DeFi Explained: Mechanics and Risk

Decentralised finance, or DeFi, is a set of financial services built as smart contracts — programs that run on a public blockchain such as Ethereum. Where traditional finance relies on banks, brokers, exchanges, and clearing houses to hold assets and enforce the rules, DeFi replaces those intermediaries with code that anyone can read and anyone can call. A lending market, an exchange, or a derivatives venue becomes a contract at a fixed address. You interact with it directly from a wallet you control, without opening an account or asking permission.

That design removes some risks and creates others. There is no bank that can freeze your account on a whim, and no closing bell. But the trust you would normally place in an institution is now placed in two things instead: the correctness of the code, and the security of your own keys. If the contract has a bug, no support desk can reverse the loss. If someone obtains your keys or tricks you into signing a malicious transaction, the network will execute it faithfully because it cannot tell theft from a legitimate instruction. In DeFi, the risk does not disappear — it moves into the code and into the keys.

This guide explains the mechanics of the main DeFi building blocks and, for each one, where it can fail. It contains no prices, no forecasts, and no advice about whether to use any of these systems. It is a description of how the machinery works and how people lose money when it does not. Unfamiliar terms are defined in our glossary. Every figure cited below is drawn from the primary sources or public post-mortems listed at the end; where a number could not be verified, it has been left out.

How DeFi actually works: the building blocks

Almost every DeFi application is assembled from a small number of primitives. Understanding these ten mechanisms — what each does, and the single risk that most often bites — explains the behaviour of the vast majority of protocols you will encounter.

1. Automated market makers and the constant-product formula

A traditional exchange matches buyers with sellers through an order book. An automated market maker (AMM) does away with the counterparty entirely and prices trades against a pool of tokens using a fixed formula. The most widely copied design is the constant-product market maker introduced by Uniswap. It holds reserves of two tokens, x and y, and enforces a single invariant: the product of the reserves must not fall. This is written x × y = k, where k is a constant the pool defends on every trade.

When you swap token A for token B, you add to reserve x and remove from reserve y, and the contract requires that the new product be at least k. The larger your trade relative to the reserves, the further along the curve you push, and the worse the price you receive — this is slippage, and it is a mechanical consequence of the formula, not a fee. Uniswap v2 also takes a 0.30% fee on the input amount of each swap, which is added back to the reserves and so accrues to liquidity providers. The mechanics are covered in depth in how automated market makers work.

Order books are difficult to run directly on a blockchain because every order placement and cancellation would be a separate, gas-costed transaction, and block times are far too slow for the rapid quoting that market makers rely on. The AMM sidesteps that problem: liquidity sits passively in the pool, and the formula quotes a price algorithmically for any size at any time. The trade-off is that the price the pool offers is derived only from its own reserves and the shape of the curve, not from any external view of what the asset is worth.

Later designs refine the curve. Curve's StableSwap invariant, aimed at assets meant to trade near parity such as two dollar-pegged stablecoins, blends the constant-product curve with a constant-sum curve so that liquidity is concentrated where the assets trade one-for-one, giving very low slippage while they hold their peg and degrading gracefully when they do not. The degree of concentration is set by an amplification parameter chosen by the protocol. The common thread across all these variants is that price and slippage are deterministic functions of the reserves.

Main risk: because the pool prices purely from its own reserves, its quoted price can be moved by anyone with enough capital. A large trade — often funded by a flash loan — can shove the price far from the wider market for the duration of a single transaction. That does not harm the AMM itself, but any other contract that reads the pool's spot price as a source of truth can be deceived by it, which is the root of the oracle attacks described below.

2. Liquidity pools and LP tokens

The reserves an AMM trades against are supplied by liquidity providers. A provider deposits both tokens of a pair, usually in equal value, and in return receives LP tokens — a receipt representing a proportional claim on the pool. As traders swap and pay fees, the reserves grow, and each LP token becomes redeemable for a slightly larger slice of the pool. To withdraw, the provider burns the LP token and receives back its current share of both reserves.

LP tokens are themselves composable: many protocols accept them as collateral or let holders stake them for additional incentives, so a single deposit can be layered into several positions. This composability is one of DeFi's defining features and one of its sharpest edges, because a failure in any layer can cascade into the others.

Main risk: an LP position is not a passive deposit. Its token balance is constantly rebalanced by arbitrage as the market price moves, so a provider almost never withdraws the same quantities they put in. The gap between holding the tokens and providing them as liquidity is impermanent loss, the subject of the next section. There is also smart-contract risk in the pool itself, and — for pools created permissionlessly — the risk that one of the two tokens is malicious or that the pool is a trap that cannot be exited.

