Cross-Chain Yield on Autopilot

Earning yield on DeFi has long been constrained by fragmented liquidity across protocols. Given the variable and volatile nature of yield sources on-chain, it is infeasible for users to optimize their returns by rebalancing their portfolios—that’s a complex process that costs both money and time. Yield aggregators do exactly all that hard work for you—automatically moving assets on your behalf to maximize passive earnings.

While solutions exist and asset management is a very competitive sector, we are in a multichain paradigm, and cross-chain portfolio optimization is an endeavor that most yield aggregators aren’t equipped to do. What’s a seemingly simple and passive process for users carries a lot of complexities behind the scenes. Therein lies a market opportunity for yield aggregators to have an edge, and that’s exactly what maxAPY set out to achieve.

By offering cross-chain yield aggregation and optimization vaults, maxAPY abstracts away all the complexities that come with maximizing earnings on-chain—not only on one chain at a time, but across multiple chains at once. That’s what differentiates maxAPY from other asset management protocols. On top of that, maxAPY’s focus on simplicity and UX make it a very accessible protocol for users, not only improving the capital efficiency of their assets, but also onboarding a large set of new users on-chain. maxAPY automates the full process end-to-end, from strategy selection, to cross-chain reallocation to compounding and reinvesting. The main differentiator with other protocols, in addition to the optimization algorithms, is that users do nothing other than deposit. With maxAPY, both crypto-natives and the average retail participant can put their assets to work, accepting deposits in either fiat or crypto.

With fully automated and risk-adjusted cross-chain yield aggregation, maxAPY removes any form of manual bridging, rebalancing, or vault curation for users. In this report we will explore the unique value proposition of maxAPY as the first truly intelligent cross-chain yield aggregator, as well as explain how the protocol seamlessly bridges the gap between institutional-grade strategy execution and effortless DeFi participation.

Key Takeaways

• maxAPY represents DeFi’s shift from manual and chain-specific vaults to fully automated, cross-chain yield aggregation.
• Most yield aggregators are deployed on different chains, and their earnings are restricted to opportunities on that single chain, rather than offering a single access point that scouts for optimal strategies across all chains at once.
• Superform introduced a new solution that enabled fully cross-chain yield aggregation via standardized vault standards, allowing users to access optimized yield strategies and enter positions from any chain and with any asset. However, the user would still need to choose where to invest, and as far as optimization goes with SuperVaults, yield strategies are still isolated to 1 chain.
• maxAPY serves as an optimization layer on top of cross-chain bridging infrastructure to automate cross-chain yield farming. Their algorithm maximizes capital allocation in a risk-adjusted way depositing on trusted, audited, and carefully curated pools.
• maxAPY offers true cross-chain yield aggregation from a single deposit interface from any EVM chain without needing to bridge, and abstracting away the intricate backend work of automatically bridging from chain-to-chain for the best risk-adjusted yields.

Evolution of Yield Farming

Yield farming has been a cornerstone of DeFi since inception. Protocols working on yield aggregation naturally emerged alongside the early DeFi protocols. With so many yield sources and volatile opportunities, it was only a matter of time until someone built the equivalent of a Robo Advisor on-chain. This concept gained momentum in 2020 during what became known as “DeFi Summer,” when protocols began incentivizing liquidity providers with governance tokens, creating unprecedented return opportunities for savvy participants. As DeFi protocols started issuing their governance tokens, early adopters and users were rewarded with inflationary emissions. Those extra rewards further enhanced the organic yield that users could earn on protocols like Compound, Synthetix, or Uniswap—simultaneously earning governance token rewards and interest payments or swap fees from the underlying protocol.

Early yield strategies were manual and reactive. Users engaged in “yield farming” by chasing the highest APY across platforms. For example, moving stablecoins between Compound and Aave to capitalize on rate differences, or chasing the early emissions of a new token launch. This required constant monitoring and manual rebalancing, consuming time and capital.

