DeFi Basics and Risks

Decentralised finance rebuilds familiar financial services — trading, lending, earning a yield — as programs running on a public blockchain instead of inside a company. Anyone with a wallet can use them, at any hour, without permission or an account.

That openness is genuinely remarkable, and it comes with a bill. Removing the intermediary also removes everything the intermediary quietly provided: reversals, dispute handling, compensation schemes, someone to ring. This lesson explains the building blocks briefly, then spends most of its length on the risks, because for DeFi the risks are the main subject rather than a closing disclaimer.

What the building blocks actually are

Nearly everything is assembled from a small number of pieces. Decentralised exchanges let people swap tokens against a shared liquidity pool rather than an order book, with a formula setting the price as the pool's balance shifts. Lending markets let holders deposit assets that borrowers take against over-collateralised positions, with rates moving according to how much of the pool is in use.

Stablecoins supply the unit of account that makes any of this usable, and yield strategies stack these pieces together. Each layer is a smart contract: code that executes exactly as written, including when what is written is wrong.

Token approvals: how wallets are quietly emptied

This is the risk most newcomers never see coming, so it comes first. To let a contract move your tokens, you grant it an allowance. Many interfaces request an unlimited allowance by default, because it saves you approving again later.

That approval persists. It does not expire when you close the tab, and it survives long after you stop using the application. If the contract is malicious, or is later compromised, or was never what it claimed to be, that standing permission is all an attacker needs to move your balance whenever they choose — sometimes months afterwards. Nothing further is required from you.

The defences are unglamorous and effective: read what a signature request actually authorises rather than clicking through it, prefer limited approvals over unlimited ones, review and revoke permissions you no longer use, and keep experimental activity in a separate wallet from long-term holdings. Fake sites weaponise exactly this mechanism, which is why the walkthrough in how to spot crypto scams is required reading before you connect a wallet anywhere, alongside the scams lesson.

Smart contract risk is not theoretical

Code holding large balances is a permanent target. Bugs in logic, flawed assumptions about how components interact, and mistakes in upgrade permissions have all led to funds being drained from protocols. An audit reduces this risk; it does not remove it, and audits have preceded losses.

Composability multiplies the exposure. Because protocols build on each other freely, a failure in one can cascade into several that depended on it. You may be exposed to code you never chose to interact with. Ask also who can change the contract: if a small group holds an upgrade key, you are trusting people again, just less visibly than at a bank.

Market and design risks

• Impermanent loss. Supplying two assets to a pool can leave you worse off than simply holding them, because the pool automatically sells the strengthening asset for the weakening one. Fees may or may not cover the gap.
• Liquidation. Collateralised borrowing is unforgiving. A sharp move can close your position automatically, at a bad moment, with a penalty attached.
• Oracle failure. Contracts learn outside prices from oracles. A manipulated or stale feed can trigger liquidations or mispriced trades that are entirely valid as far as the code is concerned.
• Peg failure. A stablecoin is a promise with a mechanism behind it, and mechanisms break. See stablecoins and their risks.
• Yield that is really emissions. Rewards paid in a newly issued token depend entirely on that token holding value.

If you go ahead anyway

Assume everything you deposit could be lost, and size accordingly. Start with an amount whose complete loss would be annoying rather than damaging. Use a wallet separate from your main holdings, understand where the yield genuinely comes from before chasing it, and remember that transaction fees on a busy network can make small positions uneconomic before any strategy has a chance.

There is no deposit protection here, no regulator to complain to, and no reversal. That is not a reason to avoid DeFi outright, but it is the honest frame for every decision inside it. Nothing on CoinCrafty is financial advice.