3. Impermanent loss, with worked arithmetic

Impermanent loss is the difference in value between providing liquidity to a constant-product pool and simply holding the two tokens, when their relative price changes. It arises because the invariant forces the pool to sell whichever token is appreciating and buy whichever is depreciating. It is called impermanent because it reverses if the price returns to its starting ratio; it becomes permanent only when the provider withdraws while prices are dislocated. The figures below are the deterministic output of the constant-product formula. They are arithmetic, not a forecast, and they say nothing about whether fees earned would offset the effect.

Consider a pool holding 10 units of token A and 1,000 units of token B, so the pool's implied price is 1 A = 100 B. The invariant is k = 10 × 1,000 = 10,000. Now suppose the wider-market relative price of A doubles. Arbitrageurs will trade against the pool until its marginal price also doubles — that is, until the ratio of reserves reaches 1 A = 200 B. Solving x × y = 10,000 with y / x = 200 gives x ≈ 7.071 units of A and y ≈ 1,414.21 units of B.

Valuing that new mix at the new relative price (1 A = 200 B) gives 7.071 × 200 + 1,414.21 ≈ 2,828.4 units of B. Had the provider simply held the original 10 A and 1,000 B, they would hold 10 × 200 + 1,000 = 3,000 units of B. The pool position is worth about 2,828.4 against 3,000 — roughly 5.7% less than holding. That figure is exactly what the closed-form expression 2√r / (1 + r) − 1 produces for a price ratio change of r = 2. The table below lists the loss for a range of ratio changes; the effect is symmetric, so a halving of price produces the same loss as a doubling.

Main risk: a provider can earn trading fees and still end up worse off than holding, if the price of the paired assets diverges enough. The loss grows with the size of the divergence and is unrelated to any yield figure a front-end may advertise. Our dedicated explainer, impermanent loss explained, works through further cases.

4. Lending, borrowing, collateralisation, and liquidation

DeFi lending markets such as Aave and Compound let users deposit assets to earn interest and borrow other assets against them. There is no credit check; instead, loans are over-collateralised. To borrow, you must lock collateral worth more than the loan. Each collateral asset has a loan-to-value (LTV) ratio that caps how much you can borrow against it, and a higher liquidation threshold at which the position is deemed under-collateralised. The gap between the two is a deliberate safety buffer.

Aave expresses the safety of a position as a health factor: the total collateral value multiplied by the weighted liquidation threshold, divided by the total borrowed value. As Aave's documentation states, when the health factor falls below 1 the position becomes eligible for liquidation: a third-party liquidator repays part of the debt and takes the borrower's collateral at a discount, called the liquidation bonus. For example, $10,000 of collateral at an 80% liquidation threshold securing $6,000 of borrowing gives a health factor of (10,000 × 0.8) / 6,000 ≈ 1.33.

Interest rates in these markets are usually algorithmic and driven by utilisation — the fraction of a pool's supplied assets that is currently borrowed. As utilisation rises, the borrow rate rises to attract more suppliers and discourage further borrowing; most protocols use a curve with a "kink" at a target utilisation, beyond which the rate climbs steeply to protect the pool's ability to service withdrawals. Protocols also impose supply and borrow caps and, in some designs, isolate riskier assets so that a problem with one collateral type cannot spill into the whole market. These parameters are typically set by governance rather than fixed in stone.

Main risk: the health factor moves with market prices, which the borrower does not control. A sharp move in either the collateral or the borrowed asset can push a position under water in minutes, triggering liquidation and the loss of the discounted collateral. In periods of network congestion, transactions to add collateral may not confirm in time. And because liquidation depends on a reported price, the whole mechanism inherits oracle risk: a manipulated price can force healthy positions into liquidation or let unhealthy ones drain the protocol, as the Mango Markets case below demonstrates.

5. Stablecoins and peg risk

A stablecoin is a token designed to hold a constant value, almost always one US dollar. Stablecoins are the settlement layer of DeFi, but they are not interchangeable — they keep their peg by very different means, and each mechanism has a different failure mode. The table below sets out the main types.

The failure modes are not theoretical. In March 2023, Circle disclosed that $3.3 billion of the reserves backing the fiat-collateralised USDC — about 8% of the total — were held at Silicon Valley Bank, which had just been shut down. USDC lost its peg and traded near $0.87 before recovering once US regulators guaranteed the bank's deposits. That episode showed a fiat-backed stablecoin is only as sound as the institutions holding its reserves.