The development of yield aggregators stemmed directly from the personal frustrations experienced by DeFi participants themselves. Andre Cronje, the founder of Yearn Finance, exemplifies this journey. As an active DeFi participant looking to maximize returns on his personal savings, Cronje encountered several critical challenges:

• The overwhelming proliferation of new protocols, each requiring separate due diligence, deposits, and capital management.
• Constantly fluctuating yield rates that required vigilant monitoring to ensure optimal allocation.
• The significant time investment needed to manually shift positions as opportunities emerged and disappeared.
• The cumulative gas costs that eroded potential profits when frequently rebalancing positions.

Cronje built a solution for himself, creating automated “vaults” that algorithmically farm yields, also auto-compounding returns without manual intervention. Yearn’s success proved that aggregating yields could greatly simplify the user experience while often outperforming static positions. Now users could just deposit in a single vault and passively watch their assets grow over time.

The value proposition was clear, and this inspired a wave of innovation in yield aggregation. Protocols like Harvest Finance, or Pickle Finance emerged, along with others like Beefy, Rari Capital, and more, each addressing specific aspects of yield optimization. These platforms significantly advanced the accessibility of DeFi by automating complex yield strategies, handling the technical challenges of position management, and socializing gas costs across many users through pooled transactions—the benefits of economies of scale. Over time, more advanced systems were developed to ensure the most optimal yield allocation, and this led to Yearn v2 and v3, as well as new more recent protocols like Sommelier, or Veda. The industry had matured, and institutional onboarding required more sophisticated risk management. Unlike the early days of DeFi where liquidity mining rewards made up the vast majority of the returns, now there are plenty of opportunities to earn passive income with real yield, passively compounding returns in stablecoins like USDC or blue-chips like ETH.

When it comes to on-chain asset management, while users are presented with an elegantly simple frontend experience—deposit $USDC and earn optimized yield—this apparent simplicity masks extraordinary backend complexity that few protocols have successfully navigated. Today, the current multichain paradigm has resulted in liquidity fragmentation across multiple L1s and L2s, each with their own respective yield opportunities. However, one limitation remained: siloed environments. Each of these yield aggregators or POL (Protocol-Owned Liquidity) mechanisms generally operated on a specific chain, or within a particular ecosystem. Liquidity and strategies were still fragmented by chain, meaning users and protocols had to choose where to deploy capital. The stage was set for the next evolution, breaking down these silos.

Today, DeFi continues to integrate an increasing number of interoperability solutions, with protocols leveraging both bridges and message-passing frameworks—such as LayerZero, Wormhole, Axelar, and Hyperlane—to facilitate asset transfers between chains. However, most yield aggregators do not offer seamless cross-chain bridging—users often still need to manually bridge assets before depositing into different yield vaults on separate chains.

maxAPY stands out for being the only yield aggregator in DeFi that continuously monitors yield opportunities across 700+ strategies from 70+ protocols on 9+ EVM chains, maintaining secure bridging operations and implementing dynamic capital allocation. Everything is meticulously automated to deliver what appears effortless to users: the ability to deposit funds once and simply earn the highest risk-adjusted passive income available on-chain.

Introduction to maxAPY

The unique value proposition lies in offering a one-stop, automated DeFi platform where users can deposit from any supported EVM chain and any token and their backend systems will handle the rest. maxAPY handles the hard work it takes to capture the highest available risk-adjusted yield at any given time, 24/7/365. Behind the scenes, maxAPY’s smart vaults handle all the heavy lifting, continuously scanning hundreds of curated strategies across every major DeFi protocol. Assets are automatically bridged to different networks and swapped as necessary to capture the best risk-adjusted returns,  rebalancing as soon as more profitable strategies emerge. At the core of this is maxAPY’s MetaVaults, a single unified vault that can deploy capital across multiple chains using third-party cross-chain transfer technology.

