Educational content, not investment advice. Crypto-asset values fluctuate.

Modulis 2 · Security and practice
3/8

DeFi Risks

This is an important lesson in the whole course. DeFi offers higher returns than banks — and when you see a bigger number, it's worth asking yourself: "what risk am I being paid for here?" In this lesson you'll get to know every risk type well enough to understand how it works and how to protect yourself from it.


Smart Contract Risks

A smart contract — like an automat that holds money

Remember the automatic store from lesson 1-1? A smart contract is that same kind of automat, except it manages your money. If the automat works correctly, everything's fine. But if it has a bug, someone can exploit it and "drain" all the funds.

A smart contract is a program. Programs are written by people. And people make mistakes. Here are the main types of risk — and how to spot each one:

1. Bug (a code error)

Bug — the simplest and most common risk

A bug is an error in the program's code. Like a typo in a dictation exercise, except here a mistake can cost millions.

Example: in 2023, Euler Finance lost $197M to a single bug in one function. One line of code — and the whole protocol was drained.

How to protect yourself: only use protocols that have been checked by independent experts (auditors) and have run for a long time without problems.

2. Reentrancy attack

Reentrancy — an exploit based on repeating an action

Imagine an ATM that hands out cash first and only checks the account balance afterward. If you can repeat the withdrawal between those two steps — you can drain the ATM.

Reentrancy works in a similar way — the program gets called again and again before it manages to update its own records.

Example: in 2016, "The DAO" lost $60M in ETH. It was the first major DeFi incident.

How to protect yourself: modern protocols have safeguards against this. But always check whether a protocol has been audited.

3. Oracle manipulation (faking the price feed)

Oracle — when someone fakes the price

DeFi programs don't know on their own what SOL or ETH costs. They rely on oracles — external price feeds. Think of it as a price board. If someone alters the price on the board, the program makes the wrong decisions.

Example: in 2022, someone faked the price on Mango Markets (Solana) and borrowed $114M — more than they were entitled to.

How to protect yourself: reliable oracles (Chainlink, Pyth) pull from many different price sources. They're hard to fool.

4. Flash loan attack (an instant loan)

Flash loan — an attack with no starting capital

Imagine you could borrow millions of dollars with no collateral at all — on the condition that you pay it back within a few seconds. That's a flash loan — a legitimate DeFi feature.

But hackers use it as a tool: borrow a huge sum → manipulate a price → pocket the profit → repay the loan. All of it happens within seconds.

Examples: Cream Finance ($130M), Pancake Bunny ($45M), Harvest Finance ($34M) — all fell victim to flash loan attacks.

How to protect yourself: good protocols have safeguards. But it remains a hard problem to solve completely.

5. Upgrade risk (when the program can change)

Upgrade risk — when the rules can change

Most DeFi programs can be upgraded (their code can be changed). That's useful for fixing bugs. But if someone took control, they could rewrite the program and steal all the funds.

How to protect yourself: check whether the protocol has a timelock (a delay before any change takes effect) and multi-sig (approval required from multiple people). That means one person alone can't change the program.


Rating Protocol Security

Not all protocols are equally secure. Here's a visual map of our strategy's protocols — by security (audits + age) and liquidity (TVL + ease of exit):

Protocol risk matrix
↑ SecurityLiquidity →Safe, illiquid✓ Ideal✗ RiskyLiquid, riskyAaveUniswapKaminoOrcaDeribitMeteora
Colors (chain)
solana
ethereum
CEX (centralized)
Bridge
Bubble size
= TVL size

Above — each protocol as a bubble. Size = TVL (total value locked). Color = chain. The ideal quadrant is top-right (secure + liquid) — that's where Aave and Uniswap sit. The danger zone is bottom-right (liquid, but not secure) — that's usually where new, hyped-up protocols end up.

Our strategy's protocols

ProtocolChainAudited?Running sinceRisk tags
AaveETHMany auditsSince 2020 AUDITED
Uniswap V3ETHMany auditsSince 2021 AUDITED
OrcaSOLA few auditsSince 2021 AUDITED
KaminoSOLMany audits, solid TVLSince 2022 AUDITED
DeribitCEXCentralized exchangeSince 2016⚠️ CEX
MeteoraSOLAudited, but newerSince 2022⚠️ NEW ⚠️ SC RISK
Uniswap V4ETHNew, not yet battle-testedSince 2025⚠️ NEW ⚠️ SC RISK

What do the risk tags mean?

