DeFi Due Diligence: A Practical Protocol Risk Checklist

Start with a map of the position

Write down the network, application URL, asset contract and contract receiving your deposit. Then identify what you receive in exchange: a token balance, a vault share, a liquidity-provider position or a claim against a borrower. These are different exposures even when the interface presents each as a savings balance.

A useful example is supplying USDC to a vault that allocates funds to several lending markets. You are researching more than USDC. You also need to understand the vault’s allocation rules, collateral accepted in each market, the price oracles and how withdrawals are fulfilled. Adding a bridge or a yield-bearing collateral token adds another dependency.

Use an evidence table, not a single safety score

A single score hides disagreement about what matters. Record each risk, the evidence supporting your understanding and the date you checked it. Mark a gap as unknown instead of converting missing evidence into a reassuring average.

Read an audit as a scoped document

Find the report linked by the project or auditor. Identify its date, repository, commit or version, scope, exclusions and remediation status. A report for an older deployment may be useful background but does not automatically cover a new module, a different chain or an upgraded implementation.

Look for findings that were acknowledged rather than fixed and for assumptions made about administrators, users or external systems. Those assumptions define the conditions under which the review is meaningful. Do not infer that a branded audit badge guarantees the absence of vulnerabilities.

Operational evidence matters too. Locate a responsible disclosure route, the project’s incident history and any published post-mortems. Ask whether there is a clear process for communicating an incident. The incident log provides case studies; it is not a complete record of every DeFi failure.

Check oracle and liquidation mechanics

A lending protocol normally depends on collateral valuation and rules for reducing unhealthy debt. A market price, an oracle price and a redemption value can differ. Identify which one the contract uses, how often it updates and what happens if its input is disrupted.

For a simplified single-collateral lending position, health factor is collateral value multiplied by its liquidation threshold, divided by debt value. Debt growth and collateral-price changes can reduce that margin. Multiple collateral types, correlated assets, depegs and protocol-specific rules make the real calculation more involved. Use the risk calculator to explore the arithmetic, then check the actual protocol.

Separate token risk from protocol risk

A stablecoin may target a fixed value while still exposing its holder to issuer, reserve, redemption and market-liquidity risks. A token can also represent a bridged claim or a yield-bearing position. Verify the asset’s contract and redemption mechanics before comparing its rate with another dollar-labelled asset.

For liquidity provision, account for changing inventory and impermanent loss. For staking derivatives, examine redemption conditions and dependencies on the underlying staking system. A strategy that combines lending, staking and derivatives inherits more than one set of failure conditions.

Inspect permissions before and after interacting

Read the wallet request. Distinguish connecting an account, signing a message and authorizing token spending. For an approval, identify the spender, asset and allowance. Avoid assuming that the amount shown by an application describes every permission requested by the transaction.

Recovery planning should be independent of yield research. Understand how access is restored and what happens if a device or authentication method is lost. Never place a recovery phrase in a support conversation or a research form. Ethereum’s security guidance is a useful starting point for wallet practices.

Model the exit before the entry

Write out how you would unwind the position. Include withdrawals, cooldowns, queues, bridge transfers, swaps, slippage and transaction fees. Test the economics for the amount and holding period you actually intend to research; a high annualized rate may not cover a short holding period’s fixed costs.

Consider a stressed scenario in which asset prices move, borrow rates rise and withdrawal liquidity falls together. A strategy can look profitable under constant inputs while becoming difficult to exit under stress. The APR, APY and net-yield guide shows a transparent way to compare assumptions.

Make a research decision with explicit unknowns

Conclude the review with three lists: verified mechanics, unresolved questions and conditions that would change the assessment. If you cannot explain where the yield comes from or how to withdraw, further investigation is more useful than a higher headline return.

This checklist is a documentation-review method. It is not a smart-contract audit, a personal suitability assessment or a certification that a protocol is safe. Keep dated notes and revisit them when contracts, collateral or the strategy change.

Sources and further reading

Ethereum: DeFi overview · Ethereum: security and scam prevention · Aave: health factor and liquidation documentation. Examples and the evidence table are educational analysis; they are not a report of a live funded test.