If you’re wondering how to check if a DeFi protocol is safe before depositing, the honest answer is that no protocol is risk-free, but you can measure how much risk you’re taking in about 20 minutes. Run ten checks: audits, verified code, bug bounty, upgradeability, admin keys, timelock, oracles, yield source, track record and front-end safety. Each has a place to look and a red flag to watch for. At the end, a scorecard table turns your answers into green, amber or red, so you can size your deposit or walk away.
Key takeaways
- An audit is a dated review of specific code, not a guarantee. Check who audited, which version, and whether findings were fixed.
- Who can change the contracts matters as much as the code: look at proxies, multisig thresholds and timelocks.
- Oracle design is a frequent point of failure; spot DEX prices are the classic weakness.
- Major 2025–26 losses came from a rounding bug in long-audited code, a re-entrancy flaw and a hijacked admin multisig.
- Even a green scorecard calls for position sizing, a separate wallet and revoking approvals afterwards.
Why ‘audited’ isn’t the same as safe
Most protocol websites display an “audited by” badge. It tells you less than it seems. An audit is a time-boxed review of a particular code version by a particular firm. Code changes after the audit aren’t covered. Integrations with other protocols are often out of scope. And auditors miss things.
The clearest recent example is Balancer. Its v2 contracts had been reviewed repeatedly and had run for years. On 3 November 2025, an attacker exploited a rounding inconsistency in v2 Composable Stable Pools, chaining many tiny swaps inside one batch transaction, and losses across several chains were reported at around $128 million. The protocol has since voted to wind down. Longevity and audits reduced risk; they didn’t remove it.
Protocol-level checks are also different from token checks. If you’re judging whether a new token is a scam, our guide to rug pulls covers liquidity locks and holder concentration. This page is about the protocol you deposit into.
How to check if a DeFi protocol is safe: checks 1–3 on code, audits and bug bounties
Check 1: read the audit, not the badge
Where to look: the protocol’s docs or GitHub, usually under “Security” or “Audits”.
Open each report and note three things: the date, the commit or version reviewed, and the findings table. Critical or high findings marked “acknowledged” rather than “resolved” mean the team chose not to fix them. Multiple audits by different firms are better than one. Red flag: no reports, a report for an older version only, or an “audit” from a firm with no public track record.
Check 2: is the deployed code verified?
Where to look: the protocol’s list of contract addresses in its docs, then each address on the chain’s block explorer.
A verified contract shows its source code on the explorer. Compare its name and version with the audited repository. Red flag: unverified contracts holding user funds, or addresses that the docs don’t list at all.
Check 3: is there a meaningful bug bounty?
Where to look: bug bounty platforms such as Immunefi and Cantina, or the protocol’s security page.
A bounty gives white-hat hackers a legal, paid route to report bugs instead of exploiting them. Compare the maximum payout with the TVL: a $50,000 cap on a protocol holding $500 million gives an attacker little reason to report. Red flag: no bounty, or a tiny one relative to the funds at stake.
Checks 4–6: who can change the protocol
Admin powers are where many losses now come from. Look at who holds them and how quickly they can act.
Check 4: upgradeable contracts
Where to look: on the explorer, a contract that is a proxy usually shows “Read as Proxy” and “Write as Proxy” tabs, pointing to an implementation contract. An upgradeable proxy means the logic behind your deposit can be replaced. That’s not automatically bad, because it lets teams fix bugs, but everything then depends on who controls upgrades. Red flag: upgradeable contracts controlled by a single address.
Check 5: admin keys and multisig
Where to look: the owner or admin address on the contract’s “Read” tab. If it’s a Safe multisig, the Safe interface shows the signers and threshold (for example, 4 of 7).
A higher threshold and named, independent signers are better than an anonymous 2-of-3. But multisigs can still fail. On 1 April 2026, Solana perpetuals exchange Drift lost an estimated $280–286 million after attackers took over its Security Council powers. Drift said no smart-contract bug was involved: the attackers obtained approvals from enough signers using pre-signed transactions. Investigators linked the attack to North Korean groups. Red flag: a single externally owned admin account, a low threshold, or signers who all belong to one company.
Check 6: timelock and pause powers
Where to look: the docs’ governance section and the admin address. If the admin is a timelock contract, it shows a minimum delay.
A timelock forces changes to wait (often 24 hours to several days) before execution, giving users time to withdraw if they dislike an upgrade. Separate “guardian” or “pause” roles can freeze the protocol in an emergency; check whether they can only pause or can also move funds. For protocols on rollups, the chain’s own admin powers matter too: L2BEAT rates rollups in stages, from Stage 0 (operators retain broad control) to Stage 2 (control largely enforced by code), and notes that stages measure decentralisation, not security. Red flag: instant upgrades with no timelock.
Checks 7–8: oracles and where the yield comes from
Check 7: the oracle design
Where to look: the docs’ “oracles” or “risk parameters” page.
Lending markets, perps exchanges and vaults need prices. Established oracle networks such as Chainlink, Pyth and RedStone aggregate prices from many sources. A protocol that reads the spot price from a single DEX pool, or values its own shares from another pool’s live balances, can be manipulated with borrowed capital in one transaction. In January 2026, Makina Finance lost roughly $4–5 million after an attacker used flash-loaned USDC to distort Curve pool data that Makina used to value its assets. If you’re setting up a specialised yield strategy that depends on oracles, this is the check that matters most. Red flag: spot DEX prices, thin-liquidity markets as price sources, or no documentation at all.
