How DeFi Works and Where It Breaks

Code instead of an intermediary

DeFi, short for decentralised finance, refers to services where programs running on a blockchain handle trading and lending instead of a bank or exchange. These programs are called smart contracts and run automatically, without anyone's permission, once their conditions are met. Instead of signing up, users connect their own wallet. Transactions are public, which is a plus, but once executed they cannot be reversed, and when something goes wrong there is often no clear party to hold responsible.

Decentralised exchanges and liquidity pools

A centralised exchange matches buyers and sellers in an order book. Many decentralised exchanges instead use a liquidity pool holding two tokens. The best-known design keeps the product of the two token quantities constant: when someone puts one token in and takes the other out, the ratio in the pool shifts and that sets the price. A trade that is large relative to the pool moves the ratio a lot, increasing slippage, the gap between the price you saw and the price you got.

Providing liquidity and impermanent loss

People who deposit tokens into a pool share the trading fees it earns. But if the price ratio of the two tokens moves away from where it was when they deposited, their position can end up worth less than if they had simply held both tokens in a wallet. This is called impermanent loss. It shrinks if the ratio returns, but becomes real if they withdraw while the ratio has shifted. The yield shown on screen often leaves this loss out.

Lending and automatic liquidation

DeFi lending runs on collateral instead of credit checks. Borrowers usually deposit coins worth more than the loan, and if the collateral's value falls below a set threshold, anyone can buy it at a discount, so the position is liquidated automatically. Liquidation often carries a penalty-like charge. In a sharp sell-off, liquidated collateral floods the market, pushing prices lower and triggering further liquidations in a chain.

Reading the yield numbers

DeFi services often display yields far above bank rates. The first question is where that money comes from. Part of it may come from real use, such as trading fees or loan interest, and part from reward tokens the service mints and hands out. If the reward token's price falls, the displayed yield can be far from what you actually earn. A simple annual rate and a yield that assumes compounding also give different numbers for the same terms.

• Trading fees and loan interest: from real use
• Reward tokens: earnings shrink if their price falls
• Simple annual rate versus compounded annual yield
• Losses and costs missing from the displayed yield

The usual ways money is lost

Losses in DeFi have followed a few recurring patterns. Attacks exploit bugs in smart contract code, manipulate the oracles that bring outside price data on-chain so collateral looks more valuable than it is, or hack the bridges that move assets between blockchains. Sometimes operators use admin privileges to drain funds, and many people lose money by connecting their wallet to a fake site imitating a real service.

• Bugs in smart contract code
• Price feed manipulation
• Cross-chain bridge hacks
• Operators draining funds
• Fake sites and phishing

Wallet approvals and signatures

Using DeFi involves approving a service to move your tokens from your wallet. If you grant an unlimited approval, all of that token in your wallet is at risk if the service or that address is later compromised. Read signature prompts to the end when they show what you are allowing, revoke approvals you no longer use, and keep larger holdings in a separate wallet from the one you use for DeFi. For wallet security in general, see the article on how people actually lose crypto from wallets.

What to check before using a service

A note that a service has passed an external security audit means known kinds of flaws were checked, not that it is safe. Also look at how long it has been running, who holds admin privileges and how, and what network fees each transaction costs. DeFi deposits are not covered by deposit insurance, and tax and regulation differ by country and change over time, so check official guidance. This article explains structure only and is not investment advice.

• Whether it was audited, and the limits of audits
• How long it has run and who holds admin rights
• Network fees
• No deposit insurance
• Tax and regulation from official sources