TagWhat it meansHow risky
AUDITEDMany checks, long track record with no problemsLow risk
⚠️ NEWNewer protocol — shorter track record, less tested over timeMedium risk
⚠️ SC RISKCode is more complex than averageMedium-to-high risk
⚠️ CEXCentralized exchange — not DeFi. You depend on the companyMedium risk
⚠️ BRIDGEA bridge between networks. Historically the most exploited componentHigh risk

The Biggest DeFi Hacks in History

This table shows how large the real-world losses have been:

YearProjectLossCauseType
2022Ronin Bridge (Axie)$625MValidators taken overBridge
2021Poly Network$611MCross-chain code bugBridge
2022Wormhole Bridge$326MSignature verification bugBridge
2022Nomad Bridge$190MInitialization bugBridge
2023Euler Finance$197MBug in a single functionLending
2023Mixin Network$200MDatabase hackInfrastructure
2022Mango Markets$114MPrice manipulationDEX/Lending
2021Cream Finance$130MFlash loan + oracle attackLending

Bridge Risk — Connections Between Networks

A bridge — like a ferry across a river

Imagine two islands (two networks). Each has its own currency. To move money from one island to the other, you use a ferry (a bridge). But if the ferry breaks down or someone hijacks it — your money disappears into the river.

A bridge is a protocol that moves assets between different networks — for example, from Ethereum to Solana.

Why is a bridge dangerous?

  1. Complexity: it has to work correctly on two different networks at the same time
  2. Lock-and-mint: the original tokens are locked on one side and new ones are minted on the other. If the originals are stolen, the new ones become worthless
  3. Few guardians: many bridges are controlled by a small group of validators (e.g. Ronin had only 9, of which 5 were compromised)

Our strategy's bridge rule

Never move a large amount through a bridge in one transaction. If you need to move $10,000:


Rugpull — When the Team Steals the Money

Rugpull — like a fraudulent pop-up shop

Imagine a new shop opens. It offers unbelievable discounts. People rush in and pay upfront. The next day, the shop is gone with all the money. That's a rugpull.

A rugpull is when a project's team deliberately builds a protocol just to collect investors' money and disappear.

How to spot a dangerous project

1

Anonymous team

If the team members aren't publicly known, the risk is much higher. Legitimate projects have public founders with LinkedIn profiles.

Anonymity doesn't automatically mean fraud (Bitcoin was created by an anonymous person). But for small projects, it's a big warning sign.

2

An unaudited smart contract

If the code hasn't been reviewed by independent experts (auditors), nobody knows whether it actually does what it claims. It might have a hidden backdoor — a secret function that lets the team take all the funds.

3

Unlocked liquidity

If the team can withdraw all the funds from the protocol at any time, they can simply walk away. Legitimate projects LOCK their liquidity so the team itself can't touch it.

4

Unrealistic promises

1000% APY, 'guaranteed returns', 'risk-free' — these are classic signs of fraud. Nothing in DeFi is guaranteed.

If it sounds too good to be true, it probably is.

5

Aggressive marketing

If a project invests more in influencers than in security and code, that's a very bad sign.

6

Unpublished code

If the program's code isn't publicly visible on Etherscan or Solscan, you can't see what it actually does. Legitimate projects always publish their code.


Liquidation Risk — When Your Collateral Gets Sold

When you borrow in DeFi, your collateral can be automatically sold if its value drops too far.

Liquidation — like a mortgage

Imagine you took out a bank loan and put up your house as collateral. If the house's value fell sharply, the bank could force you to sell it to cover the debt. In DeFi, this happens automatically and within seconds.

How does liquidation work? An example:

  1. You deposit 126 SOL (price $88) = $11,088 of collateral
  2. You borrow 4,704 USDC (that's 42% of the collateral's value — called LTV)
  3. The SOL price drops to $55 → your collateral is now worth only $6,930
  4. LTV rises to 68% — approaching the danger threshold (71%)
  5. If LTV goes above 71% → the program automatically sells part of your SOL

The LTV color system on the platform

On the DeFi Risk OS platform, the LTV indicator is shown with colors:

  • Green (under 40%): safe, liquidation is far away
  • Yellow (40–55%): keep watching, but still fine
  • Orange (55–65%): danger zone, action needed
  • Red (over 65%): critical level, urgent action needed

Our strategy keeps LTV around ~42% — a safe level.


