DeFi Risks
This is an important lesson in the whole course. DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → offers higher returns than banks — and when you see a bigger number, it's worth asking yourself: "what risk am I being paid for here?" In this lesson you'll get to know every risk type well enough to understand how it works and how to protect yourself from it.
Smart Contract Risks
A smart contract — like an automat that holds money
Remember the automatic store from lesson 1-1? A smart contract is that same kind of automat, except it manages your money. If the automat works correctly, everything's fine. But if it has a bug, someone can exploit it and "drain" all the funds.
A smart contract is a program. Programs are written by people. And people make mistakes. Here are the main types of risk — and how to spot each one:
1. Bug (a code error)
Bug — the simplest and most common risk
A bug is an error in the program's code. Like a typo in a dictation exercise, except here a mistake can cost millions.
Example: in 2023, Euler Finance lost $197M to a single bug in one function. One line of code — and the whole protocol was drained.
How to protect yourself: only use protocols that have been checked by independent experts (auditors) and have run for a long time without problems.
2. Reentrancy attack
Reentrancy — an exploit based on repeating an action
Imagine an ATMATMAt The Money — an option whose strike sits at the current price. that hands out cash first and only checks the account balance afterward. If you can repeat the withdrawal between those two steps — you can drain the ATMATMAt The Money — an option whose strike sits at the current price..
Reentrancy works in a similar way — the program gets called again and again before it manages to update its own records.
Example: in 2016, "The DAO" lost $60M in ETH. It was the first major DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → incident.
How to protect yourself: modern protocols have safeguards against this. But always check whether a protocol has been audited.
3. Oracle manipulation (faking the price feed)
Oracle — when someone fakes the price
DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → programs don't know on their own what SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson → or ETH costs. They rely on oracles — external price feeds. Think of it as a price board. If someone alters the price on the board, the program makes the wrong decisions.
Example: in 2022, someone faked the price on Mango Markets (SolanaSolanaA fast blockchain (under 1s, gas under $0.01). Home to the Kamino, Orca and Meteora ecosystem.Read the lesson →) and borrowed $114M — more than they were entitled to.
How to protect yourself: reliable oracles (Chainlink, Pyth) pull from many different price sources. They're hard to fool.
4. Flash loan attack (an instant loan)
Flash loan — an attack with no starting capital
Imagine you could borrow millions of dollars with no collateral at all — on the condition that you pay it back within a few seconds. That's a flash loan — a legitimate DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → feature.
But hackers use it as a tool: borrow a huge sum → manipulate a price → pocket the profit → repay the loan. All of it happens within seconds.
Examples: Cream Finance ($130M), Pancake Bunny ($45M), Harvest Finance ($34M) — all fell victim to flash loan attacks.
How to protect yourself: good protocols have safeguards. But it remains a hard problem to solve completely.
5. Upgrade risk (when the program can change)
Upgrade risk — when the rules can change
Most DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → programs can be upgraded (their code can be changed). That's useful for fixing bugs. But if someone took control, they could rewrite the program and steal all the funds.
How to protect yourself: check whether the protocol has a timelock (a delay before any change takes effect) and multi-sig (approval required from multiple people). That means one person alone can't change the program.
Rating Protocol Security
Not all protocols are equally secure. Here's a visual map of our strategy's protocols — by security (audits + age) and liquidity (TVLTVLTotal Value Locked — the total value deposited in a DeFi protocol. An indicator of how popular a protocol is. + ease of exit):
Above — each protocol as a bubble. Size = TVLTVLTotal Value Locked — the total value deposited in a DeFi protocol. An indicator of how popular a protocol is. (total value locked). Color = chain. The ideal quadrant is top-right (secure + liquid) — that's where AaveAaveEthereum lending protocol (v3). In our strategy: ETH collateral to a USDC loan.Read the lesson → and UniswapUniswapAn Ethereum concentrated-liquidity protocol (V3/V4). Its Solana counterpart is Orca.Read the lesson → sit. The danger zone is bottom-right (liquid, but not secure) — that's usually where new, hyped-up protocols end up.
