Most guides on how to check a DeFi protocol would have passed Aave on the morning of 18 April 2026. It held 26.4 billion dollars of deposits on DefiLlama’s count, it had a bug bounty of up to 5 million dollars, and its governance proposals passed through a timelock. At 17:35 UTC that day a forged cross-chain message released 116,500 rsETH, a restaked ether token issued by Kelp, from a bridge contract Aave did not run. The attacker posted 89,567 of those tokens on Aave as collateral and borrowed real ether against them.
By 21 April, the deposits shown by DefiLlama stood at 16.59 billion dollars. More than a third had gone in three days, and the cause lay outside Aave’s own contracts.
So which box was missing? The one most checklists skip: what the protocol depends on. This lesson gives a grid of 15 points, each with what to check, where to find it and the red flag. It then runs the grid on Aave as a worked example. That example shows a method. It is not a verdict on Aave and not a suggestion to use it or to avoid it.
The previous lesson, our DeFi user security routine, dealt with your wallet. This one deals with the contract on the other side of your signature.
Nobody certifies a protocol as reliable, so the checking falls to you
A bank has a supervisor and a deposit guarantee. A DeFi protocol has neither. The three EU supervisory authorities put it bluntly in their joint 2025 warning on crypto-assets: even for services regulated under MiCA, “you will not benefit from compensation schemes”. In the US, the FDIC lists crypto assets among the products it does not insure, even when bought from an insured bank, and SIPC says it does not protect any crypto asset that fails to qualify as a security under its statute. A blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract is not a SIPC-member broker in any case. A paper sent to the SEC’s Crypto Task Force in April 2026 by Vanderbilt emeritus finance professor Craig Lewis, with financial support from Andreessen Horowitz and so not an SEC position, says there is “typically no recourse or insurance backstop” for users after a technical failure.
“Reliable” therefore cannot be a label. A protocol is a bundle of promises: the code does what it says, nobody can change it behind your back, the prices are right, the money has a real source, the things it relies on will hold. Each promise can be checked in a different place, and the map of DeFi risks from earlier in this course shows what breaks when one fails. The grid turns that map into a routine. It lowers your unknowns. It never brings them to zero.
One reminder on exit scams. A rug pull, where insiders empty a project they control, is the failure most beginners fear, and the grid catches most of the set-ups: unverified code, one admin key, no delay, yield paid in a token the team prints. But several of the biggest DeFi losses of 2026 looked different. Drift lost control of its admin powers, Kelp’s bridge trusted a single verifier, and Resolv lost a signing key. The reports cited here describe outside attacks, not exit scams, and users lost money just the same.
How to check a DeFi protocol in five tabs and about 20 minutes
Plan on 20 minutes once you know the tools, and longer the first time. Open these five tabs and keep a table with 15 rows beside them:
- DefiLlama’s page for the protocol: staking or liquidity, measured at current market prices. It is the main size metric in DeFi.">TVL by chain and by token, fees, revenue, the official website link.
- A block explorer such as Etherscan, on the main contract: verified source, proxy tab, owner.
- The project’s documentation and its GitHub: addresses, audit PDFs, licence.
- The governance forum and any timelock queue: what is changing, who proposes it.
- An incident record: the DefiLlama hacks page and the Rekt leaderboard.
The whole job is read-only. You never connect a wallet to check a protocol and you never sign anything, and any site that asks you to “verify” by signing has failed the test. Take contract addresses from the project’s own documentation or repository, never from a social post. Aave, for instance, keeps a public address book on GitHub, and its entry for the Ethereum Pool matches what the contract registry returns on-chain: 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2, read on 1 November 2026.
Two rules before starting. If you cannot find an answer, write it down as red, because a missing answer is information. And note the date, because each row is a snapshot that a single governance vote can change.
The 15 points: what to check, where, and the red flag
1. The team: who answers when it breaks
Check who builds the protocol, who pays them and how to reach them about a security problem. Look for named founders with a record outside this project, a legal entity, a security contact, and payments to service providers in the governance forum. Many serious protocols run through a DAO that hires firms: Aave’s V3.7 licence names the Aave DAO as licensor, its V4 licence names Aave Labs.