The algorithmic model failed far more violently. In May 2022 the UST stablecoin, which held its peg only through an arbitrage loop with its sister token LUNA rather than through hard reserves, slipped below a dollar. Redemptions minted ever-larger quantities of LUNA, collapsing its price and destroying the mechanism meant to defend the peg — a reflexive "death spiral." A Federal Reserve Bank of Richmond post-mortem describes how the design unravelled; UST fell more than 95% within days.

Main risk: "stable" describes an intention, not a guarantee. Fiat-backed coins carry counterparty and reserve risk; crypto-backed coins carry collateral and liquidation risk; algorithmic coins carry the risk that the peg exists only while everyone believes it does. A depeg can propagate through every pool and lending market that treats the coin as worth a dollar.

6. Staking and "yield": the mechanics, not the return

The word staking covers several distinct activities, and conflating them causes confusion. In its precise sense it means locking a network's native token to help secure a proof-of-stake blockchain. On Ethereum, running a validator requires depositing 32 ETH; the validator proposes and attests to blocks and, per ethereum.org, earns protocol rewards for honest participation. The point here is the mechanism, not any rate of return, which this guide does not discuss.

Securing the chain comes with a penalty system. Minor failures such as being offline incur small inactivity penalties. Serious violations — proposing two blocks for one slot, or contradictory attestations — trigger slashing, the forced removal of the validator and destruction of part or all of its stake. Ethereum applies a correlation penalty: if many validators are slashed together, each loses far more, up to the entire stake, which discourages large coordinated operators from taking the same risk. Entering and exiting the validator set is rate-limited through activation and exit queues, so staked funds are not instantly liquid.

Because 32 ETH is a high bar and staked funds are illiquid, liquid-staking arrangements emerged: a user deposits ETH with a provider that runs validators on their behalf and issues a token representing the staked position, which can then circulate in DeFi as collateral or in pools. This restores liquidity but adds layers — the provider's competence, the smart contracts that mint and redeem the token, and the risk that the token itself trades away from the value of the ETH it represents. Restaking extends the same idea further, reusing staked capital to secure additional services and stacking additional slashing conditions on top.

Separately, DeFi front-ends advertise "yield" from lending interest, trading fees, or token incentives. These are not the same as protocol staking rewards, and layered strategies — restaking, liquid-staking tokens used as collateral, "farming" incentive tokens — stack each component's risk on top of the last.

Main risk: staking exposes the stake to slashing and to lock-up periods, and delegating to a third-party operator adds their competence and honesty to your risk. Advertised yields, meanwhile, are the output of mechanisms that can stop or reverse; a headline rate says nothing about the probability that the underlying contract, token, or counterparty fails.

7. Bridges

A blockchain cannot natively see another blockchain, so moving assets between chains relies on a bridge. The common pattern is lock-and-mint: the asset is locked in a contract on the source chain, and a wrapped representation is minted on the destination chain; to return, the wrapped token is burned and the original unlocked. The security of the whole arrangement rests on whatever mechanism authorises the mint — typically a set of validators or a signature scheme — and on the correctness of the contracts on both sides.

Bridges have been the single most damaging category of DeFi failure. In March 2022 the Ronin bridge lost roughly $625 million after attackers obtained five of the nine validator keys needed to approve withdrawals — enough to forge them, as CoinDesk and Halborn documented. The month before, the Wormhole bridge lost about 120,000 wrapped ETH (around $320 million) when a flaw let an attacker bypass signature verification and mint tokens that were never backed. In August 2022 the Nomad bridge lost roughly $190 million after a botched upgrade left a trusted "root" value set to zero, so any message validated; once the first attacker showed the trick, others copied the transaction and drained it in a chaotic crowdsourced looting.

Main risk: a bridge concentrates the assets of many users behind a single trust assumption, whether that is a small validator quorum or one signature-checking routine. A break in that assumption can drain everything at once, and there is no chain to fall back on because the funds genuinely leave the source chain. This is why cross-chain movement is treated as the weakest link; see bridge risk: why cross-chain is the weak point.

8. Oracles

Smart contracts cannot fetch data from outside their own blockchain. An oracle is the bridge for information rather than assets: it brings off-chain facts, most importantly asset prices, on-chain so that lending markets, derivatives, and stablecoins can function. The security question for any oracle is how hard it is to make it report a false value.

