DeFi & Yield · Risk & Due Diligence
DeFi Risk & Due Diligence
Investment Education, Research & Tools for Smarter Decisions.
Use an evidence-based workflow to evaluate contracts, governance, assets, oracles, liquidity, economics, operations, and exit paths. Document unknowns as exposure constraints, not neutral scores.
Overview
Direct answer: DeFi due diligence evaluates the entire dependency stack, contracts, privileges, assets, oracles, liquidity, governance, bridges, networks, economics, incidents, and user operations, before capital is committed.
Why this subcategory matters
Checking an audit badge or total value locked (TVL) is not a diligence process. This subcategory provides an evidence hierarchy, a layered risk model, and a position policy that converts unknowns into exposure limits, alerts, and exit conditions.
Core concepts
Control
Owners, proxies, multisignatures, governance, timelocks, pauses, and fee powers.
Evidence
Verified code, audit scope, bug bounties, incidents, parameters, and on-chain state.
Dependencies
Assets, oracles, bridges, networks, interfaces, keepers, and other protocols.
Liquidity
The ability to withdraw, repay, swap, or liquidate during stress.
Operations
Wallet security, approvals, gas, monitoring, records, and exit execution.
Learning path
| Lesson | Purpose |
|---|---|
| How to Evaluate a DeFi Protocol | Run the evidence-based diligence workflow. |
| The DeFi Risk Stack | Map correlated failure paths. |
| Position Management | Set size, alerts, maintenance, and exit rules. |
How to study this material
Read the pages in order when the topic is new. For each lesson:
- Write the position or transaction in plain language.
- Identify the assets, contracts, network, data, and control dependencies.
- Reconstruct the cash flow or token flow.
- State what can change after entry.
- Define the evidence that would change the decision.
- Map the exit and recordkeeping steps.
Use examples to learn mechanics, not as live protocol parameters. Current values must come from primary documentation and on-chain state.
Decision gate
Before moving from reading to execution, answer:
- Is the exact deployment and contract version verified?
- Who can upgrade, pause, mint, or move assets?
- What critical dependencies are shared with other positions?
- How much liquidity is available in stress?
- Which unknown would stop the position?
- Is the complete unwind documented?
An unverified contract version, an unidentified admin-key holder, or an undocumented unwind path is not a neutral score. It is a reason to continue researching the protocol, reduce exposure, test with a smaller amount, or avoid the workflow entirely.
Related Swoopr Investment hubs
- Crypto fundamentals: blockchain, token, wallet, and stablecoin concepts
- Wallet security and scam detection: operational safeguards
- Tokenomics: reward emissions, unlocks, governance, and dilution
- Crypto risk management: position sizing and concentration
- Crypto taxes and records: transaction documentation
- Market structure: execution, spreads, liquidity, and slippage concepts
Frequently asked questions
Is an audit a guarantee that a contract is safe?
No. An audit is scoped evidence: a specific version of the code, reviewed against a specific checklist, at a point in time. It does not cover later upgrades, the economic design, oracle behaviour, or how administrator privileges are used. Treat it as one input among several rather than a verdict.
What is the difference between smart-contract risk and economic risk?
Smart-contract risk is the code doing something other than intended, such as a bug or an exploit. Economic risk is the code working exactly as designed while the design itself loses money under conditions the authors did not anticipate. An audit addresses the first and largely not the second.
Who can change the rules after I deposit?
Whoever holds upgrade or administrator rights, which may be a governance process, a multisig, or a single key. Upgradeable contracts can have their logic replaced after funds are deposited. Establishing who holds those rights, and what they can change without notice, is part of due diligence rather than an afterthought.
What does total value locked tell me about safety?
It measures deposits, not soundness. A high figure reflects what other people have put in, which is a popularity measure rather than a risk measure. It can also be inflated by recursive positions where the same underlying capital is counted at several layers.
Next step
Complete the Protocol Risk Scorecard and schedule re-review after material changes.
Return to the DeFi & Yield learning hub.
References
- Ethereum.org: Decentralized Finance (DeFi)
- Ethereum.org: Introduction to Smart Contracts
- Ethereum.org: Oracles
- SEC Division of Corporation Finance: Offerings and Registrations of Securities in the Crypto Asset Markets
- CFTC: Digital Assets
- FinCEN: Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies
Educational disclaimer
Educational information only; not investment, tax, legal, or personalized financial advice.