Our strategy's protocols
| Protocol | Chain | Audited? | Running since | Risk tags |
|---|---|---|---|---|
| Aave | ETH | Many audits | Since 2020 | ✅ AUDITED |
| Uniswap V3 | ETH | Many audits | Since 2021 | ✅ AUDITED |
| Orca | SOL | A few audits | Since 2021 | ✅ AUDITED |
| Kamino | SOL | Many audits, solid TVLTVLTotal Value Locked — the total value deposited in a DeFi protocol. An indicator of how popular a protocol is. | Since 2022 | ✅ AUDITED |
| Deribit | CEXCEXCentralized Exchange — a centralized exchange (e.g. Nexo, Kraken, Binance). Requires KYC.Read the lesson → | Centralized exchange | Since 2016 | ⚠️ CEX |
| Meteora | SOL | AuditedAuditAn independent security review of smart-contract code. Not a guarantee, but it reduces risk.Read the lesson →, but newer | Since 2022 | ⚠️ NEW ⚠️ SC RISK |
| Uniswap V4 | ETH | New, not yet battle-tested | Since 2025 | ⚠️ NEW ⚠️ SC RISK |
What do the risk tags mean?
| Tag | What it means | How risky |
|---|---|---|
| ✅ AUDITED | Many checks, long track record with no problems | Low risk |
| ⚠️ NEW | Newer protocol — shorter track record, less tested over time | Medium risk |
| ⚠️ SC RISK | Code is more complex than average | Medium-to-high risk |
| ⚠️ CEX | Centralized exchange — not DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson →. You depend on the company | Medium risk |
| ⚠️ BRIDGE | A bridge between networks. Historically the most exploited component | High risk |
The Biggest DeFi Hacks in History
This table shows how large the real-world losses have been:
Notice the pattern
Bridge protocols (bridges between networks) dominate the list of biggest losses. BridgesBridgeA protocol that lets assets move from one blockchain to another. Historically the riskiest part of DeFi.Read the lesson → connect two different networks — that's technically very complex, and complexity is where most of the exploits live.
Our strategy doesn't use bridges directly. SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson → positions stay on the SolanaSolanaA fast blockchain (under 1s, gas under $0.01). Home to the Kamino, Orca and Meteora ecosystem.Read the lesson → network (KaminoKaminoSolana lending protocol. In our strategy: SOL collateral to a USDC loan.Read the lesson →, OrcaOrcaA Solana DEX with concentrated liquidity (Whirlpool). The basis of our LP strategy on the Solana network.Read the lesson →). ETH positions stay on the EthereumEthereumA blockchain with smart contracts. We use Aave (lending) and Uniswap (LP) on it.Read the lesson →/ArbitrumArbitrumAn Ethereum Layer 2 network. Cheaper and faster transactions than Ethereum mainnet.Read the lesson → network (AaveAaveEthereum lending protocol (v3). In our strategy: ETH collateral to a USDC loan.Read the lesson →). That reduces this risk.
Bridge Risk — Connections Between Networks
A bridge — like a ferry across a river
Imagine two islands (two networks). Each has its own currency. To move money from one island to the other, you use a ferry (a bridge). But if the ferry breaks down or someone hijacks it — your money disappears into the river.
A bridge is a protocol that moves assets between different networks — for example, from EthereumEthereumA blockchain with smart contracts. We use Aave (lending) and Uniswap (LP) on it.Read the lesson → to SolanaSolanaA fast blockchain (under 1s, gas under $0.01). Home to the Kamino, Orca and Meteora ecosystem.Read the lesson →.
Why is a bridge dangerous?
- Complexity: it has to work correctly on two different networks at the same time
- Lock-and-mint: the original tokens are locked on one side and new ones are minted on the other. If the originals are stolen, the new ones become worthless
- Few guardians: many bridges are controlled by a small group of validators (e.g. Ronin had only 9, of which 5 were compromised)
Our strategy's bridge rule
Never move a large amount through a bridge in one transaction. If you need to move $10,000:
- Move $100 first and confirm it arrived
- Then move the rest in parts
- Best of all: keep SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson → positions on the SolanaSolanaA fast blockchain (under 1s, gas under $0.01). Home to the Kamino, Orca and Meteora ecosystem.Read the lesson → network, ETH positions on the EthereumEthereumA blockchain with smart contracts. We use Aave (lending) and Uniswap (LP) on it.Read the lesson → network, and avoid bridges altogether
Rugpull — When the Team Steals the Money
Rugpull — like a fraudulent pop-up shop
Imagine a new shop opens. It offers unbelievable discounts. People rush in and pay upfront. The next day, the shop is gone with all the money. That's a rugpull.
A rugpull is when a project's team deliberately builds a protocol just to collect investors' money and disappear.
How to spot a dangerous project
Anonymous team
If the team members aren't publicly known, the risk is much higher. Legitimate projects have public founders with LinkedIn profiles.
Anonymity doesn't automatically mean fraud (Bitcoin was created by an anonymous person). But for small projects, it's a big warning sign.
An unaudited smart contract
If the code hasn't been reviewed by independent experts (auditors), nobody knows whether it actually does what it claims. It might have a hidden backdoor — a secret function that lets the team take all the funds.
Unlocked liquidity
If the team can withdraw all the funds from the protocol at any time, they can simply walk away. Legitimate projects LOCK their liquidity so the team itself can't touch it.
Unrealistic promises
1000% APY, 'guaranteed returns', 'risk-free' — these are classic signs of fraud. Nothing in DeFi is guaranteed.
