RiskIntermediate6 min
Smart-Contract Risk
Core question
Does an audit make a protocol safe?
Every DeFi protocol depends on its code. Bugs, security holes, or oracle manipulation can lead to losses — regardless of how established a protocol looks. An audit reduces that risk, since independent reviewers examine the code, but it doesn't eliminate it. “No known exploit” also doesn't mean “guaranteed safe” — only that no vulnerability has been found or used yet.
An audit lowers the risk — it doesn't remove it entirely. No known exploit only means none has been found yet.
Look up in the Glossary: Smart Contract Risk →What your deposit stands on
Each layer is a separate part that can fail – and then nothing above it holds.
- Your deposit sits in the contract, not in an account of yours.
- Protocol – team, governance and parameters that can be changed.
- Smart contract – the code that holds your money. A bug in it affects every deposit.
- Oracle – supplies prices. A wrong price can trigger liquidations.
- Bridge – only for bridged assets: the token is a counterpart to value on another chain.
- Chain – the foundation. If it halts, everything above it halts.
Schema, not market data. An audit mainly checks layer 3 – the other layers remain risks of their own.
Protocol track record side by side
Example: established protocol
STETH · Lido
2.22%
APY
TVL: $26.43B
- TVL at least 50M USD
- Chain Ethereum is on the SKN3X reference list of established chains
- Not a stablecoin, single exposure, no IL risk per DeFiLlama
- Rewards below 20% of APY
- Protocol lido is on the SKN3X reference list (allowlist)
Example: not on the allowlist
ETH · Justlend V1
0.00%
APY
TVL: $1.31B
- TVL at least 50M USD
- Chain Tron is not on the SKN3X reference list of established chains
- Not a stablecoin, single exposure, no IL risk per DeFiLlama
- Rewards below 20% of APY
- Protocol justlend-v1 is not on the SKN3X reference list (allowlist) — this says nothing about its track record