Security Critical

DeFi Security: Protect Your Crypto from Hacks, Scams, and Contract Risks

A technical security guide for engineers entering DeFi. Learn to verify contracts, detect scams, secure your assets, and farm yield safely.

Hardware Wallet Security
Contract Audits
Scam Detection

Table of Contents

1

Hardware Wallet Security

The foundation of crypto asset protection

Why Hardware Wallets Are Essential

Hardware wallets store your private keys offline on a physical device, making them immune to most online attacks. For DeFi users managing significant assets, they're non-negotiable.

Hardware Wallet
  • • Private keys never leave device
  • • Immune to keyloggers & malware
  • • Physical transaction confirmation
  • • Recovery seed offline storage
  • • Multi-signature support
Software Wallet (Hot Wallet)
  • • Keys stored on internet-connected device
  • • Vulnerable to malware & phishing
  • • No physical confirmation required
  • • Easier to compromise remotely
  • • Higher risk for large holdings

Recommended Hardware Wallets for DeFi

Ledger Nano X / Nano S Plus

Industry standard with excellent DeFi support via Ledger Live and WalletConnect.

Pros:
  • • Wide protocol support (Ethereum, BSC, Polygon, Solana)
  • • WalletConnect integration for dApps
  • • Regular firmware updates
  • • Bluetooth support (Nano X)
  • • Large app ecosystem
Cons:
  • • Closed-source firmware
  • • App installation required per chain
  • • Higher price point ($79-$149)

Critical Setup & Security Practices

2

Contract Audit Verification

Technical due diligence before interacting with protocols

Understanding Smart Contract Audits

A smart contract audit is a comprehensive security review by specialized firms. However, an audit is not a guarantee of safety—audited protocols have been exploited.

Tier 1 Auditors
  • • Trail of Bits
  • • OpenZeppelin
  • • ConsenSys Diligence
  • • Certik
  • • Quantstamp

Most rigorous, high cost, long timeline

Tier 2 Auditors
  • • Hacken
  • • SlowMist
  • • PeckShield
  • • CertiK (standard tier)
  • • Solidified

Good quality, moderate cost, faster turnaround

Lower Tier
  • • Techrate
  • • Solidity Finance
  • • Various solo auditors
  • • Community audits

Variable quality, proceed with caution

Step-by-Step Audit Verification Process

1Find Official Audit Reports

Check protocol's official website, documentation, or GitHub repository for audit links. Look for:

  • Direct links to auditor's website (not just PDF)
  • Multiple audits from different firms (better)
  • Recent audits (within last 12 months for active projects)

Example: Aave audits → github.com/aave/aave-v3-core/tree/master/audits

2Verify Audit Authenticity

Confirm the audit is legitimate and not fabricated:

Visit auditor's official website - Find the audit in their published reports section
Check report metadata - Verify PDF properties, digital signatures if available
Cross-reference audit date - Match with protocol's development timeline

3Review Audit Findings

Read the audit report, focusing on:

Critical

Can result in loss of all funds. Must be fixed before launch.

High

Significant risk, can lead to substantial losses under certain conditions.

Medium

Potential for loss or unexpected behavior, should be addressed.

Low / Informational

Best practices, gas optimization, code quality improvements.

4Verify Deployed Contracts

Confirm the audited code matches what's actually deployed on-chain:

On Etherscan (or equivalent block explorer):

  1. Find the contract address from protocol's official docs
  2. Look for green checkmark indicating verified source code
  3. Check "Contract" tab → "Read Contract" / "Write Contract"
  4. Compare contract creation date with audit date
  5. Review constructor parameters and initialization

🔍 Advanced: Compare bytecode hash

For maximum assurance, compile audited source code and compare bytecode hash with deployed contract. Tools: Foundry, Hardhat verification scripts.