Cross-Chain Infrastructure

maxAPY currently leverages Superform’s routing and bridging stack as the backbone for moving assets cross-chain. Superform’s protocol handles the low-level execution using integrated bridge and DEX aggregators (e.g. Socket, 1inch, deBridge, etc.) to find routes for transferring liquidity and swapping tokens between networks​. On top of this foundation, maxAPY runs its own optimization logic. The maxAPY engine continuously scans yield rates and allocates capital to the highest-yielding vaults, then auto-compounds and rebalances positions in real time,  all while the user simply deposits a single asset and earns​.

In essence, Superform provides the cross-chain transaction rails, and maxAPY adds a smart decision layer above it to optimize yields across those rails. This synergy allowed maxAPY to quickly implement cross-chain yield farming without reinventing bridging mechanics, instead focusing on its core algorithmic strategy selection. On top of that, maxAPY integrates multiple cross-chain bridge aggregators like Socket, Li.Fi, and Debridge, reducing overreliance on any single route.

When a user initiates a deposit from one chain to a vault on another chain, Superform executes a sequence of on-chain and cross-chain steps. At a high level, the flow starts with the route selection. The Superform backend/API can suggest an optimal route which includes which bridge to use, whether to swap tokens on source or destination, estimated gas costs, etc.​

Next, the router initiates a cross-chain token bridge, handing off the tokens to various integrated bridge aggregators like Socket, Li.Fi or Debridge according to the route.

After some time (typically a few minutes or less), the bridged tokens and the cross-chain message both arrive on the destination chain, and the destination chain contracts will take the bridged tokens and deposit them into the target yield vault on that chain.

From a security perspective, it is worth noting that Superform’s cross-chain messaging is built on a Multi-AMB (Arbitrary Message Bridge) architecture designed for resilience and fault-tolerance. An AMB is a protocol for passing arbitrary data between chains. AMBs that are used by maxAPY include LayerZero, Wormhole, Hyperlane. Rather than trust a single provider to deliver critical instructions (like “deposit Alice’s funds into Vault X on chain Y”), this Multi-AMB approach ensures that no single bridge failure can compromise a cross-chain transaction—a critical security improvement given the track record of bridge hacks.

All of this is enabled by the combination of two standards: ERC-4626, and ERC-7540. The ERC-4626 standard allows for tokenized vaults, providing the interface for deposits, withdrawals, and share accounting. Meanwhile, ERC-7540, represents a new Ethereum standard for asynchronous cross-chain vaults, making it possible to deposit and withdraw by making a request on one chain but executing it on another.

ERC-4626

ERC-4626 is a universal standard for yield-bearing assets, or tokenized vaults, designed to improve efficiency, security, and compatibility across DeFi. The interface defines how vaults handle deposits, withdrawals, and interest calculations, ensuring they work consistently across different protocols. At its core, ERC-4626 is an extension of ERC-20—when users deposit assets into an ERC-4626 vault, they receive vault share tokens representing their stake, which grows in value as the vault generates yield.

By developing ERC-4626-compliant vaults, maxAPY ensures compatibility with other protocols and providers like portfolio trackers. The implementation of the standard also facilitates auto-compounding of yields: as strategies produce yield, the returns are converted into more of the underlying asset and reinvested, causing the MetaVault share price to rise (rather than issuing new tokens).

Assets can be dynamically allocated to multiple strategies while keeping interactions simple and standardized. Since ERC-4626 is widely recognized and supported across DeFi, maxAPY’s vaults can integrate easily with other protocols, ensuring smooth deposits, withdrawals, and automated yield maximization without requiring users to manage complex strategies themselves.

ERC-7540

ERC-7540 extends ERC-4626 to handle cross-chain vault operations​ by introducing asynchronous deposits and withdrawals, allowing a vault to accept a request on one chain while fulfilling it on another. In maxAPY’s MetaVault, a deposit or withdrawal can be initiated on the source chain (e.g. Ethereum mainnet) even if the actual strategy lives on a different chain (e.g. Polygon or Base).

The MetaVault that implements the interface essentially logs a pending request that is later finalized when the cross-chain process completes. For example, when deploying capital to another chain, the MetaVault will internally call a function that prepares a request and hands it off to the cross-chain gateway. The deposit amount is temporarily marked as “in transit” and not immediately counted as vault debt until confirmation is received that the funds reached the target.