Check 8: where the yield comes from
Where to look: the docs, plus DefiLlama’s fees and yields data.
Real yield is paid by someone: borrowers, traders or a network’s stakers. If most of the APY is the protocol’s own token emissions, it depends on that token’s price and lasts only as long as emissions continue. Also check exit liquidity: can you withdraw instantly, or is there a queue, lock-up or thin market for the receipt token? And map the stack. A vault that deposits a liquid restaking token, which is built on a restaking protocol, which is built on liquid staking, carries every layer’s risk at once. Our yield farming guide has more questions to ask before each deposit. Red flag: a yield nobody can explain, or one that is almost entirely emissions.
Checks 9–10: track record and front-end safety
Check 9: time live and incident history
Where to look: DefiLlama’s protocol page (TVL history) and its Hacks database, plus incident write-ups and post-mortems from the team.
Months of operation with meaningful TVL is evidence, not proof. Read past incidents carefully: how the team responded matters. On 9 July 2025, GMX’s V1 contracts were exploited for about $42 million through a re-entrancy flaw; most funds were returned after a bounty offer, and GMX said V2 was unaffected. Also check whether the protocol forked code from a project that was later exploited. Red flag: repeated exploits, hidden post-mortems, or a brand-new fork of exploited code.
Check 10: the website itself
Where to look: your browser’s address bar.
The contracts can be fine while the website is compromised. In August 2022, Curve’s front end was redirected through a DNS hijack to a malicious copy. In July 2024, Compound’s site and many others registered through the same domain registrar, Squarespace, were redirected to wallet-draining pages; Compound said its contracts were unaffected. Bookmark the official domain, never use links from ads or direct messages, and read what your wallet asks you to sign. Red flag: an unexpected request to approve an unrelated token, or to sign a “permit” message you didn’t initiate.
The DeFi safety scorecard
Score each check. Two or more reds is a strong reason to stay out; several ambers means a smaller position.
| # | Check | Green | Amber | Red |
|---|---|---|---|---|
| 1 | Audits | Several recent audits of the deployed version, findings resolved | One audit or slightly outdated scope | None, or only for old code |
| 2 | Verified code | All fund-holding contracts verified and listed | Some auxiliary contracts unverified | Core contracts unverified |
| 3 | Bug bounty | Large and proportional to TVL | Small | None |
| 4 | Upgradeability | Immutable, or upgrades gated by multisig plus timelock | Upgradeable by multisig | Upgradeable by one key |
| 5 | Admin keys | High threshold, independent named signers | Moderate threshold, team-only signers | Single key or 2-of-3 anonymous |
| 6 | Timelock | Delay of a day or more, pause-only guardian | Short delay | No timelock |
| 7 | Oracles | Established oracle network with fallbacks | Time-weighted DEX price on deep pools | Spot price from a single pool |
| 8 | Yield source | Mostly fees or interest, instant exit | Mixed fees and emissions | Mostly emissions or unexplained |
| 9 | Track record | Long history, transparent incident handling | Under a year live | New fork or repeated exploits |
| 10 | Front end | Bookmarked domain, clear signing prompts | New domain or frequent UI changes | Reached via ad or DM link |
If you deposit anyway: limit the damage
The checks reduce the odds of loss; these steps reduce its size:
- Size the position. Decide in advance the most you’d accept losing entirely in this protocol, and stay below it.
- Use a separate wallet for experimental protocols, so one bad approval can’t reach your main holdings.
- Cap approvals. When your wallet asks to approve a token, edit the spending cap to the amount you’re depositing instead of an unlimited allowance.
- Revoke when you leave. Old approvals stay live after you withdraw. Our guide on how to revoke token approvals shows how.
- Consider cover. Some on-chain cover products pay out for specific smart-contract failures, with exclusions. See our overview of DeFi insurance.
- Watch for news. Follow the protocol’s official account so you hear about pauses or exploits quickly.
For the rest of our DeFi research and risk guides, see the DeFi hub.
FAQ
Is DeFi safe to use?
DeFi can be used carefully, but it is never risk-free. Smart-contract bugs, compromised admin keys, oracle manipulation, depegs and phishing sites have all caused large losses, including in long-running protocols. Running structured checks, keeping positions small relative to your savings, using separate wallets and revoking approvals reduces the risk without eliminating it.
Should I use an unaudited DeFi protocol on a new launch?
An unaudited protocol on a new launch, on any chain, is the highest-risk category. With zero audits, nobody independent has reviewed the code, and new deployments haven’t been tested by time or by attackers. If you take part at all, use only an amount you can afford to lose completely, a fresh wallet and tightly capped approvals.
How do I check a smart contract audit?
Open the full report, not just the badge. Confirm the auditor’s identity, the date and the exact commit or version reviewed, then compare it with the deployed contract on a block explorer. Read the findings table and check that critical and high issues are marked resolved. Several audits by different firms are stronger evidence than one.
What are the signs of a DeFi rug pull at protocol level?
Warning signs include admin keys held by a single anonymous address, upgradeable contracts with no timelock, unverified code, yields paid almost entirely in the team’s own token, and a website reached through promotions. Sudden changes to contract ownership or withdrawal rules are urgent signals. If you report a scam, use official channels such as the FBI’s IC3 in the United States.
Crypto is volatile and risky; this is education, not financial advice. Do your own research.