5Check for Upgradeable Contracts

Many DeFi protocols use proxy patterns for upgradeability. This introduces risks:

Safer Upgrade Mechanisms

  • • Timelocked upgrades (24-48+ hour delay)
  • • Multi-sig control (e.g., 4-of-7 signers)
  • • Governance-controlled upgrades (DAO vote)
  • • Immutable core logic contracts

Dangerous Patterns

  • • Single admin address (EOA) can upgrade instantly
  • • No timelock or delay mechanism
  • • Upgrade authority not disclosed
  • • Proxy pattern with backdoor functions

Audit Verification Tools

DeFi Safety

defisafety.com - Process Quality Review scores for protocols

Scoring methodology

Audit Database

github.com/0xNslabs/blockchain-security-audit-list - Comprehensive audit collection

Searchable repository

Etherscan Contract Checker

Verify source code, check for proxies, review contract calls

Built-in tool

Tenderly

tenderly.co - Simulate transactions, debug contracts, monitor for changes

Advanced tool
3

Rug-Pull Detection Checklist

Identify scams before you invest

Comprehensive Rug-Pull Checklist

Quick Rug-Pull Assessment Scorecard

Score each category: ✅ (Pass) = 1 point, ⚠️ (Caution) = 0.5 points, 🚩 (Red Flag) = 0 points

Team Identity✅ Doxxed | ⚠️ Partially | 🚩 Anonymous
Liquidity Locked✅ 12+ months | ⚠️ 6 months | 🚩 Unlocked
Audit Status✅ Tier 1 | ⚠️ Tier 2 | 🚩 None
Token Distribution✅ Fair | ⚠️ Heavy team | 🚩 Concentrated
Contract Analysis✅ Clean | ⚠️ Minor issues | 🚩 Malicious
Economic Model✅ Sustainable | ⚠️ Questionable | 🚩 Ponzi
Community✅ Organic | ⚠️ Mixed | 🚩 Shilled

Scoring Guide:

  • 6-7 points: ✅ Relatively safe (but still do your own research)
  • 4-5.5 points: ⚠️ Proceed with extreme caution, high risk
  • <4 points: 🚩 Likely scam, do not invest
4

Exploit Case Studies

Learn from the biggest DeFi security failures

Ronin Bridge Hack (March 2022)

$624 million stolen

Centralization Attack

What Happened:

Ronin Network (Axie Infinity's Ethereum sidechain) used a 9-validator system where 5 signatures were required to approve withdrawals. Attackers compromised 5 validator private keys and withdrew 173,600 ETH and $25.5M USDC.

Root Cause:

  • 4 validators controlled by single entity (Sky Mavis)
  • Social engineering attack gave access to another validator
  • Insufficient validator decentralization
  • No monitoring alerts for unusual withdrawals

Lessons for Users:

  • Check validator distribution: Multi-sig or bridge should be controlled by diverse, independent parties
  • Avoid over-centralized protocols: If one team controls majority of validators, it's a single point of failure
  • Bridge risk is real: Cross-chain bridges are prime targets. Minimize assets on bridges and sidechains
  • Monitor large protocols: Even popular projects can have centralization risks

Wormhole Bridge Exploit (February 2022)

$325 million stolen

Smart Contract Vulnerability

What Happened:

Attacker exploited signature verification flaw in Wormhole's Solana contract, allowing them to mint 120,000 ETH on Solana without depositing actual ETH on Ethereum. They then bridged this fabricated ETH back to Ethereum.

Root Cause:

  • Signature verification bypassed in specific function
  • Developer mistake in Solana contract upgrade
  • Audits didn't catch the specific vulnerability
  • No rate limiting on minting large amounts

Lessons for Users:

  • Audits aren't foolproof: Wormhole was audited, but signature verification flaw was missed
  • New code = new risk: Contract upgrades can introduce vulnerabilities. Monitor protocol updates
  • Bridges are high-value targets: Billions locked makes them attractive to hackers. Limit bridge exposure
  • Bug bounties help: Large bug bounty programs incentivize white hat hackers to find issues first

Terra/Luna Collapse (May 2022)

$40+ billion in value destroyed

Economic Exploit

What Happened:

Terra's algorithmic stablecoin UST depegged from $1, triggering death spiral. UST relied on LUNA token for stability. As UST lost peg, massive LUNA minting to defend it caused LUNA price to crash, further breaking UST peg. Entire ecosystem collapsed in days.

