Smart contracts are trustless code — but code can have bugs. Before depositing funds into any DeFi protocol, evaluate these factors.
What Can Go Wrong
| Risk | Example | Damage |
|---|
| Reentrancy attack | The DAO hack (2016) | $60M |
| Flash loan attack | Multiple DeFi hacks | $10-100M |
| Logic bug | Incorrect calculation | Funds stuck or stolen |
| Backdoor | Admin can drain funds | Total loss |
| Oracle manipulation | Price feed manipulated | Liquidation |
| Rug pull | Developers remove liquidity | Total loss |
Audit Checklist
1. Who Audited?
| Auditor | Reputation |
|---|
| Trail of Bits | Top tier |
| OpenZeppelin | Top tier |
| Certik | Good (but not perfect) |
| Hacken | Good |
| SlowMist | Good |
| No audit | Red flag — don’t use |
One audit is good. Multiple audits from different firms is better.
2. Check the Audit Report
| What to Look For | What It Means |
|---|
| Critical issues: 0 | Minimum requirement |
| Major issues: 0 | Should be fixed |
| Minor/info issues: Some | Acceptable |
| All issues resolved: Yes | Good sign |
| Issues NOT resolved | Understand why — may be acceptable |
3. When Was the Audit?
| Audit Date | Meaning |
|---|
| Within last 6 months | Recently reviewed |
| 6-12 months ago | Code may have changed |
| Over 12 months ago | Needs re-audit after updates |
Time Lock
A time lock delays contract changes, giving users time to withdraw.
| Time Lock Duration | Safety Level |
|---|
| 48+ hours | Strong — users can exit |
| 24-48 hours | Moderate |
| 0-24 hours | Weak |
| No time lock | Very risky |
Admin Keys
The development team may have special admin powers.
| Admin Power | Risk |
|---|
| Can pause contract | Low (protection) |
| Can upgrade contract | Medium |
| Can withdraw all funds | High — possible rug pull |
| Can mint unlimited tokens | High — unlimited dilution |
| No admin keys | Decentralised |
Liquidity Lock
| Liquidity Lock | Meaning |
|---|
| Locked for 1+ years | Team can’t rug pull |
| Locked for 3-6 months | Moderate safety |
| No lock | Team can remove liquidity anytime (rug risk) |
Check on Unicrypt or Team Finance if LP tokens are locked.
TVL (Total Value Locked)
| TVL | Meaning |
|---|
| $100M+ | Established protocol, lower risk per dollar |
| $10-100M | Mid-sized, reasonable |
| $1-10M | Small, higher risk |
| Under $1M | Very high risk |
DeFi Safety Score
Use DeFi Safety (defisafety.com) to check protocols:
| Score | Meaning |
|---|
| 900-1000 | Excellent |
| 700-900 | Good |
| 500-700 | Moderate |
| Under 500 | Poor |
Your Personal Risk Assessment
| Factor | Safe | Caution | Avoid |
|---|
| Audits | 2+ reputable | 1 recent | None or old |
| Time lock | 48h+ | 24h | None |
| Admin keys | Timelocked | Single multisig | EOA |
| Liquidity lock | 1 year+ | 3 months | No lock |
| TVL | $50M+ | $5-50M | Under $1M |
| Code verified | Etherscan verified | Partial | Unverified |
Bottom Line
Never deposit into a protocol without checking: audits (and reading the report), time locks, admin key controls, and liquidity locks. If a protocol fails on any major safety check, skip it. There are enough audited, time-locked, established DeFi protocols that you don’t need to take unnecessary risks.
This content is for educational purposes only. Not financial advice. Do your own research before investing.