DeFi Risks Checklist: What to Check Before You Deposit

Lesson 10 of 10 · Intermediate

Why DeFi risk needs a checklist

In the nine previous lessons we saw where DeFi breaks: code, oracles, bridges, admin keys, leverage, token incentives and composability. None of these can be understood from a glance at an APY or a TVL. A checklist helps you ask the same questions in the same order before every deposit, so the excitement of an attractive yield does not replace analysis.

This checklist does not guarantee security. Protocols that passed all of these points have been hacked too. Its purpose is to remove the obvious risks and, for the rest, to size your capital correctly.

Part one: the protocol itself

1. Audit: has the code been audited by several independent firms? Are the reports public? Were serious issues resolved? Was the audit done before the latest upgrade or after it? An audit examines code only, not keys and people; the Bybit and Drift cases showed this.
2. Age and track record: how long has the code been running on mainnet with meaningful value? A new protocol that has not been through a volatile market period has not yet passed the real test. Has it had an incident before, and how did it handle it?
3. TVL concentration: what percentage of deposits belongs to a few large addresses? Are some of them the team’s own wallets? Concentrated TVL can halve when one actor leaves.
4. Admin powers: who can upgrade the code, change parameters or pause withdrawals? Is the key a single wallet or a multisig? How many signatures are needed? Is there a timelock that gives users time to exit before changes take effect?
5. Oracle: where do prices come from? How many independent sources? For each asset, especially “dollar” or derivative tokens, is a fixed or single-source price assumed?

Part two: the asset and the exit route

• 6. Dependencies: how many layers does your asset pass through? A liquid staking token, restaking, a bridge, a vault? Count each layer as a separate point of failure. The weakest link is the risk of the entire chain.
• 7. Source of yield: does the yield come from real fees, from printing tokens or from leverage? If it is above prevailing rates, what is the checkable explanation?
• 8. Exit liquidity: if you wanted to leave tomorrow, could you? Withdrawal queues, high utilisation in a lending market, or thin pool depth for selling the token you receive can all slow or raise the cost of exit. In a crisis, everyone wants out at once.
• 9. Access risk: interfaces, network infrastructure and token issuers can restrict addresses or regions. Tokens such as USDT and many RWAs are subject to freezes. This risk is real and documented for users in sanctioned countries and must be reflected in how much you commit.

Part three: sizing the worst-case loss

10. What happens if all of it is lost? This is the last and most important question.

In DeFi the worst case is usually not a “10 percent loss”; it is “going to zero”. A bridge hack, bad debt or a stablecoin depeg can wipe out the entire deposit. So start sizing your capital from this question, not from the yield:

• Commit an amount whose complete loss would not disrupt your life and essential financial decisions.
• Spread capital across protocols and kinds of risk, not just across pools of one protocol.
• Hypothetical example: if you cannot rule out a serious failure within a year for a small protocol, assume it is significant. An annual return of 10 percent with a 10 percent chance of going to zero is, in effect, worse than simply holding.

And do not forget wallet hygiene: use a separate wallet with a limited balance for DeFi, connect only to the official address, read every signature, and regularly revoke old spending approvals. A large share of ordinary users’ losses come not from protocol hacks but from malicious signatures.

Running the checklist on a hypothetical protocol

Suppose a hypothetical “yield-bearing dollar” vault with a high advertised yield is presented to you. Your review might turn up something like this:

In this example, even if the yield is real, the structure closely resembles patterns that failed in real cases: a fixed oracle price, an opaque yield source and an admin with no timelock. The logical outcome is either to pass or to commit only an amount you can accept losing entirely. The checklist does not make the decision for you, but it shows exactly what you are betting on.

📊 See real gold futures volume behind these ideas: free order flow course · today's gold volume map

Frequently asked questions

What is the biggest DeFi risk?

There is no single risk. Code bugs, admin keys and social engineering, oracles, bridges, bad debt, depegs and a user’s own malicious signature are all common failure points. Because composability links risks together, the weakest link decides.

Does an audit mean a protocol is safe?

No. An audit reduces the chance of known bugs but does not cover admin keys, signers, oracles or later upgrades. Audited protocols have been hacked too.

How much should I put into DeFi?

We do not give financial advice. The risk-management principle is to start from the worst case: commit only an amount whose complete loss would not disrupt your life, and spread it across protocols and types of risk.

Education only, not a recommendation to buy or sell; we never give signals. Price examples are illustrative. Test any method on a demo account first, with strict risk management.