Root Cause:

  • Algorithmic stablecoin fundamentally unstable under stress
  • Anchor Protocol's 20% APY on UST was unsustainable
  • Large UST holder sold massive amount, starting depeg
  • Reflexive system: stability depended on market confidence
  • No real collateral backing UST

Lessons for Users:

  • Algorithmic stablecoins are risky: No real collateral means vulnerability to bank runs
  • Unsustainable yields attract collapse: 20% APY should have been red flag
  • Prefer overcollateralized stablecoins: USDC (centralized but backed 1:1) or DAI (overcollateralized by assets)
  • Economic exploits are possible: Not all exploits are code hacks. Economic design matters
  • Diversify stablecoins: Don't hold all value in one stablecoin type

Curve Finance / Vyper Exploit (July 2023)

$73 million stolen

Compiler Bug

What Happened:

Reentrancy vulnerability in Vyper compiler (versions 0.2.15, 0.2.16, 0.3.0) affected several Curve pools. Attackers drained liquidity from affected pools including CRV/ETH, JPEG'd pETH/ETH, Metronome sETH/ETH, and Alchemix alETH/ETH.

Root Cause:

  • Reentrancy guard not properly implemented in affected Vyper versions
  • Curve contracts written in Vyper instead of Solidity
  • Bug in compiler itself, not in developer's code
  • Multiple protocols affected (Curve, Alchemix, JPEG'd, Metronome)

Lessons for Users:

  • Compiler risks exist: Bug wasn't in protocol code but in the compiler used to deploy it
  • Even battle-tested protocols vulnerable: Curve is one of the most established DeFi protocols
  • Monitor security disclosures: Vyper bug was publicly disclosed; affected pools should have been avoided
  • Diversify across protocols: Don't concentrate all liquidity in one protocol/pool
  • Understand tech stack: Know what compiler and dependencies a protocol uses

Euler Finance Hack (March 2023)

$197 million stolen (later returned)

Donation Attack

What Happened:

Attacker exploited donation attack vulnerability: took flash loan, donated assets to inflate their account's collateral value, borrowed maximum against inflated collateral, triggered liquidation of their own position to extract value. Repeated across multiple assets.

Root Cause:

  • Flaw in health check calculation allowed donation manipulation
  • Liquidation logic didn't account for donated collateral
  • Multiple audits missed the specific attack vector
  • Novel attack - first major "donation attack" exploit

Lessons for Users:

  • Complex protocols = more attack surface: Euler had sophisticated risk management, which introduced complexity
  • Novel attacks emerge: This was a new attack type not previously seen at scale
  • Audits can't catch everything: 10 audits didn't find this vulnerability
  • On-chain negotiations possible: Hacker returned funds after on-chain messages and negotiations

Common Exploit Patterns Summary

Smart Contract Bugs

  • Reentrancy attacks
  • Integer overflow/underflow
  • Front-running vulnerabilities
  • Flash loan attacks
  • Oracle manipulation

Centralization Risks

  • Compromised admin keys
  • Multi-sig failures
  • Malicious upgrades
  • Insider attacks
  • Bridge validator compromise

Economic Exploits

  • Algorithmic stablecoin death spirals
  • Liquidity pool manipulation
  • Governance attacks
  • MEV exploitation
  • Ponzi collapse

Further Resources: Track exploits in real-time on DeFiLlama Hacks Dashboard, Rekt News, and Web3 Is Going Great.

5

Safe Yield Farming Workflow

Step-by-step process to minimize risk

Pre-Farming Security Checklist

✓ Protocol Research (30 min)

  • • Run through complete rug-pull checklist (Section 3)
  • • Read documentation and understand how it works
  • • Check TVL on DeFiLlama (prefer $50M+ for established protocols)
  • • Review recent Twitter/Discord for security discussions

✓ Contract Verification (20 min)

  • • Find and review audit reports (Section 2)
  • • Verify contracts on Etherscan
  • • Check for upgradeable proxies and admin controls
  • • Run TokenSniffer scan on new tokens

✓ Economic Analysis (15 min)

  • • Calculate where yield comes from (fees, emissions, both?)
  • • Check token emission schedule (avoid high inflation)
  • • Understand impermanent loss risk for LP positions
  • • Verify APY is reasonable (<100% for sustainable farming)

✓ Wallet & OpSec Setup (10 min)

  • • Use hardware wallet (Ledger, Trezor, GridPlus)
  • • Verify you're on official website (check URL carefully)
  • • Review gas fees before confirming (high gas = possible phishing)
  • • Bookmark official site to avoid phishing

Step-by-Step Safe Yield Farming Process

1

Acquire Farming Assets

Get tokens needed for farming pool

Option A: Buy tokens on DEX (Uniswap, Curve, etc.)

