How to Check a DeFi Protocol Before Depositing
A practical checklist before you deposit in DeFi: track record, audits, admin keys, timelocks, oracles, liquidity, token supply and where the yield comes from.
DeFi due diligence means checking a protocol before you deposit: how long it has run safely, who audited which code, who can change or pause it, how it gets prices, how deep its liquidity is, who holds its token and where yield comes from. No check proves safety, but together they filter out avoidable risks.
Before you start
You need the protocol’s official website, its documentation and a data site such as DefiLlama. Reach the site through a saved bookmark or official documentation, not ads. Plan to deposit only an amount you could afford to lose entirely.
The core checks
Check its track record
Figure: Seven checks before you deposit.
How long has it been live, and has it handled large deposits without incident? A long, clean history is meaningful; a protocol launched last week has none. Check total value locked over time, not just today. See what TVL is.
Read the audits
Find who audited the code, when and which version. Check that critical findings were fixed. Our guide to what a smart contract audit misses explains the limits.
Find out who controls it
Can a small group upgrade contracts, move funds or pause withdrawals? Is there a timelock before changes take effect? If governance runs on token votes, who holds most of the votes? See what a DAO is.
Check the price source
Lending and derivatives protocols depend on price feeds. A single, easily moved price source is a warning sign. See what a blockchain oracle is.
Check liquidity and exit
Can you withdraw at any time, or only when the pool has spare funds? How much would a large withdrawal or sale move the price?
Check the token and the yield
If rewards are paid in the protocol’s own token, look at who holds it and when locked tokens unlock. Then identify where the yield comes from. See where DeFi yield comes from.
Start small and keep records
Test with a small deposit, confirm you can withdraw, and keep your transaction records.
Tools for each check
| Check | Where to look |
|---|---|
| Track record and TVL history | DeFi data sites, the protocol’s own dashboard |
| Audits | The protocol’s documentation, auditors’ published reports |
| Admin powers and timelocks | Documentation, contract pages on a block explorer |
| Price feeds | Documentation, oracle provider dashboards |
| Liquidity and utilization | The app itself, data sites |
| Token holders and unlocks | Block explorer, unlock trackers |
The checks applied to an example
Suppose you are considering a lending protocol that has run for three years, holds a large and fairly steady TVL, publishes audits from two firms covering its current version and pays a modest yield funded by borrower interest. (Illustrative scenario.) Most checks pass. But its documentation shows that a single multisig controlled by the team can upgrade the contracts immediately, with no timelock. That does not make the protocol dangerous by itself, but it means your funds depend on that small group’s security and honesty. A sensible response might be to deposit less than you otherwise would, or to wait until a timelock is introduced.
Mapping who you are trusting
A DeFi deposit rarely depends on one protocol alone. A lending market may rely on an oracle for prices, a bridge for wrapped assets, a stablecoin issuer for the value of its deposits and a multisig for upgrades. Each is a point where something could go wrong. Listing these dependencies, even roughly, shows where your real risks lie. A protocol with clean code can still lose money if the stablecoin it holds loses its peg or the bridge behind a wrapped token is hacked.
Sizing your deposit
Checks reduce risk but never remove it, so how much you deposit matters as much as where. Many experienced users cap the share of their crypto held in any single protocol, spread deposits across several well-established ones and keep larger sums in simpler setups such as self-custody. Putting a small amount into a newer protocol and a larger amount into one with a long record reflects the difference in what is known about each.
After you deposit
Due diligence does not end at the deposit. Follow the protocol’s announcements and governance forum for proposals that change risk, such as new collateral assets or upgrades. Watch for unusual drops in TVL or sudden spikes in utilization. Revisit your position after major market moves or incidents elsewhere in DeFi, since problems often spread between connected protocols.
Keeping your own record
Write down, for each protocol you use, what you checked and when: the audits you read, the admin powers you found, the oracle it uses and the date of your deposit. It takes minutes and pays off later, when a governance proposal, an incident elsewhere or a sudden change in yields prompts you to look again. A short record also makes it easier to compare protocols fairly instead of relying on memory or on whichever one is promoted most.
Red flags
- Anonymous team with no audits and admin control over funds.
- Rewards far above comparable protocols with no clear source.
- No timelock on upgrades, or one person holding the keys.
- Pressure to deposit quickly before a deadline.
What this cannot tell you
Even well-checked protocols can be exploited in ways nobody foresaw. These checks reduce the odds of avoidable losses; they do not guarantee safety. For the basics, read what DeFi is.
This article is educational content and does not constitute financial, investment, legal or tax advice. Digital assets are volatile and you may lose the amount you invest.
Frequently asked questions
How long should these checks take?
A first pass over a well-known protocol can take under half an hour. A newer or more complex protocol, or a large deposit, deserves much longer, including reading audit findings and governance discussions.
Is a protocol safer if a big fund has invested in it?
Not necessarily. Backing from well-known investors shows that someone found the project promising, not that its code is secure or that your deposit is protected.