Before depositing into any DeFi protocol: verify the contract is audited, check TVL and time live without incident, review your token approvals (set specific amounts not unlimited), confirm you are on the correct URL (bookmark it), check the protocol on DefiLlama for legitimacy, and never deposit more than you can afford to lose in a single protocol.
DeFi Security Checklist Before Depositing
4 min read
The short version
DeFi gives you higher yields but zero customer support if things go wrong. This checklist takes 5 minutes before each new protocol interaction and has a single purpose: catch the obvious red flags that result in 100% loss. Every item here corresponds to a real exploit or scam that has cost someone real money.
How It Works
The pre-deposit checklist. Step 1: Verify you are on the correct URL. Bookmark official protocol URLs (from their official Twitter/GitHub, not from Google ads). Phishing sites clone DeFi frontends pixel-for-pixel. One wrong character in the URL and you are signing a drainer. Step 2: Check audit status. Has the protocol been audited by a reputable firm (Trail of Bits, OpenZeppelin, Spearbit, Cyfrin)? Check the protocol docs or GitHub for published audit reports. Unaudited = higher risk. Audited still carries risk (audits miss things) but it is the minimum bar. Step 3: Check TVL and age. How much is already deposited (higher TVL = more eyes on it)? How long has it been live without a security incident? New protocols with <$10M TVL and <3 months live carry significantly higher risk than established ones with $100M+ TVL and 2+ years without incident. Use DefiLlama to verify. Step 4: Set specific approval amounts. When the protocol asks you to approve spending your tokens, do not approve unlimited. Approve only the exact amount you are depositing. If the contract is later exploited, unlimited approvals let the attacker drain your entire token balance. Specific approvals limit exposure to the approved amount. Step 5: Check holder/admin concentration. Does one address control the protocol (upgradeable proxy with single-owner admin)? Can the team drain the treasury with one transaction? Protocols with timelocked multisig admin (3-of-5 minimum) are safer than single-key admin controls. Step 6: Understand the exit path. How do you withdraw? Is there a lockup period? Can withdrawals be paused by the team? Know your exit before you enter. If the protocol can pause withdrawals and has single-key admin, your funds can be trapped. Step 7: Size your position. Never put more than 10-20% of your portfolio in a single DeFi protocol. Spread across multiple audited protocols to limit the damage from any single exploit.
Running the checklist on a new yield protocol
You find YieldMax offering 12% on USDC. Before depositing $5,000: (1) URL check: go to their official Twitter, click the link in bio. Matches what you see. Bookmark it. (2) Audit: they link to a Cyfrin audit from 3 months ago covering their vault contracts. Good. (3) TVL: $45M on DefiLlama, live for 8 months without incident. Moderate. (4) Approval: MetaMask asks to approve USDC spending. You change unlimited to 5000 (the exact deposit amount). (5) Admin: docs say protocol is controlled by a 4-of-7 multisig with 48-hour timelock. Good structure. (6) Exit: withdrawals are instant, no lockup, no pause function in the contract. Good. (7) Position size: $5K is 10% of your $50K portfolio. Acceptable risk. All checks pass. You deposit. If check 2 or 3 had failed (no audit, brand new, tiny TVL), you would have walked away regardless of the APY advertised.
What People Get Wrong
Audited protocols are safe
Audits reduce risk but do not eliminate it. Euler Finance was audited and still lost $197M. Auditors check for known patterns; novel attacks or complex cross-protocol interactions can be missed. An audit is necessary but not sufficient. Treat it as passed the minimum bar not guaranteed safe.
High TVL means the protocol is trustworthy
TVL shows that others have deposited money. It does not mean they analyzed the risks carefully. Many high-TVL protocols have been exploited (Wormhole: $320M TVL before hack). TVL is one signal among many, not a safety guarantee. It is useful because higher TVL attracts more security researchers (larger bug bounties), but it does not make the code inherently safer.
If I use a hardware wallet, I am protected from DeFi exploits
A hardware wallet protects your private key from extraction. It does NOT protect against: malicious approvals you sign on the device (you approved the drainer yourself), smart contract exploits that drain the protocol funds you deposited, and oracle manipulation that liquidates your positions. DeFi risk is protocol risk, not key risk.
Keep Reading
Sources & Further Reading
- DefiLlama
Verify protocol TVL, age, and chain deployment
- Revoke.cash
Audit and revoke your existing token approvals
- DeFi Safety
Independent security scoring for DeFi protocols
Questions People Also Ask
- How often should I run this checklist?
- Every time you interact with a new protocol for the first time. For protocols you already use and trust, you do not need to re-verify daily. But re-check after any major upgrade announcement (upgrades can introduce new vulnerabilities) or if you see unusual community concerns.
- What is the single most important step?
- Step 4: limiting approval amounts. If you set unlimited approvals on 20 protocols and one gets exploited, the attacker can drain your ENTIRE token balance through that one compromised approval. Limited approvals cap your maximum loss at what you actually deposited. This single habit prevents the worst-case drainer scenario.
- Should I avoid DeFi entirely if this seems complicated?
- If the checklist feels overwhelming, start with the most established protocols only (Aave, Uniswap, Lido, MakerDAO). These have billions in TVL, years of track record, and multiple audits. The checklist matters most for newer or smaller protocols. Sticking to blue-chip DeFi with limited approvals is reasonably safe for most users.