  • Check token contract address on official protocol docs
  • Verify contract address in DEX interface matches docs
  • Start with small test trade to verify everything works
  • Beware of high slippage (>2% concerning for liquid tokens)

Option B: Bridge from another chain

  • Use established bridges (Stargate, Across, Hop Protocol)
  • Verify bridge contract addresses before approving
  • Expect delays (minutes to hours depending on bridge)
  • Keep transaction receipt for tracking
2

Approve Token Spending (Carefully)

Grant contract permission to interact with your tokens

❌ NEVER Do This:

  • Unlimited approvals: Default in many UIs. Change to specific amount.
  • Approve without verification: Always verify contract address on hardware wallet screen
  • Approve unknown contracts: Only approve verified protocol contracts

✅ Safe Approval Process:

  1. Verify you're on official protocol website (check URL)
  2. When approval popup appears, manually set specific amount (e.g., exactly what you'll deposit)
  3. Compare contract address on hardware wallet screen with Etherscan verified contract
  4. Approve only after verification
  5. Document the approval for future revocation

🔧 Tool: Revoke.cash

Use revoke.cash to view and revoke all token approvals. Do this regularly (monthly) to minimize attack surface.

3

Provide Liquidity / Deposit

Enter the farming position

LP Token Farming (e.g., Uniswap V3, Curve):

  1. Understand impermanent loss: Your tokens can lose value vs. holding if prices diverge. Use IL calculator
  2. Check pool balance: Prefer balanced pools (50/50). Avoid pools with extreme ratio imbalances
  3. Verify pool contract: Check pool address on protocol docs before depositing
  4. Add liquidity: Equal value of both tokens (UI will guide you)
  5. Receive LP tokens: These represent your pool share
  6. Set price range (V3): For concentrated liquidity, choose range carefully (tighter = more fees but higher IL risk)
4

Monitor Position & Risks

Active management is essential

Daily Monitoring (5 min/day):

  • Check protocol Twitter/Discord: Look for security alerts, unexpected behavior
  • Review position value: Compare to what you deposited (accounting for IL)
  • Monitor APY changes: Sudden drops may indicate issues or dilution
  • Track gas prices: Plan withdrawals during low gas periods

Weekly Deep Checks (20 min/week):

  • TVL changes: Sudden large withdrawals are red flag (check DeFiLlama)
  • Price movements: For LP positions, calculate current impermanent loss
  • Reward token price: If farming rewards, monitor their value (may need to sell regularly)
  • Protocol news: Read governance proposals, development updates
  • Competitor yields: Compare with similar protocols (maybe better opportunities)

Red Flags - Exit Immediately:

🚨 Security Issues

  • Exploit reported or suspected
  • Unusual contract activity
  • Team communication goes silent

📉 Economic Concerns

  • TVL drops >30% in short time
  • Reward token crashes >50%
  • Liquidity becomes imbalanced

🔔 Monitoring Tools:

  • • DeFiLlama: Track TVL, yields across protocols
  • • Zapper / Zerion: Portfolio tracking & visualization
  • • DeBank: Multi-chain portfolio management
  • • Tenderly: Set alerts for contract interactions
5

Harvest Rewards & Compound

Claim and reinvest or secure profits

Harvesting Strategy:

Best for: Long-term farming in trusted protocols with valuable reward tokens.

  • Manual compounding: Claim rewards → Swap for LP tokens → Reinvest in pool
  • Auto-compounding vaults: Use Yearn, Beefy, etc. (adds another layer of smart contract risk)
  • Gas consideration: Compound when rewards > 2-3x gas cost
  • Tax implication: Each compound is taxable event in most jurisdictions

Pro: Maximize APY through compounding effect

Con: Continued exposure to protocol & reward token volatility

6

Exit Position Safely

Withdraw when needed or risks increase

Withdrawal Process:

  1. Check withdrawal conditions: Some protocols have lock-up periods or penalties
  2. Harvest pending rewards first: Claim before withdrawing principal
  3. Unstake/withdraw: Remove LP tokens or lending positions
  4. Remove liquidity (if LP): Burn LP tokens to get underlying assets back
  5. Verify receipt: Check wallet to confirm all tokens received
  6. Revoke approvals: Use revoke.cash to remove protocol's token approval

Exit Timing Considerations:

  • Gas prices: Withdraw during low gas periods (weekends, late night UTC)
  • Market conditions: For LP, exit when price ratio favorable (minimize IL)
  • Protocol risk: If red flags appear, exit immediately regardless of other factors
  • Lock-up: If funds are locked, wait for unlock period (or check for early exit penalties)