The two broad approaches sit at opposite ends of a trade-off. A naive oracle simply reads the spot price from an on-chain AMM pool — cheap, but, as section 1 showed, that price can be shoved by a single large or flash-loan-funded trade. A decentralised oracle network such as Chainlink instead aggregates prices from many off-chain sources and publishes a consensus value, which, per Chainlink's documentation, is inherently resistant to flash-loan manipulation because the reported figure does not come from a single manipulable pool.

Two further defences are common. A time-weighted average price (TWAP) reads a pool's price averaged over a window rather than at a single instant, which makes manipulation far more expensive because an attacker must hold the distorted price across many blocks rather than one. And a well-run oracle feed enforces a heartbeat and a deviation threshold — publishing at least periodically and whenever the price moves beyond a set band — while consumers check that the data is not stale before acting on it. A price that has not updated recently is itself a hazard, because it may no longer reflect reality.

The Mango Markets incident of October 2022 shows what weak oracle design costs. An attacker used a relatively small position to spike the reported price of the thinly traded MNGO token roughly thirteen-fold in about half an hour, then borrowed against the inflated collateral to withdraw over $110 million, according to the CFTC's complaint. Nothing in the code was "broken" — it faithfully trusted a price that had been manipulated.

Main risk: a protocol is only as honest as its price feed. If an oracle can be manipulated — through low-liquidity pools, stale data, or a single point of trust — every downstream contract that acts on that price can be drained or unfairly liquidated, even though each contract executed exactly as written.

9. Governance

Many DeFi protocols are controlled by a governance system in which holders of a governance token vote on proposals — parameter changes, treasury spending, contract upgrades. This is how a protocol claims to be decentralised: no single company sets the rules. Votes are usually weighted by token holdings, and approved proposals may execute automatically.

That automation is precisely the danger when token voting power can be rented. In April 2022 an attacker took out flash loans reportedly exceeding one billion dollars to acquire, for a single transaction, the two-thirds majority needed to pass an emergency proposal in the Beanstalk protocol. The proposal transferred the protocol's assets to the attacker and executed immediately because there was no timelock — no enforced delay between a vote passing and its effects taking hold. Immunefi and Halborn document the mechanics; the protocol lost tens of millions of dollars in net assets. A timelock would have given the community time to see the malicious proposal and respond.

Main risk: governance concentrates enormous power in whatever holds a majority of votes, and flash loans can make that majority temporarily buyable. Without safeguards such as timelocks, quorum requirements, and vote-locking, a governance system can be turned into a mechanism for stealing the very treasury it controls. More mundanely, low participation can leave real control in the hands of a few large holders.

10. Maximal extractable value (MEV)

Maximal extractable value is the profit that block producers, or the "searchers" who bid for transaction ordering, can extract by choosing which transactions to include in a block and in what order — beyond the normal block reward and fees. Because pending transactions sit in a public mempool before they are confirmed, anyone can watch them and react. Ethereum.org catalogues the main forms.

The most familiar to ordinary users is the sandwich attack, a form of front-running. A searcher spots a large pending swap that will move an AMM's price, places its own buy immediately before the victim's trade and a sell immediately after, and pockets the difference the victim's own trade created — leaving the victim a worse price. Not all MEV is predatory: arbitrage that aligns AMM prices with the wider market is beneficial. Initiatives such as Flashbots emerged to move this ordering competition out of the public mempool into a private auction, reducing some of the network-clogging side effects.

Main risk: for an ordinary user, MEV is a hidden tax on transparent trades. A large swap sent through a public mempool with loose slippage settings invites sandwiching, so the executed price can be materially worse than the quote. The defences are practical — tight slippage limits and, where available, private transaction routing — rather than anything the base protocol can guarantee.

The risk stack in DeFi

The ten mechanisms above fail in recurring ways. It helps to think of DeFi risk as a stack of independent layers, any one of which can cause total loss regardless of how sound the others are. A protocol can have flawless economics and still be drained through a contract bug; a contract can be perfect and still be emptied through a manipulated oracle or a compromised bridge.

Contract risk is the risk that the code does something other than intended — a re-entrancy bug, an arithmetic error, an access-control mistake, or a flawed upgrade. Code on a public chain is immutable once deployed unless an upgrade path exists, and that upgrade path is itself an attack surface, as the Nomad initialisation error showed. Because contracts are composable, a bug in one can propagate into every protocol that integrates it.

