--- title: "DeFi Risk & Due Diligence" description: "DeFi risk and due diligence: use a layered diligence process covering contracts, governance, oracles, liquidity, assets, bridges, and operational risk." canonical: https://www.getswoopr.com/learn/defi-and-yield-farming/risk-and-due-diligence/ source: "Swoopr Investment: https://www.getswoopr.com" --- ## Overview **Direct answer:** DeFi due diligence evaluates the entire dependency stack, contracts, privileges, assets, oracles, liquidity, governance, bridges, networks, economics, incidents, and user operations, before capital is committed. # DeFi Risk & Due Diligence Use an evidence-based workflow to evaluate contracts, governance, assets, oracles, liquidity, economics, operations, and exit paths. Document unknowns as exposure constraints, not neutral scores. ## Why this subcategory matters Checking an audit badge or total value locked (TVL) is not a diligence process. This subcategory provides an evidence hierarchy, a layered risk model, and a position policy that converts unknowns into exposure limits, alerts, and exit conditions. ## Core concepts ### Control Owners, proxies, multisignatures, governance, timelocks, pauses, and fee powers. ### Evidence Verified code, audit scope, bug bounties, incidents, parameters, and on-chain state. ### Dependencies Assets, oracles, bridges, networks, interfaces, keepers, and other protocols. ### Liquidity The ability to withdraw, repay, swap, or liquidate during stress. ### Operations Wallet security, approvals, gas, monitoring, records, and exit execution. ## Learning path | Lesson | Purpose | | --- | --- | | [How to Evaluate a DeFi Protocol](https://www.getswoopr.com/learn/defi-and-yield-farming/risk-and-due-diligence/how-to-evaluate-a-defi-protocol/) | Run the evidence-based diligence workflow. | | [The DeFi Risk Stack](https://www.getswoopr.com/learn/defi-and-yield-farming/risk-and-due-diligence/defi-risk-stack/) | Map correlated failure paths. | | [Position Management](https://www.getswoopr.com/learn/defi-and-yield-farming/risk-and-due-diligence/defi-position-management/) | Set size, alerts, maintenance, and exit rules. | ## How to study this material Read the pages in order when the topic is new. For each lesson: 1. Write the position or transaction in plain language. 2. Identify the assets, contracts, network, data, and control dependencies. 3. Reconstruct the cash flow or token flow. 4. State what can change after entry. 5. Define the evidence that would change the decision. 6. Map the exit and recordkeeping steps. Use examples to learn mechanics, not as live protocol parameters. Current values must come from primary documentation and on-chain state. ## Decision gate Before moving from reading to execution, answer: - Is the exact deployment and contract version verified? - Who can upgrade, pause, mint, or move assets? - What critical dependencies are shared with other positions? - How much liquidity is available in stress? - Which unknown would stop the position? - Is the complete unwind documented? An unverified contract version, an unidentified admin-key holder, or an undocumented unwind path is not a neutral score. It is a reason to continue researching the protocol, reduce exposure, test with a smaller amount, or avoid the workflow entirely. ## Related Swoopr Investment hubs - [Crypto fundamentals](https://www.getswoopr.com/learn/crypto-fundamentals/): blockchain, token, wallet, and stablecoin concepts - [Wallet security and scam detection](https://www.getswoopr.com/security/): operational safeguards - [Tokenomics](https://www.getswoopr.com/crypto/tokenomics/how-to-analyze-tokenomics/): reward emissions, unlocks, governance, and dilution - [Crypto risk management](https://www.getswoopr.com/learn/crypto-risk-management/): position sizing and concentration - [Crypto taxes and records](https://www.getswoopr.com/learn/taxes-and-rules/): transaction documentation - [Market structure](https://www.getswoopr.com/learn/market-structure-and-trade-execution/): execution, spreads, liquidity, and slippage concepts ## Frequently asked questions ### Is an audit a guarantee that a contract is safe? No. An audit is scoped evidence: a specific version of the code, reviewed against a specific checklist, at a point in time. It does not cover later upgrades, the economic design, oracle behaviour, or how administrator privileges are used. Treat it as one input among several rather than a verdict. ### What is the difference between smart-contract risk and economic risk? Smart-contract risk is the code doing something other than intended, such as a bug or an exploit. Economic risk is the code working exactly as designed while the design itself loses money under conditions the authors did not anticipate. An audit addresses the first and largely not the second. ### Who can change the rules after I deposit? Whoever holds upgrade or administrator rights, which may be a governance process, a multisig, or a single key. Upgradeable contracts can have their logic replaced after funds are deposited. Establishing who holds those rights, and what they can change without notice, is part of due diligence rather than an afterthought. ### What does total value locked tell me about safety? It measures deposits, not soundness. A high figure reflects what other people have put in, which is a popularity measure rather than a risk measure. It can also be inflated by recursive positions where the same underlying capital is counted at several layers. ## Next step Complete the [Protocol Risk Scorecard](https://www.getswoopr.com/tools/defi-protocol-risk-scorecard/) and schedule re-review after material changes. Return to the [DeFi & Yield learning hub](https://www.getswoopr.com/learn/defi-and-yield-farming/). ## References - [Ethereum.org: Decentralized Finance (DeFi)](https://ethereum.org/defi/) - [Ethereum.org: Introduction to Smart Contracts](https://ethereum.org/smart-contracts/) - [Ethereum.org: Oracles](https://ethereum.org/developers/docs/oracles/) - [SEC Division of Corporation Finance: Offerings and Registrations of Securities in the Crypto Asset Markets](https://www.sec.gov/newsroom/speeches-statements/cf-crypto-securities-041025-offerings-registrations-securities-crypto-asset-markets) - [CFTC: Digital Assets](https://www.cftc.gov/digitalassets/index.htm) - [FinCEN: Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies](https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-persons-administering) ## Educational disclaimer Educational information only; not investment, tax, legal, or personalized financial advice. ## Related Reading - [DeFi & Yield: Free Learning Path](https://www.getswoopr.com/learn/defi-and-yield-farming/) the section this guide belongs to - [DeFi Position Sizing, Monitoring, and Exit Planning](https://www.getswoopr.com/learn/defi-and-yield-farming/risk-and-due-diligence/defi-position-management/) covered in depth here - [The DeFi Risk Stack: Contract, Oracle, Asset, Liquidity, and Governance Risk](https://www.getswoopr.com/learn/defi-and-yield-farming/risk-and-due-diligence/defi-risk-stack/) covered in depth here - [How to Evaluate a DeFi Protocol](https://www.getswoopr.com/learn/defi-and-yield-farming/risk-and-due-diligence/how-to-evaluate-a-defi-protocol/) covered in depth here - [DeFi Foundations](https://www.getswoopr.com/learn/defi-and-yield-farming/foundations/) a companion guide in this cluster - [DeFi Glossary: Essential Terms](https://www.getswoopr.com/learn/defi-and-yield-farming/glossary/) a companion guide in this cluster - [DeFi Lending & Borrowing](https://www.getswoopr.com/learn/defi-and-yield-farming/lending-and-borrowing/) a companion guide in this cluster - [Liquidity Pools & AMMs](https://www.getswoopr.com/learn/defi-and-yield-farming/liquidity-pools-and-amms/) a companion guide in this cluster - [Yield Farming & Vaults](https://www.getswoopr.com/learn/defi-and-yield-farming/yield-farming-and-vaults/) a companion guide in this cluster