Smart contracts are trustless code — but code can have bugs. Before depositing funds into any DeFi protocol, evaluate these factors.
What Can Go Wrong
| Risk | Example | Damage |
|---|---|---|
| Reentrancy attack | The DAO hack (2016) | $60M |
| Flash loan attack | Multiple DeFi hacks | $10-100M |
| Logic bug | Incorrect calculation | Funds stuck or stolen |
| Backdoor | Admin can drain funds | Total loss |
| Oracle manipulation | Price feed manipulated | Liquidation |
| Rug pull | Developers remove liquidity | Total loss |
Audit Checklist
1. Who Audited?
| Auditor | Reputation |
|---|---|
| Trail of Bits | Top tier |
| OpenZeppelin | Top tier |
| Certik | Good (but not perfect) |
| Hacken | Good |
| SlowMist | Good |
| No audit | Red flag — don’t use |
One audit is good. Multiple audits from different firms is better.
2. Check the Audit Report
| What to Look For | What It Means |
|---|---|
| Critical issues: 0 | Minimum requirement |
| Major issues: 0 | Should be fixed |
| Minor/info issues: Some | Acceptable |
| All issues resolved: Yes | Good sign |
| Issues NOT resolved | Understand why — may be acceptable |
3. When Was the Audit?
| Audit Date | Meaning |
|---|---|
| Within last 6 months | Recently reviewed |
| 6-12 months ago | Code may have changed |
| Over 12 months ago | Needs re-audit after updates |
Time Lock
A time lock delays contract changes, giving users time to withdraw.
| Time Lock Duration | Safety Level |
|---|---|
| 48+ hours | Strong — users can exit |
| 24-48 hours | Moderate |
| 0-24 hours | Weak |
| No time lock | Very risky |
Admin Keys
The development team may have special admin powers.
| Admin Power | Risk |
|---|---|
| Can pause contract | Low (protection) |
| Can upgrade contract | Medium |
| Can withdraw all funds | High — possible rug pull |
| Can mint unlimited tokens | High — unlimited dilution |
| No admin keys | Decentralised |
Liquidity Lock
| Liquidity Lock | Meaning |
|---|---|
| Locked for 1+ years | Team can’t rug pull |
| Locked for 3-6 months | Moderate safety |
| No lock | Team can remove liquidity anytime (rug risk) |
Check on Unicrypt or Team Finance if LP tokens are locked.
TVL (Total Value Locked)
| TVL | Meaning |
|---|---|
| $100M+ | Established protocol, lower risk per dollar |
| $10-100M | Mid-sized, reasonable |
| $1-10M | Small, higher risk |
| Under $1M | Very high risk |
DeFi Safety Score
Use DeFi Safety (defisafety.com) to check protocols:
| Score | Meaning |
|---|---|
| 900-1000 | Excellent |
| 700-900 | Good |
| 500-700 | Moderate |
| Under 500 | Poor |
Your Personal Risk Assessment
| Factor | Safe | Caution | Avoid |
|---|---|---|---|
| Audits | 2+ reputable | 1 recent | None or old |
| Time lock | 48h+ | 24h | None |
| Admin keys | Timelocked | Single multisig | EOA |
| Liquidity lock | 1 year+ | 3 months | No lock |
| TVL | $50M+ | $5-50M | Under $1M |
| Code verified | Etherscan verified | Partial | Unverified |
Bottom Line
Never deposit into a protocol without checking: audits (and reading the report), time locks, admin key controls, and liquidity locks. If a protocol fails on any major safety check, skip it. There are enough audited, time-locked, established DeFi protocols that you don’t need to take unnecessary risks.
What matters most
Treat a deposit into any DeFi protocol as a considered risk, not a default action. The three most reliable signals are an audit you have actually read, a time lock long enough that you can leave before an unwanted change, and admin powers that cannot drain the pool. Start with the audit: who performed it — Trail of Bits, OpenZeppelin, Certik, Hacken, and SlowMist are commonly seen — and whether all critical and major issues were resolved. One audit is good; multiple from different firms is better, and a report older than twelve months means the code may have changed since it was reviewed. Then check the time lock: 48 hours or more is strong, while none at all is very risky, because it removes your chance to exit before a harmful change. Finally, examine admin keys and their ownership — a timelocked multisig that can pause the contract is a protection, while powers to withdraw all funds or mint unlimited tokens are a structural risk.
No single check is enough, and there is no way to guarantee a protocol is safe. Even an audited, time-locked, high-TVL project can fail. But layering the checks makes the decision more rational: you want a project that has been reviewed recently, gives you time to react, and cannot be abused by its own operators. Every protocol is ultimately a bet on its own code and governance, so the goal is to only place bets where the structure gives you a reasonable chance of exiting before catastrophe.
A practical evaluation workflow
You can screen a protocol in a few minutes with a repeatable checklist. First, confirm the audit exists and read the summary section: note the firm, the date, whether the code under review matches what is deployed, and whether critical and major findings are marked resolved. Second, check the contract on a block explorer to confirm it is verified and matches the audited source. Third, look at the time lock duration and the admin key type — an externally owned account with sweeping powers is a much larger risk than a timelocked multisig. Fourth, verify liquidity is locked on a service like Unicrypt or Team Finance; a meaningful lock reduces the rug-pull risk. Fifth, note the total value locked to gauge maturity. Finally, consult an independent risk score from a source such as DeFi Safety to cross-check your own read. If any major check fails — no recent audit, no time lock, no liquidity lock, or an unchecked withdrawal power — move on. There are enough audited, time-locked, established protocols that you never need to take a structural gamble.
What to avoid
The costly mistakes are almost always about skipping a check or dismissing a red flag. Depositing into an unaudited protocol on the strength of a promise or a meme is how many users lose everything. Trusting an “audit” that is not from a recognisable firm, or shrugging off unresolved critical issues, mistakes marketing for diligence. Ignoring the time lock means accepting a contract that can change underneath you without warning. Overlooking admin-key power — especially the ability to withdraw all funds or mint unlimited tokens — leaves the door open to an effective rug pull. Treating a high TVL as a free pass misses that even large protocols have failed. And skipping the liquidity lock check means the team can quietly remove the pool at any time. Every one of these is avoidable with the checklist above, and each skipped step shifts a survivable risk into a potential total loss.
Building habits that last
Make protocol screening a standing part of how you use DeFi rather than a one-time exercise. Revisit a position whenever the contract is upgraded, because a re-audit after a change is what tells you the new code is safe. Set a recurring reminder to check that time locks and liquidity locks still hold, and that the protocol’s TVL and risk profile have not drifted. Diversify across a few audited, time-locked protocols instead of concentrating everything in one, so a single failure is a setback rather than a wipeout. Keep the amounts you put into DeFi proportional to what you can afford to lose, and treat any yield that seems too generous as a signal to look harder at the risk. Approached this way, evaluating smart-contract risk becomes an automatic part of every deposit, keeping your exposure rational through cycles of hype and fear. For the broader safety picture, the guides on building a strong security plan and on choosing a trustworthy wallet cover the foundations this risk screen builds on.