Oracle risk is the risk that a protocol acts on a false price. As Mango Markets illustrated, this does not require breaking any code; it requires only that a contract trust a value an attacker can move. Lending markets, derivatives, and algorithmic stablecoins are all oracle-dependent, and a manipulated feed can trigger unjust liquidations or let an attacker borrow far more than their collateral is worth.

Bridge risk is the risk in cross-chain infrastructure. Bridges pool large balances behind a single trust assumption and have suffered some of the largest losses in the sector's history — Ronin, Wormhole, and Nomad among them. Holding a wrapped, bridged asset also means holding a claim that is only as good as the bridge backing it.

Approval risk is the risk most likely to affect an individual user directly, and it is entirely separate from any protocol bug. To trade or supply tokens, you grant a contract an allowance to move them — often, for convenience, an unlimited allowance. That approval persists after the transaction and after you stop using the site. If the approved contract is malicious or is later compromised, it can drain the approved tokens at any time without a further prompt. This is a leading cause of individual losses, and it is defended by reviewing what you sign and revoking allowances you no longer need; see how to revoke token approvals.

Depeg risk is the risk that an asset assumed to be worth a fixed amount is not. When a stablecoin loses its peg, as USDC briefly did in 2023 and UST did permanently in 2022, the effect ripples through every pool, loan, and strategy that priced it at par. A position that looked balanced can become badly lopsided the instant the market stops believing a token is worth a dollar.

These layers are cumulative, not alternatives. Evaluating a DeFi position means asking, at each layer, what single failure would cause total loss — and accepting that the answer is rarely "nothing."

What audits do and don't prove

A smart-contract audit is a manual and tool-assisted review of a protocol's code by security specialists, who report the vulnerabilities they find so the team can fix them before or after deployment. Reputable firms such as OpenZeppelin and Trail of Bits have reviewed much of the code the sector depends on, and a serious audit meaningfully reduces the chance that a known class of bug — re-entrancy, integer overflow, broken access control — survives into production. An unaudited contract handling real value should be treated with corresponding suspicion.

But an audit is a point-in-time reduction of probability, not a proof of safety. It examines a specific version of the code; a later upgrade can reintroduce risk, exactly as Nomad's post-deployment change did. It cannot rule out economic attacks that break no code at all — the Mango Markets oracle manipulation and the Beanstalk governance takeover were both executed against contracts working as written. Novel vulnerability classes, flawed assumptions about how external protocols behave, and the emergent behaviour of composable systems are all hard for any single review to capture. Auditors themselves are explicit that a review reduces risk rather than eliminating it, and history is full of audited protocols that were later exploited.

A few practical implications follow. Ask who performed the audit and whether the firm is independent and credible; a logo is not a report. Check what version was reviewed and whether the deployed code matches it. Read the findings — an audit that lists serious issues the team then fixed is more reassuring than a vague clean bill. And treat the presence of an audit as one input among many, alongside the age of the code, the value it has safely held over time, the transparency of the team, and the layered risks above. Our companion article, what smart-contract audits prove, expands on how to read one. The honest summary is that an audit narrows the odds; it never removes them, and in DeFi the code is doing the job an institution once did, with none of the recourse if it fails.

Sources

• Uniswap Developer Docs — How Uniswap Works (constant-product formula and 0.30% fee)
• Michael Egorov — StableSwap: efficient mechanism for stablecoin liquidity (Curve whitepaper)
• Aave — Health Factor and Liquidations
• Aave V3 Protocol Documentation — Overview
• ethereum.org — Ethereum staking
• ethereum.org — Proof-of-stake rewards and penalties (slashing, correlation penalty)
• ethereum.org — Maximal extractable value (MEV)
• Chainlink Education Hub — Flash loans and oracle manipulation resistance
• Circle — $3.3 billion of USDC reserve risk removed, dollar de-peg closes (March 2023)
• CoinDesk — Axie Infinity's Ronin Network suffers $625M exploit
• Halborn — Explained: The Ronin Hack (March 2022)
• Halborn — Explained: The Wormhole Hack (February 2022)
• Immunefi — Hack Analysis: Nomad Bridge (August 2022)
• Coinbase — Nomad Bridge incident analysis
• Federal Reserve Bank of Richmond — Why Stablecoins Fail: An Economist's Post-Mortem on Terra
• Immunefi — Hack Analysis: Beanstalk Governance Attack (April 2022)
• CFTC — Charges in the Mango Markets oracle manipulation scheme (October 2022)
• OpenZeppelin — Smart Contract Security Audits