fUSDC and fUSDT vaults through price discrepancies), with FARM as the uniquely scarce governance and profit-sharing token (690,420 FARM max supply — a humorous reference to 420 and 690 internet memes) that distributes 30% of all Harvest vault profits to FARM stakers via weekly “grain” buyback-and-distribute mechanics.
| Stat | Value |
|---|---|
| Ticker | FARM |
| Price | $11.68 |
| Market Cap | $7.85M |
| 24h Change | +1.7% |
| Circulating Supply | 672,183 FARM |
| Max Supply | 690,420 FARM |
| All-Time High | $628.46 |
| Contract (Ethereum) | 0xa024...a14d |
| Contract (Energi) | 0xc59a...4514 |
| Contract (Binance Smart Chain) | 0x4b5c...3743 |
How It Works
- Harvest Vaults (fTokens) — Users deposit assets (USDC, DAI, WBTC, ETH, Curve LP tokens, etc.) into Harvest vaults. They receive fTokens (fUSDC, fDAI, fWBTC) representing their vault share. The vault’s underlying strategy automatically deploys deposits to yield-generating sources.
- Strategy automation — Harvest strategies claim farming rewards (CRV, COMP, BAL, etc.) periodically, sell them for more of the vault’s base asset, and re-deposit. This compounds yield continuously. Compound events are called by anyone (usually bots) who earn a small fee for triggering the harvest.
- FARM profit sharing — 30% of all yield generated by Harvest vaults is used to buy FARM on the open market and distribute it to FARM stakers (deposited in the Profit Sharing pool). This creates buy pressure for FARM tied directly to Harvest TVL and yield generation.
- iFARM — Users who leave FARM in the Profit Sharing pool receive iFARM (interest-bearing FARM), an auto-compounding representation of their staked FARM position.
- Multi-chain — Harvest expanded to Polygon, Arbitrum, and BSC in 2021–2022, running strategies on those chains’ DeFi protocols.
Tokenomics
| Parameter | Value |
|---|---|
| Ticker | FARM |
| Total/Max Supply | 690,420 FARM |
| Ethereum contract | 0xa0246c9032bC3A600820415aE600c6388619A14D |
| Emission schedule | 4-year decreasing emissions (70% distributed to vault users; 30% profit sharing fund) |
| Profit sharing | 30% of vault profits → buy FARM → distribute to stakers |
| Peak TVL | ~$1.1 billion (October 2020) |
| Launch | September 2020 |
Use Cases
- Automated yield compounding — Deposit stablecoins or LP tokens to earn compounded yield without active management.
- FARM profit sharing — Stake FARM to receive 30% of all Harvest protocol yield as iFARM.
- Multi-chain yield — Access Harvest strategies on Ethereum, Polygon, Arbitrum, and BSC.
History
- 2020-09-01 — Harvest Finance launches anonymously. The protocol is deployed with an anonymous team. Within days, Harvest’s combination of high APYs (100%+ on stablecoin vaults via COMP and CRV farming) and fair FARM distribution attracts massive capital inflows.
- 2020-09 — Harvest TVL exceeds $400 million within three weeks of launch, peaking above $1 billion by late September. FARM trades at over $700/token at peak. The protocol becomes one of the top 3 DeFi protocols by TVL within its first month.
- 2020-10-26 — An attacker uses a Uniswap flash loan to temporarily manipulate the price of USDC against USDT in Curve Finance’s stablecoin pool. The attacker deposits into Harvest’s fUSDC vault during the manipulated price window, then withdraws after the price resets, extracting ~$33.8 million profit across repeated cycles. The flash loan is repaid within the same transaction.
- 2020-10-26 — Harvest’s anonymous team discovers the exploit and pauses new deposits. They publish a postmortem acknowledging the attack was economically rational exploit of price oracle reliance on Curve spot prices rather than time-weighted average prices (TWAPs). The team sends the attacker an on-chain message with a 2.5 ETH tip requesting voluntary return of funds.
- 2020-10-27 — The attacker returns approximately $2.5 million in USDT to the Harvest deployer address. The remaining ~$31 million is kept. Harvest’s FARM token price drops from ~$700 to ~$200. TVL drops from ~$1B to ~$300M.
- 2020-Q4 — Harvest rebuilds trust by continuing protocol operations. The team moves all price-sensitive vault strategies to use TWAP oracles instead of spot prices. Harvest implements additional slippage limits and deposit limits to reduce flash loan attack surfaces.
- 2021–2022 — Harvest expands to Polygon, Arbitrum, and BSC. The protocol continues operating as a mid-tier yield aggregator. FARM’s 690,420 max supply and profit-sharing mechanics attract a loyal community despite reduced TVL.
- 2023–2024 — Harvest remains operational with modest but consistent TVL. The protocol is one of the longer-surviving DeFi Summer 2020 protocols, maintaining activity through multiple market cycles.
Common Misconceptions
“Harvest’s hack was a smart contract bug.”
The October 2020 attack was not a bug — it was economic arbitrage exploiting a design vulnerability: Harvest’s vaults used Curve’s spot price as the price oracle, which could be temporarily manipulated with flash loans. The smart contracts worked exactly as coded. The issue was the oracle choice, not a coding error. Post-hack, Harvest switched to time-weighted average price (TWAP) oracles.
“Only $2.5M was returned.”
Yes. The attacker returned $2.5M out of $33.8M, keeping ~$31.3M. The on-chain 2.5 ETH tip to incentivize return was unsuccessful beyond the token gesture of $2.5M.
Social Media Sentiment
Harvest Finance has a niche but dedicated community. The FARM profit-sharing model (30% of protocol yield to stakers) is cited as one of DeFi’s more sustainable tokenomics designs versus pure inflationary governance tokens. The October 2020 hack is prominently featured in DeFi security education as an early example of flash loan oracle manipulation. The protocol’s anonymous founding team is a common discussion point. Harvest is generally considered a survivor of DeFi Summer rather than a growth-phase protocol.
Last updated: 2026-04