What are the main risks of DeFi?

Why is DeFi riskier than it looks?

A DeFi app can look as polished as a banking app, but the structure underneath is different. Your funds sit in smart contracts that anyone can study for weaknesses, prices come from outside feeds, and many services are stacked on top of one another. When something breaks, there is usually no insurer, regulator or help desk to reverse it.

Official bodies keep reaching the same conclusion. In August 2022 the FBI warned that criminals were increasingly exploiting vulnerabilities in DeFi platforms, reporting that $1.3 billion in crypto was stolen between January and March 2022, almost 97% of it from DeFi. In its 2023 report, the securities regulators' body IOSCO cited a blockchain analytics firm's estimate that attacks on DeFi protocols made up 82.1% of all crypto-assets stolen by hackers in 2022 — $3.1 billion — up from 73.3% in 2021.

What are the main types of DeFi risk?

Some risks belong to the protocol, others to you. Lost keys, a phishing site or a malicious token approval can empty a wallet even if every protocol you use is sound; see common crypto scams and token approvals explained.

How do DeFi exploits actually happen?

The FBI's 2022 warning describes three patterns. Attackers used flash loans — uncollateralized loans that must be repaid within one transaction — to trigger flaws in a platform's contracts. They exploited weak signature checks on token bridges. And they manipulated price pairs, taking advantage of a platform's reliance on a single price oracle, to take about $35 million.

Oracle attacks can work without any code bug. In the Mango Markets case, the US Commodity Futures Trading Commission alleged that a trader pushed up the price of the MNGO token on the exchanges feeding the platform's oracle, then used the inflated positions as collateral to withdraw over $110 million in October 2022. Our guide to blockchain oracles explains the mechanics.

Leverage adds a slower kind of failure. In lending protocols, positions are liquidated automatically when collateral falls in value. The Bank for International Settlements warns that when leveraged investors are forced to cut debt, they shed assets and push prices down further — which can trigger the next round of liquidations. See how DeFi lending works.

Why can one failure spread across DeFi?

DeFi apps are designed to plug into each other: a token from one protocol becomes collateral in a second and liquidity in a third. The BIS calls this built-in interconnectedness, and the Financial Stability Board says DeFi inherits — and may amplify — the vulnerabilities of traditional finance, including leverage, liquidity mismatches and interconnectedness. IOSCO points to the TerraUSD collapse and FTX's insolvency as events whose effects rippled through DeFi; we cover the first in what happened to TerraUSD.

Concentrated control is another channel. The BIS describes a "decentralisation illusion": governance-token holders, often the developers, decide on upgrades. The FSB found voting power in major protocols to be extremely concentrated. If a small group can change the rules or pause contracts, you are trusting that group.

How can you reduce your DeFi risk?

No checklist makes DeFi safe, but the FBI's advice and basic hygiene remove the most avoidable losses.

1. Research the protocol. Understand what it does, who controls upgrades and where its prices come from.

2. Look for independent audits. The FBI recommends checking that a platform has had one or more code audits by independent auditors. An audit lowers the odds of a bug; it does not rule one out.

3. Be wary of rushed launches. The FBI flags pools with very short windows to join and contracts deployed quickly without audits.

4. Start small and spread out. Send a test transaction first, and avoid putting everything into one protocol, chain or bridge.

5. Limit leverage and approvals. Keep loans well clear of liquidation and revoke approvals you no longer need.

What mistakes do beginners make about DeFi risk?

• Equating "audited" with "safe". Audits review code at one point in time; exploits still happen, and oracle or governance problems may be outside their scope.
• Reading a high yield as a sign of quality. Unusually high returns usually mean unusual risk, or rewards paid in a token that can fall in value.
• Judging safety by size. A large total value locked shows how much is deposited, not how well it is protected — and makes a bigger prize.
• Forgetting the legal side. The US Treasury found that many DeFi services do not meet anti-money-laundering obligations, and IOSCO says the people controlling a DeFi arrangement should be subject to the same laws as any financial firm. Rules can change what a service may offer you; see KYC and AML explained.