After 40 posts, you now know how DeFi works, how it can fail, and how attackers exploit it. You’ve seen protocols get drained through oracle manipulation, watched governance get captured, and learned why a seed phrase written on a sticky note is a liability. Now it’s time to distill everything into one practical DeFi security checklist — 15 checks you can run in about 30 minutes before depositing anything into a new protocol.
This is the capstone of the Safe DeFi: Your First 90 Days series. Keep it bookmarked. Use it every time something new looks interesting.
Why a Checklist Changes Everything
DeFi due diligence isn’t optional — it’s what separates informed participation from gambling. No checklist eliminates risk entirely. DeFi is still experimental, protocols still get hacked, and even careful users sometimes lose money. But a systematic process filters out the most obvious and avoidable failures.
Here’s the hidden value: checklists counter enthusiasm bias. When a protocol is trending and yields are sky-high, the instinct is to move fast. That instinct has cost people billions. A checklist slows you down in exactly the right way.
Category 1: Protocol Credibility (Checks 1–4)
Check 1: Audit History
Has the protocol been audited? By whom? How recently?
Look for multiple audits from reputable firms — Trail of Bits, OpenZeppelin, Sherlock, Certora, and Code4rena are well-regarded names. A single audit from a firm you’ve never heard of isn’t much protection. Neither are audits that are two or more years old if the codebase has changed significantly since.
Find audits on the protocol’s documentation site, their GitHub repository, or DeFiLlama’s protocol page. If you can’t find audit documentation in five minutes of searching, that tells you something. (For a deeper look at how to read a DeFi audit, see Post 49: How to Read a DeFi Protocol Audit.)
Check 2: Track Record
How long has the protocol been live? Has it ever been exploited? One year of operation without a major incident is meaningful. A protocol that survived a bear market and high-volume stress periods has been tested in real conditions. Check exploit history on Rekt News (rekt.news) and DeFiLlama’s hacks tracker — both are free and comprehensive.
A prior exploit isn’t automatically disqualifying if the team responded well, compensated users, and fixed the underlying vulnerability. How a team handles a crisis tells you more about their character than a clean history that was never tested.
Check 3: Team and Transparency
Is the team public (doxxed) or anonymous? Anonymous teams aren’t automatically bad — some of the most respected protocols in DeFi were built by pseudonymous developers. But anonymous teams reduce accountability. If something goes wrong, there’s no legal or reputational recourse.
More important than doxxed identities: is the codebase open-source and on GitHub? Closed-source DeFi is a hard red flag. Is there an active governance forum with substantive discussion, not just promotional announcements?
Check 4: TVL and Liquidity
Total Value Locked (TVL) is the amount of money deposited in a protocol. Higher TVL means more people have trusted the protocol with real money — but it also means it’s a larger target for attackers.
What you want to see: stable or growing TVL over time. Declining TVL can signal users losing confidence. Check TVL data on DeFiLlama. It’s the most reliable source and it’s free.
Category 2: Smart Contract Risk (Checks 5–8)
Check 5: Oracle Design
Price oracles tell a DeFi protocol what assets are worth. If an attacker can manipulate what a protocol thinks an asset is worth, they can drain it.
Safe oracle designs: Chainlink (a decentralized oracle network) or TWAP (time-weighted average price), which averages prices over time to resist manipulation. Risky design: a single DEX spot price, especially for tokens with thin trading volume. How to check: look in the protocol’s documentation or ask in their Discord.
Check 6: Upgrade Mechanism
Can the protocol’s smart contracts be upgraded? By whom? With what delay? A 48-hour or longer timelock on upgrades is meaningful protection — it gives users time to withdraw before a malicious or compromised upgrade takes effect. No timelock means the team can change the protocol instantly, requiring you to extend a high level of trust to whoever controls the upgrade keys.
Check 7: Admin Key Controls
Who holds the admin keys that control the protocol? Is it a multi-signature wallet (multi-sig)? How many signatures are required? Best practice is something like a 4-of-7 multi-sig with publicly known signers — that means four out of seven known individuals must agree before any critical action. A single admin key held by one anonymous person is the worst-case scenario.
Check 8: Bug Bounty Program
Does the protocol offer a bug bounty? How large is the maximum payout for critical vulnerabilities? A meaningful bug bounty — $1 million or more for critical bugs — signals that the team has invested in proactive security. It also incentivizes independent security researchers to look for problems before attackers do. Most DeFi bug bounties are listed on Immunefi.
