How to Determine if a DeFi Protocol is Safe Using On-chain Data

Conclusion: To assess whether a DeFi protocol is safe, you cannot trust the project team's one-sided promotions or solely rely on Total Value Locked (TVL). You must personally verify three core dimensions — the quality of audit reports, the control of fund permissions, and real-time on-chain data. Missing any of these means depositing your money is gambling.

Step 1: Check Audit Reports — Don't Just Look at Whether There Is One, See Who Did It and What the Results Are

Almost every DeFi project claims to have "passed a security audit," but this statement alone has limited reference value. In 2024, Aave suffered a $230 million loss due to an rsETH bridge vulnerability, even though Aave is a top-tier audited protocol.

What to do:

1. Find the original audit report (usually linked on the project's "Security" page or in the docs).

2. Confirm the auditor is an independent third-party firm, such as SlowMist, PeckShield, CertiK, or BlockSec.

3. Check the severity classification in the report — if there are unresolved "Critical" or "High" vulnerabilities, skip it immediately.

4. The minimum standard is cross-auditing by two independent firms, not a single report from one agency.

SlowMist's DeFi security audit checklist covers reentrancy attacks, flash loan attacks, access control, excessive permissions, and other key risk points. If the audit scope does not include these, it indicates insufficient depth.

What constitutes completion: You have found at least one audit report and confirmed there are no unpatched critical or high vulnerabilities.

Step 2: Check Fund Permissions — Who Controls Your Money

Even if the code is well-written, the protocol remains unsafe if control of funds is in the hands of a few, or if there are unrestricted withdrawal permissions.

What to do:

1. Review the protocol's multisig wallet configuration — all admin functions should require multi-signature approval, and no single key should be able to drain the protocol's funds.

2. Check whether signers use hardware wallets to store private keys — if the team uses software wallets for multisig keys, the risk is extremely high.

3. Confirm whether critical operations have a timelock — sensitive operations should have a 24-48 hour delay, giving the community time to detect malicious changes.

A useful reference metric: Safe (formerly Gnosis Safe) is currently the most widely adopted smart account protocol, with a cross-chain TVL exceeding $94 billion, accounting for 99% of the total smart account ecosystem TVL. If a protocol does not use a similar secure custody solution but controls funds itself, extra caution is warranted.

What constitutes completion: Confirmed the protocol uses a multisig wallet to manage funds and core operations are restricted by a timelock.

Step 3: Check On-chain Real-time Data — Be Alert to Anomaly Monitoring

The security of a protocol is not static — post-deployment behavioral monitoring is equally important.

What to do:

1. Check whether the project has deployed an on-chain monitoring system that sets alerts for large transfers, admin function calls, and abnormal transaction patterns.

2. Confirm whether there is a 24/7 on-call response team — "alerts are only useful if someone can take immediate action."

In Q2 2026, nearly 70 protocols suffered attacks, losing approximately $746 million, and the frequency of incidents is more concerning than the scale of individual losses. If a protocol lacks even basic monitoring, no one will respond when an incident occurs, making fund security an empty promise.

What constitutes completion: Confirmed the project has a public monitoring solution or is integrated with security monitoring platforms such as Forta or Hypernative.

Step 4: Check the Rigor of Approval Management — The Most Easily Overlooked Risk

Many users sign "unlimited approvals" (approve with unlimited amount) before depositing money. If the approved spender is malicious, the attacker can steal the assets months later.

Historical case: A user signed a malicious ERC-20 approval transaction in April 2024. The attacker waited 458 days until the wallet received $908,551 USDC and drained it all at once.

What to do:

1. Use Revoke.cash or Etherscan's Token Approval Checker to view all your approval records.

2. Regularly revoke approvals that are no longer in use or have been active for more than 3 months.

3. Be wary of protocols that require unlimited approvals — unless you fully trust the project, try to approve specific amounts.

What constitutes completion: You have checked your wallet's approval list at least once and cleared unused approvals.

Judgment Priority Summary

Risk Reminders

• High TVL does not equal security: Large locked amounts can actually become prime targets for hackers, not proof of safety.

• Audits are just the beginning, not the end: Post-launch composability risks, cross-chain risks, and oracle manipulation risks cannot be fully covered by static audits.

• DeFi lending protocols have significant design differences: Aave, as a collateralized lending protocol, has a net interest margin of only about 0.98%, and it bears liquidation risk rather than credit risk. Do not confuse such protocols with unsecured lending.

Next step: Pick a DeFi protocol you intend to use and check it item by item from Step 1 to Step 3. Record the name of the auditor, the multisig address configuration, and the monitoring solution — being able to answer these three questions means you know more than 90% of users about who you're dealing with. If you can't find a link to the audit report on the project's official website, treat it as a red flag immediately.