The collapse of FTX proved the importance of self-custody and risk management.

But it’s so easy to lose money in DeFi if you are not careful with many exploits, rug pulls, contract bugs around.

In this blog I’d like to share how to evaluate safety of DeFi protocols to protect your assets.

It’s great if you’re an experienced smart contract developer and can verify the code yourself. But most of us aren’t.

It leaves us with no other choice, but to evaluate projects based on other data, that involves some degree of trust.

Total Value Lock, ultimate proof of security?

It’s no secret that the majority evaluate DeFi projects by how much value is deposited to the smart contracts. So, TVL is the ultimate proof of trust.

The higher the Total Value Locked, the higher the implied security of a protocol. If a lot of money is deposited, it means ‘someone’ did due diligence, and that protocol is secure.

Unfortunately, it gives a false sense of security. And high TVL protocols are actively targeted by hackers. At the same time, low TVL doesn’t mean a protocol is not secure.

Take a look at the top DeFi protocols by TVL.

There might be biases in you based on what you read online.

Trust, but verify?

‘Don’t trust, verify’ is the reason we have smart contract audits.

If that wasn’t the case, we might not need audits, because code is open source and community could find all the issues in the code. Yet the community might not have the right motivation, incentives or expertise to verify code.

Auditors are supposed to have the right technical expertise, but at the end of the day, we also have to trust them to do the right job.

Remember Twitter backlash against Certik because a few of their audited protocols ended up hacked?

Audit companies are building their reputation too. If the protocols they audit (and evaluated as safe) are exploited, then it shows lack of expertise. In fact, Certik has audited 3,422 projects, so no wonder some of them got hacked or had a bug.

Just having an audit doesn’t mean the protocol is safe. I’ve seen projects proudly announcing ‘Completed audit’, but when you read the audit the safety score is actually low.

The lesson is not to trust the announcements blindly, but verify the result by reading the actual audit.

What if you don’t read the audits?

The majority doesn’t read the audits anyway.

Knowing that Certik has a dashboard with all their audited projects. You can check the ‘Trust Score’ with higher number implying safety.

Other auditors like Hacken has a similar dashboard, or you could simply read the audit summary. Check the example, of Trader Joe’s audit done by Paladin.

You can see here that Trader Joe fixed high and medium severity issues, but not all low severity issues has been resolved.

Audit is just a start.

A lot more is needed to evaluate safety:

and much more… It’s a nightmare to verify it all yourself.

I really like what DefiSafety is doing. Its Process Quality Review verifies protocols and gives them a safety score.

According to the PQR results, Liquity Protocol, Synthetix and Angle Protocol are the safest of all verified DeFi protocols.

On DefiSafety you can then check every element and see where the protocol scores the best/worst.

For example, Liquidy still needs Formal Verification.

Additionally, you can start by rating your portfolio safety on Exponential DeFi.

Its ‘Rate my wallet’ feature provides you with a custom risk analysis of your current investments. For example, $4.5M of Tetranode’s assets are deposited into riskier (C rank) protocols.

Elemental DeFi gives a score based on the project evaluation.Assessment takes into account asset risk, code quality and blockchain security to which the assets are deposited.

I like their easy to understand explanation of risks.

For example, take a look at Abracadabra’s MIM. It warns of SPELL being used as collateral which could result in bad debt.

If in doubt, ask!

Finally, I recommend joining the project community groups and ask:

Do they have an insurance fund?

Do they avoid questions?

What are they doing to increase security?

I asked Stargate team if they had an insurance fund in case they get hacked, but it sometimes more difficult to get an answer than I thought, which poses red flags.

But whatever happens, DeFi is still young, so better not to put all your assets into one protocol.

Do you have more useful tips how to evaluate projects and protect your assets?