Category 3: Economic Risk (Checks 9–11)
Check 9: Where Does the Yield Come From?
This is the most important question in safe DeFi investing. Is the yield coming from real protocol revenue — trading fees, lending interest — or is it printed from new token emissions?
Sustainable yield comes from economic activity. Unsustainable yield relies on inflation or new depositor capital to pay existing depositors. The second type is structurally fragile. When new deposits slow down, yields collapse and early depositors exit, leaving late arrivals holding a collapsing token. For the full framework, see Post 55: Real Yield vs. Printed Yield.
Check 10: Collateral Quality
For lending protocols, what assets can be used as collateral? Liquid, established assets — ETH, BTC, USDC — are far less risky than thin, volatile tokens. When collateral assets crash in price, protocols need to liquidate borrowers to stay solvent. If those collateral assets are illiquid, liquidations fail and the protocol accumulates bad debt.
Check 11: Concentration Risk
Are the protocol’s assets concentrated in a small number of large depositors? Is there a single token making up most of the collateral base? Concentrated positions create single-point-of-failure scenarios. If one whale withdraws or one collateral token collapses, the impact is outsized. Check governance forums and documentation — concentration risks often surface there.
Category 4: Your Own Security (Checks 12–15)
Check 12: Verify the URL
Before connecting your wallet, type the URL directly or use a saved bookmark — never click a link from a tweet, DM, or search result. Phishing sites that mimic popular DeFi protocols are everywhere. Confirm the URL matches what’s listed on the protocol’s official Twitter/X account, CoinGecko, or DeFiLlama.
Check 13: Read the Transaction Before Signing
Before you click confirm, read what you’re actually signing: token approvals, transaction amounts, contract addresses. Most wallet interfaces show you this information. Pay particular attention to token approvals. “Unlimited” approval means the protocol can access your entire token balance at any point in the future. Consider setting a specific dollar limit instead. If you’re using a hardware wallet, verify the transaction details on the device screen — not just your computer.
Check 14: Start Small
Your first interaction with any new protocol: use a small amount you could afford to lose entirely. Verify that deposits work. Verify that withdrawals work. Confirm the experience matches what the documentation says. Only scale up after you’ve confirmed the mechanics work as expected in real conditions. This is the single most underused piece of advice in DeFi.
Check 15: Revoke Unused Approvals
After you’re done with a protocol, remove the token approvals you granted. Use revoke.cash — it’s free, shows you every active approval, and lets you revoke them in one click. Lingering approvals from protocols you used once, two years ago, are an ongoing attack surface. A protocol you approved tokens for can be exploited later — and your approval is still valid. Clean this up periodically. (See Post 50: How to Revoke Token Approvals for step-by-step instructions.)
Scale Your DeFi Due Diligence: The 80/20 Rule
You don’t need to run all 15 checks on every small transaction. Here’s how to calibrate your effort:
- Large, new positions: Run all 15 checks.
- Protocols you’ve used reliably for years: Focus on Checks 1–3 and 12–15.
- Small experimental amounts: At minimum, run Check 1 (audit), Check 12 (URL), and Check 14 (start small).
The goal isn’t perfect information — it’s filtering out the most obvious risks before you commit real money.
Where We’ve Been — And What You’re Ready For
This DeFi security checklist is the capstone of a 41-post series that started with the basics of how blockchains work and ran through wallet security, self-custody, DeFi mechanics, historical hacks, oracle design, governance risks, and advanced DeFi concepts. (See Post 47: DeFi Security Overview for the foundational framework this checklist builds on.)
The goal was never to scare you away from DeFi. It was to give you the knowledge to participate with open eyes. The protocols that have survived years of operation, millions in security investment, and multiple bear markets are safer than ever. The risks are real, but they’re manageable with knowledge and process.
DeFi offers genuine utility: access to financial services without intermediaries, real yields from real economic activity, and participation in protocols that genuinely work. The people who use it safely are the ones who ask questions before depositing — not after.
Your Next Step
Bookmark this checklist. The next time you encounter a new DeFi protocol with attractive yields, run through these 15 checks before depositing. The 30 minutes it takes is the cheapest insurance you will ever buy.
Subscribe to Crypto Clarified — our free weekly newsletter on staying safe in crypto.