If it sounds too good to be true, it probably is.
Aggressive marketing
If a project invests more in influencers than in security and code, that's a very bad sign.
Unpublished code
If the program's code isn't publicly visible on Etherscan or Solscan, you can't see what it actually does. Legitimate projects always publish their code.
Liquidation Risk — When Your Collateral Gets Sold
When you borrow in DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson →, your collateral can be automatically sold if its value drops too far.
Liquidation — like a mortgage
Imagine you took out a bank loan and put up your house as collateral. If the house's value fell sharply, the bank could force you to sell it to cover the debt. In DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson →, this happens automatically and within seconds.
How does liquidation work? An example:
- You deposit 126 SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson → (price $88) = $11,088 of collateral
- You borrow 4,704 USDCUSDCA USD stablecoin issued by Circle. Regulated, audited monthly. Our primary stablecoin and loan asset in the Kamino/Aave strategies.Read the lesson → (that's 42% of the collateral's value — called LTVLTVLoan-to-Value — the ratio of debt to collateral value. LTV 30% is considered safe. LTV 71%+ triggers liquidation.Read the lesson →)
- The SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson → price drops to $55 → your collateral is now worth only $6,930
- LTVLTVLoan-to-Value — the ratio of debt to collateral value. LTV 30% is considered safe. LTV 71%+ triggers liquidation.Read the lesson → rises to 68% — approaching the danger threshold (71%)
- If LTVLTVLoan-to-Value — the ratio of debt to collateral value. LTV 30% is considered safe. LTV 71%+ triggers liquidation.Read the lesson → goes above 71% → the program automatically sells part of your SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson →
The LTV color system on the platform
On the DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → Risk OS platform, the LTVLTVLoan-to-Value — the ratio of debt to collateral value. LTV 30% is considered safe. LTV 71%+ triggers liquidation.Read the lesson → indicator is shown with colors:
- Green (under 40%): safe, liquidation is far away
- Yellow (40–55%): keep watching, but still fine
- Orange (55–65%): danger zone, action needed
- Red (over 65%): critical level, urgent action needed
Our strategy keeps LTVLTVLoan-to-Value — the ratio of debt to collateral value. LTV 30% is considered safe. LTV 71%+ triggers liquidation.Read the lesson → around ~42% — a safe level.
Impermanent Loss — in LP Positions
When you provide liquidity (Orca, Meteora), you can experience impermanent loss — a reduction in your gains compared with simply holding the assets.
Impermanent loss — like a market-stall trade
Imagine you have 10 apples and 10 pears. You hand them over to a market trader's stall. If the price of apples suddenly doubles, you would have earned more just by holding onto your apples. The gap between "what you'd have if you'd done nothing" and "what you have now" is impermanent loss.
But the trader's stall earns fees! If the fees cover the loss, you're still ahead.
Why is concentrated liquidity's IL bigger?
In our strategy, liquidity is provided in a narrower price range. That means:
- More fees (you earn more from a smaller range)
- Bigger impermanent loss (if the price moves out of your range)
Fees vs. loss — the balance
In our strategy, the LPLPLiquidity Provider — deposits tokens into a pool and earns a share of trading fees.Read the lesson → position earns ~68% per year in fees (a live, changing snapshot — not a forecast). For the strategy to break even, it needs at least ~46% per year. Right now the LPLPLiquidity Provider — deposits tokens into a pool and earns a share of trading fees.Read the lesson → is earning 48% more than it needs (a coverage ratio of 1.48x) — that's a safety buffer.
Options Risk (Deribit)
Deribit is a centralized exchange — not DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson →. That means it carries a different kind of risk.
Exchange risks
- The exchange can collapse — as happened with FTX in 2022
- It can be banned in certain countries
- It can be illiquid — hard to close a position when there are no buyers
- Counterparty risk — if Deribit fails to pay out, there's nothing you can do about it
Options position risks
| Position | Biggest risk | Worst-case scenario |
|---|---|---|
| Long PutPutAn option type that grants the right to SELL at a set price. Used as insurance. (bought protection) | You lose the entire premium if the price doesn't fall enough | -$1,300 (the full amount paid) |
| Short PutPutAn option type that grants the right to SELL at a set price. Used as insurance. (sold protection) | SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson →'s price falls sharply — you must buy at a high price | A large position around $60–65 |
| Short CallCallAn option type that grants the right to BUY at the strike price. The opposite of a put. (sold upside) | SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson →'s price rises sharply — you must sell cheap | You sell SOLSOLSolana's native token. Used to pay gas and as collateral.Read the lesson → at $160 (even though it's worth more) |
How Much Money to Put Into DeFi?
The most important rule: never invest more than you can afford to lose.