Anonymity alone proves nothing, and neither does a public name. Drift’s contributors were approached in person: according to Rekt, the operation appears to have started at a conference in fall 2025, with attackers posing as a trading firm and meeting contributors again over several months.
Be careful when nobody is identifiable and there is no security contact on a protocol holding large sums, or when the people with keys change just before a change of control.
2. The code: published, verified, and the same as what runs
Three separate questions hide here. Is the source public? Is the deployed contract verified on the explorer, meaning the published source compiles to the bytecode on-chain? Is that source the audited version? Open the contract tab, look for the verified mark, compare the compiler version and the commit in the repository, and do the same for the implementation behind any proxy.
“Open source” is not the same thing as “verifiable”. Aave V3.7 is published under a Business Source License, which forbids uses that help move users or funds out of the Aave ecosystem. You can read and verify every line, yet it is not open source in the usual sense. For safety, verifiability is the property that counts.
The red flag is an unverified contract or implementation, code kept private, or a fork whose changes are undocumented.
3. The audits: who, when, what scope, what was fixed
You do not need to read every page, since how to read an audit report covers that. Here you want four facts per audit: the firm, the date, the contracts and commit in scope, and whether critical and high findings were fixed. “Acknowledged” means not fixed. Then compare the date of the last audit with the date of the last upgrade. Good practice looks like the Aave V4 repository, which carries dated PDFs from Blackthorn, Trail of Bits and ChainSecurity, plus Certora formal verification reports from March and April 2026.
Audits are necessary and insufficient. Balancer V2 lost about 128.6 million dollars on 3 November 2025, according to Check Point, through rounding in Composable Stable Pools. Certora, which reviewed its Stable Pools in 2022, wrote afterwards that its verified properties “did not constrain the relationship between individual swaps or rounding behavior”. Rekt counted eighteen audits at Resolv, and the loss came through signing credentials stolen off-chain, which no audit of the contracts would reach.
Red flag: an “audited” badge with no PDF, one audit by an unknown firm, an audit of another version, or critical findings left open.
4. Bug bounty and monitoring: does anyone get paid to find the bug first
A bounty gives a skilled researcher a legal reason to report a flaw instead of using it. Find the programme on Immunefi, Sherlock or a similar platform and read the live scope and the maximum payout. Aave’s security page listed, as of 1 November 2026, up to 5 million dollars on Immunefi since October 2023 and up to 3.5 million on Sherlock for V4 since May 2026. Compare the top payout with what a thief could take: Resolv’s bounty was 500,000 dollars. Ask too whether someone watches the contracts in real time and rehearses emergencies.
No bounty on a large protocol is a red flag, and so is a top payout too small to compete with what the bug would earn its finder if used.
5. TVL: how much, and how concentrated
TVL measures deposits, not safety, and how to measure DeFi TVL covers its traps. Use it for size and for concentration. On DefiLlama, split it by chain and by token, then look at it in tokens as well as dollars, because a price rise inflates the dollar figure. Check the utilisation of lending pools too: at 100%, depositors cannot withdraw until someone repays. WETH on Aave reached that level within hours of the Kelp exploit, according to Galaxy Research.
Aave’s parent TVL shows how far the number can swing. Figures below are from DefiLlama’s series as displayed on 1 November 2026, which it may revise.
| Date | Aave TVL, all versions (billion dollars) | Note |
|---|---|---|
| 7 October 2025 | 45.81 | Peak of the series |
| 18 April 2026 | 26.40 | Day of the Kelp exploit |
| 19 April 2026 | 21.97 | |
| 20 April 2026 | 17.95 | Two days on, about 8.45 billion gone |
| 21 April 2026 | 16.59 | |
| 1 July 2026 | 12.17 | |
| 1 October 2026 | 19.17 | |
| 1 November 2026 | 16.34 | Date of this check |
Warning signs: one asset or one depositor making up most of the TVL, a TVL that doubled in days, or a pool sitting near full utilisation.