Impermanent Loss — in LP Positions

When you provide liquidity (Orca, Meteora), you can experience impermanent loss — a reduction in your gains compared with simply holding the assets.

Impermanent loss — like a market-stall trade

Imagine you have 10 apples and 10 pears. You hand them over to a market trader's stall. If the price of apples suddenly doubles, you would have earned more just by holding onto your apples. The gap between "what you'd have if you'd done nothing" and "what you have now" is impermanent loss.

But the trader's stall earns fees! If the fees cover the loss, you're still ahead.

Why is concentrated liquidity's IL bigger?

In our strategy, liquidity is provided in a narrower price range. That means:

Fees vs. loss — the balance

In our strategy, the LP position earns ~68% per year in fees (a live, changing snapshot — not a forecast). For the strategy to break even, it needs at least ~46% per year. Right now the LP is earning 48% more than it needs (a coverage ratio of 1.48x) — that's a safety buffer.


Options Risk (Deribit)

Deribit is a centralized exchange — not DeFi. That means it carries a different kind of risk.

Exchange risks

Options position risks

PositionBiggest riskWorst-case scenario
Long Put (bought protection)You lose the entire premium if the price doesn't fall enough-$1,300 (the full amount paid)
Short Put (sold protection)SOL's price falls sharply — you must buy at a high priceA large position around $60–65
Short Call (sold upside)SOL's price rises sharply — you must sell cheapYou sell SOL at $160 (even though it's worth more)

How Much Money to Put Into DeFi?

The most important rule: never invest more than you can afford to lose.

Conservative profile (cautious)

Your assetsDeFi shareMaximum amount
Under $10,0000–5%$0–500
$10,000–$50,0005–10%$500–5,000
$50,000–$200,00010–15%$5,000–30,000
Over $200,00010–20%$20,000–40,000

Moderate profile

Your assetsDeFi shareMaximum amount
Under $10,0005–10%$500–1,000
$10,000–$50,00010–20%$1,000–10,000
$50,000–$200,00015–25%$7,500–50,000
Over $200,00015–30%$30,000–60,000

Aggressive profile (bold)

Your assetsDeFi shareMaximum amount
Under $10,00010–20%$1,000–2,000
$10,000–$50,00020–40%$2,000–20,000
$50,000–$200,00025–40%$12,500–80,000
Over $200,00020–40%$40,000–80,000

The golden rule — how you decide

Only invest money you don't need for everyday life. DeFi isn't a bank with deposit insurance, so pick an amount such that even the worst-case scenario wouldn't change your day-to-day life. It's one sentence that protects you: I only invest what I can calmly walk away from.


Diversification — Don't Put All Your Eggs in One Basket

Even within DeFi, it's important to spread out risk:

  1. Network diversification: use both Solana and Ethereum — not just one
  2. Protocol diversification: use several protocols — Kamino + Orca + Deribit
  3. Strategy diversification: use several strategies — A + B
  4. Time diversification: don't invest everything at once — spread it over several weeks
  5. Options diversification: hold protection (Put) alongside profit positions (Short Call)

Protocol Risk Map

Here's roughly how various places that hold money position themselves — by security and liquidity. Ideal: the top-right zone (secure + liquid).

Protocol risk matrix
↑ SecurityLiquidity →Safe, illiquid✓ Ideal✗ RiskyLiquid, riskyAaveKaminoOrcaNexoBridgeNew
Colors (chain)
solana
ethereum
CEX (centralized)
Bridge
Bubble size
= TVL size

This is an illustrative positioning for teaching purposes (like a "magic quadrant"), not exact data. "Bridge" and new, unaudited protocols sit lower (riskier); old, audited protocols with high liquidity sit in the top right.

How DeFi Risk OS Helps You Manage These Risks

Our platform was built to help you see and manage these risks in real time:


Summary

Understand DeFi risks? Now you can monitor and manage them in real time with the DeFi Risk OS platform.

Manage risk on the platform
Quick check
Which protocols have historically suffered the BIGGEST losses from hacks?
Practice task
0 / 4
Size up protocol risk with your own eyes

Theory about risk fades — research you did with your own hands doesn't. Takes about 15 minutes, no funds need to go anywhere.

This is a research task — don't connect a wallet or invest anything anywhere. All the numbers and audits are public and need no login.

This is learning, not investing — use only small amounts you treat as tuition.

You just worked through the whole DeFi risk map — from smart contract bugs to liquidation — and you know how to manage each one. Most investors never learn this.