This asynchronous flow is crucial for cross-chain activity because moving funds between chains cannot be done atomically in a single transaction. The process also involves waiting for bridges or messaging protocols to finalize. By using ERC-7540, maxAPY standardizes this request/fulfill process, ensuring transparency for users by making it possible for them to track pending deposits/withdrawals while avoiding partial completion issues—either the request is fulfilled and recorded, or the funds remain safe in the origin.

Optimizing Yields

maxAPY currently supports 700+ strategies from 70+ protocols on 9+ EVM chains in its V1. Protocols in the list include Convex, Sommelier, Yearn, Beefy, Curve, HOP. Yield strategies range from simple liquidity provision to CPMMs or CLAMMs, to leverage staking, and even points farming. A full list of protocols supported can be found here.

By default, users are able to zap any asset from any chain into an underlying Base vault on maxAPY—the maxAPY MetaVault. From this vault on Base, smart algorithms constantly scan for opportunities across various protocols on various EVM chains (not limited to Base). A better opportunity is evaluated based on various factors including security, performance history, and TVL among other indicators—not just the raw APY, as deposits also impact and can dilute those numbers. If the yields are relatively sustainable, and the destination protocol has been whitelisted by maxAPY—and is, therefore, audited, and curated from the lens of liquidity stickiness and Lindyness—the assets will be bridged via the Superform integration into the respective chain’s vaults.

Consider an $ETH optimization scenario:

1. User deposits $ETH to the maxETH MetaVault on Base
2. MetaVault has access to all $ETH vaults across EVM chains
3. MetaVault identifies a high-yield opportunity in a Beefy vault on Polygon
4. MetaVault uses a bridge to cross-chain transfer $ETH to the Polygon strategy
5. The maxAPY SharePriceOracle instance that is deployed on Polygon monitors strategy performance
6. Performance data flows back to the maxETH MetaVault on Base through an integration with LayerZero and Chainlink
7. The MetaVault maintains accurate performance tracking and optimization, and can make reallocation decisions, or just make this data accessible to the user in a transparent and on-chain manner.

Fees

maxAPY’s fee structure is designed to align with user profitability and fund sustainability, ensuring that fees are only taken when performance justifies them.

maxAPY only charges performance fees on new gains, ensuring that users are never double-charged for the same profits. This is enforced using a high-water mark system, meaning that performance fees are applied only when the vault’s value surpasses its previous highest point. Additionally, the protocol uses a hurdle rate, which sets a minimum required return before any performance fees can be charged, ensuring that users do not pay fees if their earnings do not exceed a baseline risk-free rate.

Management Fee: maxAPY charges a 2% annual management fee, which is collected monthly based on the average AUM during the period. This fee is deducted from the vault’s total value rather than directly from user deposits, meaning that users do not experience an upfront fee deduction. The purpose of the management fee is to cover protocol operations and infrastructure costs. maxAPY does not charge users on top of what the underlying protocol charges so users never pay more than necessary and that returns don’t fall below the hurdle rate.

For example:

If an underlying protocol charges 1% → maxAPY adds 1% to reach our 2% target

If an underlying protocol charges 2% or more → maxAPY adds nothing extra

Performance Fee: maxAPY applies a 20% performance fee only on net new profits. The high-water mark ensures that users never pay fees on unrealized or previously paid-for gains. If a vault’s share price drops and later recovers, fees will only be taken on profits exceeding the previous all-time high.

Hurdle Rate: To prevent excessive fee collection, maxAPY sets a hurdle rate which is a baseline return that the vault must exceed before any performance fees apply. This hurdle rate is dynamic, often set relative to Lido’s staked $ETH ($stETH) APR for $ETH vaults and Treasury yields (4-week T Bill yield) for $USDC vaults, ensuring that users only pay fees on outperformance above a reasonable benchmark. Additionally, since these rates fluctuate over time, the actual hurdle applied to your position is calculated as the average rate during your deposit period.