6. Where the TVL comes from: deposits that stay, money that visits
Deposits that stay because the product is useful behave differently from deposits rented with rewards. Real yield and subsidised yield are covered elsewhere in the course, so just read the split: on DefiLlama’s yields page each pool shows a base APY, paid by borrowers or traders, and a reward APY, paid in tokens. As of 1 November 2026, Aave V3’s USDC pool on Ethereum showed 3.91% base and no reward. RLUSD on the Horizon market showed 1.63% base and 3.95% reward, so most of that yield was an incentive. Then ask what backs the base yield.
Stream Finance answered that question too late. Late on 3 November 2025 it said an external fund manager had lost about 93 million dollars of user assets and suspended withdrawals and deposits, Decrypt reported. Its staked token xUSD fell from 1 dollar to about 0.50, according to PeckShield, then to 0.26 on CoinGecko. The yield had rested on someone off-chain.
Be wary, and call it a red flag, when a yield cannot be traced to fees, when an off-chain manager reports nothing, or when TVL falls each time rewards do.
7. Emissions: who is paid in newly printed tokens
Emissions are tokens created on a schedule and handed to users, the team or investors. Read the tokenomics page and DefiLlama’s unlocks and emissions tabs: how much supply is still to come, who receives it, when, and whether rewards pay for TVL that would otherwise leave. Incentives are normal early in a protocol’s life. DefiLlama’s timeline for Aave marks reward programmes starting on Avalanche and Optimism in 2022. What matters is whether the protocol can stand without them.
A red flag here: an APY above about 20% paid mostly in the protocol’s own token, large team or investor unlocks within months, or no stated use for the token. The 20% is a heuristic, not a rule.
8. Fees and revenue: does the protocol earn anything
Fees are what users pay. Revenue is the protocol’s share of them, the rest going to depositors or liquidity providers. Compare both with what the protocol spends on incentives. DefiLlama showed Aave at 636.2 million dollars of fees and 90.1 million of revenue over the 12 months to 1 November 2026, and 38.4 million and 5.03 million over the last 30 days. Numbers of that order mean real borrowers paying real interest. They say nothing about solvency, and fees can shrink with TVL.
Treat as a red flag no fees at all, “revenue” that is only token emissions, or incentives far larger than fees for a long time.
9. Admin keys: who can move or change things
This is the row that repays the effort. Find the owner or admin of the main contracts: the explorer’s read tab shows owner() or the role admin. Then classify the address. A plain wallet means one key. A multisig means you check the threshold and who signs, and the Safe interface shows both. A governance executor means changes pass through votes.
On Aave, the owner of the Ethereum PoolAddressesProvider read on 1 November 2026 is 0x5300A1a15135EA4dc7aD5a167152C01EFc9b192A, a contract the address book lists as the Level 1 executor of Governance V3. No single wallet holds that role. Emergency powers sit elsewhere: Aave’s page describes a 5-of-9 Governance Guardian that can cancel proposals and a 4-of-7 Protocol Guardian for emergencies. You can test such claims yourself. The Safe contracts read on-chain on 1 November 2026 return those same thresholds: 5 of 9 owners for the Governance Guardian, and 4 of 7 for the Safe holding the emergency-admin role on the Ethereum market. The Protocol Guardian began freezing the rsETH markets at about 19:00 UTC on 18 April, according to Aave’s incident report, less than 90 minutes after the drain. Those powers cut both ways: they limit damage, and they are centralisation.
Drift shows the other end. BlockSec and Hypernative describe a Security Council of 2-of-5 with no timelock at the time of the attack, after a migration on 27 March 2026. On 1 April, pre-signed transactions using Solana’s durable nonces handed over admin control, and about 285 million dollars left, per BlockSec. DefiLlama lists 295 million and Elliptic 286 million. Drift assessed with medium-high confidence, and with outside help, that the actors behind the Radiant hack of 2024 were responsible; Elliptic links the attack to North Korea. Those are attributions, not court findings.
