DeFi Risks: The Nine That Actually Cost People Money

1. Smart contract failure

The risk everyone names first, and not the largest. Code holding funds can have bugs — reentrancy, arithmetic errors, broken access control, upgradeable proxies pointing somewhere unexpected.

Signals: how long the contracts have been live and holding real value, whether they are upgradeable and who controls the upgrade key, whether there is a timelock on changes, and whether a bug bounty exists and pays enough to outbid an exploit. Time under load is the most reliable signal there is; audits help but prove less than people assume — see smart contract audits.

2. Oracle manipulation

Do not break the protocol — change what it believes. If a lending market prices collateral from a market an attacker can move cheaply, they push the price, borrow against inflated collateral, and leave the bad debt behind. Historically this has cost more than code bugs.

Signals: whether prices come from a major aggregated provider or the protocol's own thin pool; whether they aggregate across venues; whether there are bounds on implausible moves; and what happens when a feed goes stale — halt, or keep liquidating on old data.

3. Economic design

Every contract works as written and the system still fails, because the incentives lead somewhere its designers did not model. Yields paid in a token whose only demand is the yield. Redemption mechanisms that are stabilising in calm markets and reflexive in falling ones. Reward emissions funded by nothing but new deposits.

The test: where does the yield actually come from? If the answer is trading fees, borrower interest, or protocol revenue, it is real and it has a ceiling. If the answer is token emissions, you are being paid in dilution and the question becomes who buys the token. If nobody can explain the source in one sentence, that is the finding.

4. Liquidation

Any borrowed position has a price at which it is closed automatically, and liquidations cluster: everyone is liquidated in the same move, into the same order books, which pushes the price further and liquidates the next tier.

Mitigation is unglamorous: headroom. Borrowing the maximum allowed means starting one bad hour from liquidation. Remember too that a health factor decays on its own as interest accrues — a position left alone gets riskier by doing nothing. More in DeFi lending platforms.

5. Depeg

Assets that are supposed to track something sometimes don't: stablecoins below a dollar, liquid staking tokens below their backing, wrapped assets below the thing they wrap.

Two very different cases. A liquidity depeg is temporary — the backing is fine, the exit queue is congested, and it recovers. A solvency depeg is permanent, because the backing is not there. Telling them apart in the moment is hard and is where most losses occur, because the second one looks exactly like the first for the first few hours. The compounding danger is using a pegged asset as collateral: the depeg and the liquidation arrive together.

6. Governance

Parameters your position depends on can be changed by vote: collateral factors, fees, reward rates, which oracle is used, occasionally the contract itself. Governance attacks are real — acquire or borrow enough voting power, pass a proposal that drains the treasury.

Signals: is voting power concentrated enough that one holder can pass a proposal alone; is there a timelock giving users time to exit after a proposal passes; can anything be executed with no delay at all.

7. Bridges

Bridges have lost more value than any other category in DeFi, by a wide margin. They are structurally hard: large pooled value, complex cross-chain verification, and frequently a small validator set holding the keys.

The practical implication: a wrapped asset is a claim on a bridge, not the asset. If the bridge fails, the wrapper is worth what its backing is worth, which may be nothing. Minimise both the number of bridges you cross and the time you sit in wrapped form.

8. Counterparty

Some things called DeFi are not. Custodial yield products, centralised earn accounts, and protocols with a discretionary admin key are credit exposure wearing DeFi vocabulary. That is not automatically bad — it is simply a different risk, assessed by looking at the entity rather than the code.

The question: can anyone move my funds without my signature? If yes, whatever the interface says, this is counterparty risk.

9. Correlation

The one most consistently underpriced. Risks are presented as a list of small independent probabilities, which makes the total look tolerable. In a real stress event they arrive together, because they share a cause.

A leveraged liquidity position in a volatile market goes wrong like this: price falls, impermanent loss increases, the position's value drops, the health factor falls, liquidation fires into thin liquidity, and the reward token — correlated with everything else — falls at the same time. Five outcomes, one cause. Any risk model that treats them as independent is wrong by orders of magnitude, and it is exactly the model most people carry implicitly.

And: user error

Not a protocol risk, and it still loses more retail funds than several of the categories above combined: approving a malicious contract, signing a blind transaction, a phishing front end, sending to the wrong chain, a seed phrase stored in cloud notes.

The unexciting defences work: revoke token approvals you no longer need, bookmark front ends instead of searching for them, use a hardware wallet for anything material, and treat any unexpected prompt to sign as hostile until proven otherwise.

Using this

Before any deposit, name which of the nine apply and how badly. A stablecoin supplied to an established lending market: contract, oracle, governance, mild correlation. A leveraged liquidity position on a new protocol with a bridged asset: all nine at once, and they are not independent.

Neither is wrong to do. Confusing one for the other is.