For example, holding a position in the maxETH vault for 6 months:

• Month 1-3: Lido staking APR was 1%
• Month 4-6: Lido staking APR was 3%

Your effective hurdle would be 2%.

Unique Selling Points

Yield aggregation protocols like Superform, Beefy, Yearn, etc. by itself are tools that let users deposit into various vaults across chains (it’s essentially a cross-chain vault marketplace/aggregator). The user would still need to choose where to invest.

maxAPY automates that choice by continuously scanning yield opportunities across an extensive range of protocols and chains , combining Superform’s entire vault marketplace plus the Top-yielding strategies from AAA yield farming protocols.. maxAPY’s optimizer evaluates yields in real time and can dynamically allocate or move funds to wherever the net return is highest.

For example, maxAPY’s algorithm doesn’t just chase the highest APY blindly. It also analyzes the real return after accounting for gas fees, bridge costs, and other considerations like potential impermanent loss on LP strategies​ or the market impact on lending rates upon deposit/withdrawal. This ensures the platform is seeking risk-adjusted yield, not just nominal yield. If the overhead of moving to a new strategy is too high, maxAPY will stay put in the current one; conversely, if the math shows a significant gain even after costs, it will redeploy capital accordingly. Other qualitative factors are also considered such as protocol reputation, security, prior exploits, etc.

Once moved, the protocol continues to monitor performance, and can revert or shift again if the situation changes. Superform alone doesn’t provide this kind of ongoing strategy optimization, and SuperVaults operate on a single chain at a time. Instead, maxAPY’s logic decides when and where to move funds for the user. As a result, maxAPY provides a set-and-forget experience where the user doesn’t have to constantly watch APYs or move funds around. This is a key differentiator from just using Superform manually, where the user would need to pick vaults and reallocate themselves, as well as from SuperVaults, where the actual yield opportunities are restricted to a single chain. Accessing maxAPY vaults are also simplified via fist on-ramp rails reducing friction to accessing cross-chain DeFi yields. Additionally, maxAPY’s yield optimization develops and integrates additional strategies that aren’t available through Superform including:

• Direct protocol integrations for enhanced yield opportunities
• Custom farming strategies across major DeFi platforms
• Specialized positions in emerging protocols with attractive yields
• Advanced composable strategies combining multiple protocols

Addressing User Concerns

DeFi is a prime target for hackers because of the potential of smart contract vulnerabilities in almost any protocol using smart contracts. The reliance on bridges within maxAPY introduces another compelling reason for hackers to exploit vulnerabilities that may be present.

Cross-chain bridges have historically been targets for some of the largest exploits (e.g. Harmony, Ronin, Multichain), which were all caused by compromised bridge private keys. Potential vulnerabilities include malicious message attacks, bridge contract bugs, or failures of the underlying bridge providers.

maxAPY’s yield-generating vaults (the strategy vaults on each chain) are operated by maxAPY, whereas the cross-chain bridging/messaging is handled by Superform. To understand where funds might be at risk, we have to look at where users’ funds are exposed in each component.

Primary Risk Exposure

Once your assets reach a target chain and enter a strategy (e.g. a Beefy vault on Polygon in the ETH example), they are subject to the security of that underlying protocol. If an underlying vault or strategy is exploited, funds in that strategy could be lost. maxAPY mitigates this by only integrating with vetted, audited protocols and continuously monitoring their health. The protocol also limits exposure so that no single strategy ever contains too large a portion of the MetaVault’s assets, reducing the blast radius of any one vault’s failure. In addition to that, maxAPY can dynamically pull funds out if a strategy shows anomalies or a security issue (more on this in the next section). Thus, even though protocol risk can never be zero in a permissionless decentralized environment, maxAPY’s diligence in partner selection and active risk management minimizes the chances of users being affected by an underlying vault exploit.