As a yardstick, the DeFiScan framework (version 1.2 of March 2025, on the project’s GitHub), a decentralisation grid that reuses L2BEAT’s stages to score the underlying chain, asks a security council for at least 7 signers, a threshold of at least 51%, at least 50% outsiders and publicly announced signers.
Stop and look harder at one wallet as admin, a low threshold, signers who are all insiders or unnamed, or the same people able to upgrade and mint.
10. Timelock and guardians: how long before a change takes effect
A timelock forces a delay between approval and execution. It protects you only if you can see the queued change and leave in time, so the useful number is the delay measured against your own exit: how often you look, how fast you can withdraw, what happens if the pool is at 100% utilisation. Read the delay in the documentation and confirm it on the timelock contract. Then check the queue, on the governance forum or a tool such as Tally, and ask whether anyone can bypass it.
Aave’s security page gives 1 day for Level 1 proposals and 7 days for Level 2 governance changes. DeFiScan’s stricter yardstick calls an exit window high risk when upgrades could take user funds and the window is under 7 days. Applying that to any protocol takes care, because it depends on what each level can touch.
What should worry you: no timelock, a delay shorter than your reaction time, or a timelock removed shortly before a sensitive change.
11. Upgradeability: can the rules be rewritten
Most large protocols sit behind proxies: you deposit into a fixed address whose logic can be replaced. On the explorer, the “Read as Proxy” tab shows the current implementation. Ask who can replace it, how fast, and what a replacement could touch. Immutable code removes this risk and also removes the ability to fix a bug, so neither answer is free.
Aave’s Ethereum Pool is a proxy: on 1 November 2026 its implementation slot pointed to 0x728a138a4823392c2efa55e028d434f526fe03cf, and its bytecode names the PoolAddressesProvider as proxy admin, which brings you back to the governance executor of point 9. DeFiScan rates this dimension high when upgrades could cause theft or loss of user funds, which is the question any upgradeable pool has to answer. The next one is whether point 10 gives you time.
An upgrade by one key is the classic red flag, as is no delay at all, a new implementation not verified before it goes live, or a function able to mint or drain at will.
12. Oracles: where the price comes from
A lending market liquidates on whatever its price feed says. The design is explained in our lesson on DeFi oracles, so here you only identify it. Which oracle is used for each major asset? Is it a decentralised feed, a time-weighted price or a team-run source? Is there a staleness check and a fallback? Can a new asset be listed with a custom feed, and how quickly?
Aave’s AaveOracle contract states “Use of Chainlink Aggregators as first source of price”, with a fallback oracle that governance can set. Yet the feed configuration can fail without any attack. In March 2026, a mismatch between two parameters of Aave’s CAPO price cap left proof of stake coin with a protocol that stakes it for you and issues a transferable token (such as Lido stETH or rETH) representing the deposit plus rewards, which you can use or sell while the coins stay staked.">wstETH about 2.85% below its market rate, and 34 accounts were liquidated for about 10,938 wstETH, according to the reimbursement proposal on Aave’s forum.
Red flag: the spot price of a thin DEX pool used as an oracle, a feed the team controls, or new collateral listed with an unvetted feed. Drift’s attackers created a market for a worthless token called CVT, priced by an oracle they had built and controlled for three weeks, per Rekt.
13. Dependencies: the collateral, the bridge and the service you did not choose
This is the row the April 2026 loss came through. List the five largest assets in the protocol and, for each one, write who issues it, what backs it, how it reaches this chain, who verifies that bridge and what oracle prices it. On a layer 2 deployment, add the chain’s own bridge. Off-chain services count as well: signers, cloud keys, a fund manager, a risk provider.
