Code Is Not Law If It Has Bugs
The promise of DeFi is that smart contracts execute automatically and trustlessly. The reality is that smart contracts are programs written by humans, and humans write buggy code. Since DeFi protocols hold millions or billions in assets, bugs are financially catastrophic. Over $3 billion has been lost to smart contract exploits since DeFi began, and the number continues to grow.
Categories of Smart Contract Risk
Reentrancy attacks are among the oldest and most famous. The 2016 DAO hack exploited a reentrancy vulnerability to drain approximately $60 million (in 2016 ETH prices). The attack pattern involves a contract calling an external function that then calls back into the original contract before the first call completes, allowing repeated withdrawals.
Oracle manipulation is increasingly common. Many DeFi protocols rely on price oracles (Chainlink, Uniswap TWAP) to determine asset values. If an attacker can temporarily manipulate the oracle price, they can trick the protocol into executing trades or liquidations at incorrect prices. Flash loan attacks frequently exploit oracle manipulation because the attacker can borrow massive amounts of capital, manipulate a price, exploit a protocol, and repay the loan in a single transaction.
Logic errors are bugs in the business logic of the contract. The code compiles and runs without crashing, but it does not do what the developers intended under certain edge conditions. These are the hardest vulnerabilities to find because they require understanding both the code and the intended behavior.
Governance attacks occur when an attacker accumulates enough governance tokens to pass a malicious proposal. If a protocol's governance can change key parameters (fee structures, collateral ratios, treasury spending), controlling governance is equivalent to controlling the protocol.
How to Assess Risk
Audit status is necessary but not sufficient. A protocol that has been audited by a reputable firm (Trail of Bits, OpenZeppelin, Consensys Diligence) is safer than one that has not, but audits do not guarantee security. Many exploited protocols had been audited.
Time in production matters. A protocol that has held $500 million in TVL for two years without incident is meaningfully safer than one that launched last month, regardless of audit status. The passage of time without exploits is evidence (not proof) that the major attack vectors have been covered.
Code complexity is a risk factor. Simpler protocols with fewer lines of code and fewer external dependencies have smaller attack surfaces. Protocols that compose multiple other protocols (stacking yield across three or four DeFi layers) multiply the risk because a vulnerability in any layer can affect the whole stack.
Sizing Your DeFi Exposure
The practical implication is that DeFi yields should be evaluated against smart contract risk, not in isolation. A 5% yield on Aave (battle-tested, multiple audits, years of operation, billions in TVL) is a very different risk proposition than a 50% yield on a new, unaudited protocol with $2M in TVL. Price the risk into your assessment, and size your DeFi positions accordingly.