When moving funds across chains, users temporarily rely on Superform’s bridge contracts. The main concern is losing access to funds during a cross-chain transfer, for instance, if something goes wrong in transit or Superform’s bridge were to fail. maxAPY directly addresses this with a Bridge Recovery Protocol whereby if a cross-chain transaction fails or times out, Superform’s infrastructure automatically handles it and returns the funds to a recovery vault on the source chain​. maxAPY uses a dedicated refund address (a temporary vault) so that any bounced or failed transfer is caught and held safely. The system then detects the returned funds and automatically retries the cross-chain operation, typically resolving the issue within a few hours​. The documentation emphasizes that funds are never at risk in a failed bridge scenario. At worst, there may be a time delay before your deposit/withdrawal completes (and maxAPY covers the extra gas costs for the retries in such cases)

Secondary Security Measures

maxAPY operates on a rehearsed system in the event of an exploit from pre- to post- exploit using a framework:

• Detect: 24/7 monitoring catches issues
• Protect: Emergency pause if needed
• Resolve: Move assets to safety
• Restore: Resume once threat is cleared

maxAPY has a 24/7 monitoring system that helps detect issues immediately. This acts as  an “Emergency Stop” switch for worst-case scenarios​. If a critical vulnerability or an attack is detected anywhere in the system, the team can activate this to halt new transactions, preventing further damage.

Next, the team would resolve the issue by moving assets out of harm’s way (e.g. pulling funds from a compromised strategy or switching to an alternative bridge) and patching any vulnerability.

Finally, normal operations would be restored once everything is safe again. This emergency plan can be executed within minutes before it even becomes known to the user that an exploit happened.

Security Audits

MetaVault (and the strategy vaults it allocates to) are fully on-chain and have been rigorously audited. In October 2024, Zokyo audited maxAPY’s contracts and scored 99/100 with zero critical issues found​. The codebase includes standard DeFi safety measures (like re-entrancy guards and controlled access roles) as noted in the audit, and any minor issues found were promptly fixed.

The audit report can be found here.

• Score: 99/100
• Critical Issues: 0
• High Issues: 0
• Medium Issues: 3 (all fixed)
• Low Issues: 4 (2 fixed, 2 acknowledged)

Since then, maxAPY has undergone multiple other audits and stress testing from Zokyo and Resolve to ensure best-in-class security of assets in their custody.

Rezolv Solutions – Security Review (April 2025)

• Critical Issues: 0
• High Issues: 1
• Medium Issues: 0
• Low Issues: 1

Rezolv Solutions – Security Review (February 2025)

• Critical Issues: 2
• High Issues: 1
• Medium Issues: 3
• Low Issues: 4

Zokyo – Hurdle Rate Oracle Audit (March 18, 2025)

• Score: 100/100
• No issues found

Zokyo – Share Price Oracle Audit (March 14, 2025)

• Medium Issues: 6
• Low Issues: 4

Zokyo – MetaVault Audit (March 10, 2025)

• Score: 100/100
• Critical Issues: 1
• High Issues: 2
• Medium Issues: 1
• Low Issues: 2

Conclusion

maxAPY offers a fundamental shift in DeFi yield aggregation, solving one of the biggest inefficiencies of fragmentation of liquidity and yield opportunities scattered across multiple chains. While previous iterations of yield farming required users to manually bridge assets, monitor APYs, and rebalance positions, maxAPY automates this process through its MetaVault architecture, leveraging Superform’s cross-chain infrastructure while introducing a strategic optimization layer/algorithm that dynamically reallocates capital across the highest-yielding, risk-adjusted strategies. Thus, unlike traditional yield aggregators that operate within isolated chains, maxAPY creates a unified, intelligent yield layer, eliminating inefficiencies and unlocking true cross-chain capital efficiency while providing a seamless user experience.

Disclosures

Alea Research is engaged in a commercial relationship with maxAPY as part of an educational initiative and this report was commissioned as part of that engagement.

Members of the Alea Research team, including those directly involved in the analysis above, may have positions in the tokens discussed. This content is provided for educational purposes only and does not constitute financial or investment advice. You should do your own research and only invest what you can afford to lose. Alea Research is a research platform and not an investment or financial advisor.