Kelp’s rsETH bridge ran on LayerZero with a single verifier, LayerZero Labs itself, and the two sides have argued over that choice ever since. LayerZero’s first statement said: “Despite these recommendations, KelpDAO chose to utilize a 1/1 DVN configuration.” Kelp answered on 20 April that the setup was LayerZero’s own documented default. LayerZero’s chief executive rejected that account of the defaults in early May. Then, on 8 May, the company conceded: “we made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions”. For your own grid, the point is smaller than the quarrel: the number of verifiers on a bridge is a setting, so ask what it is. LayerZero attributes the attack to North Korea’s Lazarus Group, which is its claim and not a court finding.
Aave had no say in any of that, yet it carried the consequence. Its report of 20 April estimated bad debt at 123.7 million dollars if losses were shared across all rsETH, and 230.1 million if they fell on layer 2 holders, adding that the outcome “depends on decisions outside Aave’s control”. A rescue effort called DeFi United, with Lido, EtherFi, Mantle and the Aave DAO among its backers, reported 320 million dollars in donations and loans by 29 April. Kelp sent the last tranche of rsETH to the bridge contract in late May, which restored the backing, ForkLog reported, citing a bad debt of 190 million dollars.
On this row, watch for top collateral that is a wrapped or bridged receipt with a single verifier, a stablecoin backed by loans to one manager, or a token that cannot be sold in size without moving its price.
14. Incident history: what happened and how they behaved
A clean record may mean good work or a short life. An incident handled well can tell you more. Search the catalogue of DeFi hacks in this course and the DefiLlama list, whose entries give date, amount, technique and funds returned. Then read the project’s own post-mortem. Was it fast and specific? Were users made whole, and from what money? What changed afterwards?
Aave’s record, as of 1 November 2026, shows the range. DefiLlama lists a 56,000-dollar exploit in August 2024; Aave Labs’ report describes a flaw in Paraswap-powered periphery contracts, puts the take at roughly 95,000 dollars across networks and says no user funds were lost. DefiLlama lists the CAPO episode at 862,000 dollars and marks that amount as returned, while the forum proposal asked for about 513 ETH from the treasury to refund users. A failed CRV short left about 1.6 million dollars of bad debt in November 2022, according to the Llama and Gauntlet proposal to repay it. For Kelp, Cointelegraph reported on 7 May 2026 that the attacker’s positions were liquidated without using Umbrella, Aave’s insolvency backstop. Kelp said in May that it was moving rsETH to Chainlink’s CCIP.
Red flags: a post-mortem that never came, users left unpaid in silence, or the same class of bug twice.
15. Legal and front-end exposure: the website, the domain and the law
The contract can be sound while the website is not. DefiLlama lists Matcha, 25 January 2026, 13.43 million dollars, as a frontend compromise, and CoW Swap, 14 April 2026, 1.2 million, as a DNS hijack. Check whether the interface has backups: DeFiScan rates a single interface with no backup as high risk and several independent interfaces as low. Aave’s page lists DNSSEC, Content Security Policy, Subresource Integrity and IPFS deployments of each interface commit. Use a bookmark, and take the link from DefiLlama.
Then the legal layer: who publishes the site, what the terms say, which countries are blocked, and whether a regulator has named the project or the domain in a warning. The liability of developers and DAOs gets its own later lesson on DeFi regulation. For now, note whether a named entity exists at all.
The last red flags: no terms, no entity, a single website with no way to reach the contracts without it, or a regulator’s warning on the name.
The grid on Aave: a worked example, dated 1 November 2026
Here is what the 15 rows looked like for one protocol on one day. Aave is here because its data are public and rich, and because the April episode tests the method. The third column is not a rating: it says what a reader would still need to do. Where a figure comes from Aave’s own security page, it is self-reported.
