- Smart Contract risk can take the form of a logic error in the code or an economic exploit in which an attacker can withdraw funds from the platform beyond the intended functionality. This can take the form of any typical software bug in the code. 
- Since DeFi is built on code this software foundation gives attackers a larger
attack surface than the threat vectors of traditional financial institutions.

Pace University

University of Michigan - Ann Arbor

The principal risks DeFi faces today are smart contract, governance, oracle, scaling, exchange, custodial, DEX, and regulatory risks. DeFi allows developers to create new types of financial products and services, expanding the possibilities of financial technology. While DeFi can eliminate counterparty risk, cutting out middlemen and allowing financial assets to be exchanged in a trustless way, as with any innovative technology, the innovations introduce a new set of risks.

Defi Risks

Harvey, Campbell R., et al. “Defi and the Future of Finance.” SSRN, 15 Dec. 2020, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3711777. 

DeFi and the Future of Finance 

 - Programming risk is the sole threat to the protocol because the application is autonomous and controlled by smart contracts. 
- Protocol governance refers to the representative or liquid democratic mechanisms that enable changes in the protocol. Governance tokens usually have a fixed supply that assists in resisting attempts by anyone to acquire a majority, nevertheless they expose the protocol to the risk of control by a malicious person.

Governance Risk

- Oracles represent significant risks to the systems they help support. 
- If an oracle’s Cost of Corruption is ever less than an attacker’s potential Profit from Corruption, the oracle is extremely vulnerable to attack. 
- Oracles, as they exist today, represent the highest risk to DeFi protocols that rely on them. 
- All onchain oracles are vulnerable to front-running.

Oracle Risk

- Ethereum and other “Proof of Work” blockchains have a fixed block size. For a block to become part of the chain, every Ethereum miner must execute all of the included transactions on their machine. To expect each miner to process all of the financial transactions for a global financial market is unrealistic.

- One actively pursued solution to this problem is a new consensus algorithm, Proof of Stake. Proof of Stake simply replaces mining of blocks, with staking an asset on the next block. An example of malicious behavior in Proof of Stake includes voting for multiple candidate blocks. This action shows a lack of discernment and skews voting numbers, and thus is penalized. 

Scaling Risk

- As the DeFi market increases in size and influence, it will face greater regulatory scrutiny. In response to regulatory pressure, DeFi has seen an increasing
number of anonymous protocol founders. 
- Governance tokens, released by many DeFi projects, are also facing increasing scrutiny as the SEC continues to evaluate if these new assets will be regulated as securities.

Regulatory Risk

There are two dominant DEX environments: Automated Market Makers (AMMs) and order-book exchanges.
- AMMs large problem is impermanent loss.
- On-chain order-book DEXs suffer from the scalability issues inherited from the underlying blockchain they run atop of, and are often vulnerable to front running by sophisticated arbitrage bots. 

DEX Risk

Smart Contract Risk

There are three types of custody and risks associated with each. 
- With self custody, a user develops their own solution (ie a flash drive not connected to the internet, a hard copy, or a vaulting device). Risks with self custody involve private keys getting locked or lost. 

- With partial custody, there is a combination of self custody and an external solution (ie Bitgo). Risks with partial custody include the external service getting hacked and key getting lost from the hack. 

- With third-party custody, a company holds your keys in something like an external wallet. Risks include hacking resulting in lost keys.

Learn Before

Related