Advanced Safety Tips

Risk Management

  • Never farm with >10% of portfolio in single protocol
  • Diversify across multiple protocols and chains
  • Use different wallets for different risk levels
  • Set stop-loss mentally (e.g., exit if position drops 20%)
  • Prefer established protocols (>1 year old, >$100M TVL)

Tax & Accounting

  • Track every transaction for tax reporting
  • Use Koinly, CoinTracker, or TokenTax for automation
  • Understand your jurisdiction's crypto tax rules
  • Set aside ~30-40% of profits for taxes (if applicable)
  • Consider tax-loss harvesting for failed positions

Insurance Options

  • Nexus Mutual: Protocol cover for specific smart contracts
  • InsurAce: Multi-chain coverage options
  • Cost: 2-5% of insured value per year typically
  • Worth it?: For large positions (>$50k) in new protocols
  • Read coverage terms carefully (what's excluded)

Emergency Procedures

  • Have exit plan prepared (know withdrawal steps)
  • Keep ETH in wallet for emergency gas fees
  • Bookmark protocol's official Discord/Twitter for alerts
  • Set up notifications for large TVL changes (Tenderly alerts)
  • Know where to check for exploit reports (Rekt, PeckShield Twitter)
6

Security Tools & Resources

Essential tools for DeFi security

Contract Analysis Tools

Etherscan / Block Explorers

Verify source code, check contract creation, review transactions

etherscan.io

Token Sniffer

Automated scam detection, audit scores, honeypot detection

tokensniffer.com

Honeypot.is

Test if you can sell a token before buying

honeypot.is

DeDaub Contract Library

Decompile and analyze bytecode

library.dedaub.com

Wallet Security Tools

Revoke.cash

View and revoke token approvals across all chains

revoke.cash

Fire (by Webacy)

Wallet security dashboard, scam detection, panic button

app.webacy.com

Wallet Guard

Browser extension that simulates transactions before signing

walletguard.app

Tenderly

Transaction simulation, debugging, monitoring alerts

tenderly.co

Research & Intelligence

DeFiLlama

TVL tracking, yields, hacks database, protocol comparisons

defillama.com

Rekt News

Detailed write-ups of major DeFi exploits and hacks

rekt.news

CertiK Skynet

Security scores, on-chain monitoring, audit reports

skynet.certik.com

DeFi Safety

Process quality reviews and security scores

defisafety.com

Portfolio Management

Zapper

Multi-chain portfolio tracking, position management

zapper.xyz

DeBank

Portfolio tracking, DeFi dashboard, social features

debank.com

Zerion

Portfolio management with mobile app support

zerion.io

Rotki

Open-source portfolio tracker with local data storage

rotki.com

Learning Resources

Documentation

Community

  • • r/defi - Reddit community
  • • DeFi Safety Discord
  • • Bankless newsletter
  • • The Defiant podcast

Security Twitter

  • • @pcaversaccio
  • • @samczsun
  • • @tayvano_
  • • @officer_cia

Final Security Checklist

Before interacting with any DeFi protocol, ensure you've completed these core security steps:

Using hardware wallet for all transactions
Verified protocol audit reports from reputable firms
Checked contract addresses on Etherscan
Reviewed rug-pull detection checklist (7/7 points)
Set specific token approval amounts (never unlimited)
Bookmarked official protocol website
Understood where yield comes from
Calculated impermanent loss risk (for LP positions)
Set up portfolio monitoring (Zapper, DeBank)
Have emergency exit plan prepared
Never invested more than you can afford to lose
Documented all transactions for tax purposes

Continue Your DeFi Education

DeFi for Tech Professionals

Complete beginner to advanced guide covering lending, staking, and LP strategies

DeFi Yield Comparison Calculator

Compare yields across protocols with APY vs APR calculations

Impermanent Loss Calculator

Calculate potential IL before providing liquidity

Compare DeFi Platforms

Side-by-side comparison of top DeFi protocols

Stay Updated on DeFi Security

Get weekly security alerts, exploit analyses, and DeFi best practices delivered to your inbox.

Stay Ahead of Your Finances

Get expert tips, exclusive credit card deals, and budgeting strategies delivered to your inbox.

We respect your privacy. Unsubscribe at any time.