Conservative profile (cautious)
| Your assets | DeFi share | Maximum amount |
|---|---|---|
| Under $10,000 | 0–5% | $0–500 |
| $10,000–$50,000 | 5–10% | $500–5,000 |
| $50,000–$200,000 | 10–15% | $5,000–30,000 |
| Over $200,000 | 10–20% | $20,000–40,000 |
Moderate profile
| Your assets | DeFi share | Maximum amount |
|---|---|---|
| Under $10,000 | 5–10% | $500–1,000 |
| $10,000–$50,000 | 10–20% | $1,000–10,000 |
| $50,000–$200,000 | 15–25% | $7,500–50,000 |
| Over $200,000 | 15–30% | $30,000–60,000 |
Aggressive profile (bold)
| Your assets | DeFi share | Maximum amount |
|---|---|---|
| Under $10,000 | 10–20% | $1,000–2,000 |
| $10,000–$50,000 | 20–40% | $2,000–20,000 |
| $50,000–$200,000 | 25–40% | $12,500–80,000 |
| Over $200,000 | 20–40% | $40,000–80,000 |
The golden rule — how you decide
Only invest money you don't need for everyday life. DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → isn't a bank with deposit insurance, so pick an amount such that even the worst-case scenario wouldn't change your day-to-day life. It's one sentence that protects you: I only invest what I can calmly walk away from.
Diversification — Don't Put All Your Eggs in One Basket
Even within DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson →, it's important to spread out risk:
- Network diversification: use both SolanaSolanaA fast blockchain (under 1s, gas under $0.01). Home to the Kamino, Orca and Meteora ecosystem.Read the lesson → and EthereumEthereumA blockchain with smart contracts. We use Aave (lending) and Uniswap (LP) on it.Read the lesson → — not just one
- Protocol diversification: use several protocols — KaminoKaminoSolana lending protocol. In our strategy: SOL collateral to a USDC loan.Read the lesson → + OrcaOrcaA Solana DEX with concentrated liquidity (Whirlpool). The basis of our LP strategy on the Solana network.Read the lesson → + DeribitDeribitA crypto options exchange. In our strategy this is where we buy put protection and sell covered calls.
- Strategy diversification: use several strategies — A + B
- Time diversification: don't invest everything at once — spread it over several weeks
- Options diversification: hold protection (PutPutAn option type that grants the right to SELL at a set price. Used as insurance.) alongside profit positions (Short CallCallAn option type that grants the right to BUY at the strike price. The opposite of a put.)
Protocol Risk Map
Here's roughly how various places that hold money position themselves — by security and liquidity. Ideal: the top-right zone (secure + liquid).
This is an illustrative positioning for teaching purposes (like a "magic quadrant"), not exact data. "BridgeBridgeA protocol that lets assets move from one blockchain to another. Historically the riskiest part of DeFi.Read the lesson →" and new, unaudited protocols sit lower (riskier); old, audited protocols with high liquidity sit in the top right.
How DeFi Risk OS Helps You Manage These Risks
Our platform was built to help you see and manage these risks in real time:
- LTV indicator — shows how close you are to liquidation (color-coded)
- Delta indicator — shows how much your portfolio depends on price movement
- Protection percentage — shows how much of your portfolio is protected by options
- Alerts — automatically flag when something's off
- Scenario analysis — shows what would happen if the price fell -30% or rose +50%
- Breakeven calculator — shows the minimum yield your LPLPLiquidity Provider — deposits tokens into a pool and earns a share of trading fees.Read the lesson → needs to generate
Summary
- Smart contract risks: code bugs, reentrancy, price manipulation, flash loans, upgrade risk
- Bridge protocols are the most dangerous — avoid them where you can
- Check a protocol's audit history, age, and team
- Rugpull warning signs: anonymous, unaudited, unrealistic promises
- Liquidation risk is managed by keeping LTVLTVLoan-to-Value — the ratio of debt to collateral value. LTV 30% is considered safe. LTV 71%+ triggers liquidation.Read the lesson → low (~42% in our strategy)
- Impermanent loss is managed through higher fees
- Only invest what you can afford to lose
- On the DeFiDeFiDecentralized Finance — financial services without intermediaries, operating through smart contracts.Read the lesson → Risk OS platform, all risk indicators are visible in real time
Understand DeFi risks? Now you can monitor and manage them in real time with the DeFi Risk OS platform.
Manage risk on the platformTheory about risk fades — research you did with your own hands doesn't. Takes about 15 minutes, no funds need to go anywhere.
This is a research task — don't connect a wallet or invest anything anywhere. All the numbers and audits are public and need no login.
This is learning, not investing — use only small amounts you treat as tuition.
You just worked through the whole DeFi risk map — from smart contract bugs to liquidation — and you know how to manage each one. Most investors never learn this.