| Point | Finding, 1 November 2026 | Still to weigh |
|---|---|---|
| 1 Team | DAO with service providers; Aave DAO and Aave Labs named as licensors | Who is paid, and turnover |
| 2 Code | Public, under Business Source License; Pool address matches on-chain | Compare commit with deployed code |
| 3 Audits | 65+ audits and reviews (Aave’s count); dated V4 reports in the repository | Third-party assets sit outside the audited code |
| 4 Bounty | Up to $5M on Immunefi, up to $3.5M on Sherlock for V4 | Payout against sums at risk |
| 5 TVL | $16.34B in all; V3 $15.33B, of which $12.74B on Ethereum; weETH, WBTC, wstETH and cbBTC are 68% of V3 | Concentration in receipt tokens |
| 6 Source | USDC 3.91% base, no reward; RLUSD on Horizon 1.63% base, 3.95% reward | Deposits left fast in April |
| 7 Emissions | Reward programmes in its history; some rewards today | Which pools rely on them |
| 8 Fees | $636.2M fees, $90.1M revenue over 12 months | Trend with TVL |
| 9 Admin | Governance executor contract; guardians 5-of-9 and 4-of-7, confirmed on-chain | Guardians can act fast |
| 10 Timelock | 1 day Level 1, 7 days Level 2 | Is 1 day enough for your exit? |
| 11 Upgrades | Proxy; admin path leads to governance | Read proposals that touch the logic |
| 12 Oracles | Chainlink first, fallback set by governance; CAPO cap layer | March 2026 parameter error |
| 13 Dependencies | Top assets are issued by other protocols; rsETH still 5% of V3 TVL | April 2026 came through here |
| 14 History | CRV bad debt 2022, periphery exploit 2024, oracle refund and rsETH shortfall 2026 | Read each post-mortem |
| 15 Front end, legal | DNSSEC, IPFS deployments, Aave Labs’ SOC 2 Type II of March 2026 (Aave’s page) | Legal exposure not assessed here |
Three things stand out. The first 12 rows take most of the 20 minutes and return plenty of documentation. Row 5 hints at row 13: of the 15.33 billion dollars in V3, 3.55 billion is weETH, 2.45 billion wstETH and 0.78 billion rsETH, each a claim on another protocol. And rsETH is still there, which a reader might not assume after April. Whether that mix suits anyone is a judgement about risk, and this table does not make it.
An outside opinion helps as a cross-check. DeFiScan’s review of Aave V3’s Core market on Ethereum, dated 7 May 2025, placed it at Stage 0, the first of its three stages, with high risk scores for upgradeability, autonomy and exit window. That is a judgement on decentralisation alone: the framework says it does not assess smart contract risk. The review also predates the April 2026 episode, so read it as one dated input.
Scoring without fooling yourself
This grid is Coindaro’s editorial framework, not an industry standard, and it has no pass mark on purpose. Adding up points would let a good bounty cancel out a bad admin key. Sort findings by weight instead.
Some findings can reasonably end the review: unverified code, one wallet able to upgrade instantly, a yield that traces to nothing. Others are questions of size: a short timelock under real governance, a concentrated collateral base, a young protocol. An unknown counts as a red until you resolve it. And a green row only describes the day you checked it, so repeat the review when governance changes something important or when the TVL moves sharply.
How much to put at risk is your own decision, and this is not advice on it. The principle is simple enough: an exposure should be one you could lose entirely without harm, since even a mature protocol can trap deposits for days, as Aave’s WETH pools at 100% utilisation showed in April. DeFi insurance can cover part of that risk, within the limits that lesson sets out.
What the grid cannot tell you
It cannot see a bug nobody has found. Balancer’s flaw sat in code that had been reviewed and formally verified. It cannot see inside a signer’s laptop, as Resolv and Drift showed. It sees dependencies only one level down, while the failure may sit two levels away: Aave depended on rsETH, rsETH on a bridge, the bridge on one verifier, and that verifier on RPC nodes the attackers poisoned, by LayerZero’s account.
It also says little about the behaviour of other depositors. On Galaxy’s figures, nearly 5.4 billion dollars of ETH and WETH left Aave by the morning of 19 April, faster than any governance process. A sound protocol can still lock you in for days if everyone heads for the door at once.
So keep an exit plan with the grid: know how you would withdraw, what you would do if a pool hit 100% utilisation, and what would make you leave. The next lesson on the DeFi path turns to what the law says about all this.
