Yield Strategy Optimization Report: Steakhouse Financial

Yield Strategy Optimization Report: Steakhouse Financial Target Protocol - Steakhouse Financial (TVL: $3005.3M) Yield Strategy Optimization Report Steakhouse Financial – Ethereum & L2 (TVL: $3,005.3 M ) prepared by the Senior DeFi Security Research & Auditing Team on 1 September 2026.

The report highlights several critical attack vectors within the Steakhouse Financial multi-chain yield-aggregation platform, which holds $3 billion in assets. The seven identified smart-contract vulnerabilities range from critical to medium severity, with the most severe being a re‑entrancy flaw in the Vault's withdraw function, potentially allowing attackers to extract unlimited funds.

Other vulnerabilities include unchecked external calls, proxy upgrade races, integer overflows, missing access controls, improper ERC-777 token handling, and unrestricted self-destruct functions.

Economic and logic attacks also pose significant risks, with the oracle price manipulation attack being the most critical at the critical severity level. An attacker could exploit the Oracle price manipulation attack by temporarily skewing the Chainlink ETH/USD price feed during the rebalance window, resulting in the allocation of excessive capital to high-yield but low-security strategies.

This could lead to misallocation of funds and substantial losses if the targeted strategy fails. The flash-loan "rebalance sandwich" attack, high severity, involves front-running legitimate rebalances to capture APR boosts, potentially siphoning up to 5% of the total value locked (TVL) each week. Another high-severity attack, the reward token "mint-and-sell" attack, allows malicious strategies to mint excessive native STEAK tokens and sell them immediately, diluting token value and causing a crash.

The L2 bridge finality delay attack poses a medium severity risk, with potential liquidity-drain consequences if attackers can trigger sequencer attacks to revert withdrawals.

The overall risk score for the protocol is 7.8 out of 10, indicating a high level of risk. While the protocol's design is deemed solid, the combination of upgradeable proxies, external oracle feeds, and complex multi-strategy rebalancing introduces several attack surfaces. These vulnerabilities, if exploited, could result in partial or total loss of user funds. The report concludes with a prioritized remediation roadmap to address these identified attack vectors and enhance the platform's security.