DeFi Product Risk Assessment Methodology

The reputation of the team behind a blockchain, protocol or token is a key indicator of its reliability. A reputable team usually has a proven track record of developing successful projects and implementing innovative and secure solutions. The team's transparency, industry expertise, and commitment to the community are important factors that reinforce the trust of users and investors.

Conversely, if the team has a poor or bad reputation, either due to a lack of transparency or past problems, this may raise doubts about the safety and stability of the project. Assessing the reputation of the team is essential to reduce the risk of getting involved in unreliable or poorly managed projects.

Significant partnerships of an organization managing a blockchain, protocol or token are an indicator of its strength and credibility. Collaborating with other companies, financial institutions, security auditors or industry leaders can strengthen the project and increase the confidence of users and investors. These partnerships can bring additional expertise, resources and support, which contributes to the growth and stability of the project.

On the other hand, a lack of relevant partnerships or collaboration with disreputable entities can create uncertainty about the viability and security of the project. Assessing an organization's strategic partnerships helps to understand the level of external support that supports the development and success of the project.

The time that has passed since the launch of an organization is an important factor in assessing its experience and strength in the market. An organization that has been in operation for years has had more time to demonstrate its capacity for development, adaptation and risk management. The longer it has been operational, the more likely it has overcome significant challenges and gained the trust of its community.

On the other hand, newer organizations may offer innovation, but they also carry greater uncertainty. Lacking an extensive track record, it is more difficult to assess how they will manage future problems or whether they will be able to sustain success over the long term.

An organization's social media activity is a good indicator of its engagement with the community and its level of transparency. Social media allows organizations to communicate directly with users, share updates, respond to questions and address concerns quickly and effectively. An active presence also suggests that the team is available and interested in keeping its community informed.

On the other hand, an organization that is not present or is not very active in social networks may generate doubts about its transparency and ability to engage with users. Lack of communication can be interpreted as a lack of interest in building relationships with the community or the project in general.

The number of social media followers is a key indicator in the context of blockchains, tokens and protocols, as it reflects the level of interest and engagement of the community. A large number of followers can demonstrate that the project has succeeded in generating enthusiasm and support, which is crucial to ensure wider adoption. In the world of blockchains and tokens, where trust in the community is critical, a high number of active followers can be a sign that the project is well supported and has potential for growth.

In addition, in decentralized or governance projects, having a large community can directly influence the success of the protocol. An active community can participate in voting, provide liquidity or promote token adoption. Therefore, the number of followers and their engagement are valuable indicators to assess the sustainability and relevance of a project in the crypto ecosystem.

The TVL (Total Value Locked) of a blockchain represents the total value of assets locked within its various protocols and decentralized applications. A high TVL indicates that there is a large amount of trusted value in the blockchain, which is generally a sign of adoption, trust and stability. Blockchains with a high TVL tend to attract more developers and users, which strengthens their ecosystem.

Conversely, a blockchain with a low TVL may reflect lower adoption or trust in the network, making it more vulnerable to market fluctuations or attacks. TVL is a good indicator to assess the strength and interest a blockchain has compared to others in the crypto ecosystem.

The number of validators providing security to a blockchain is crucial to assess its level of decentralization and resistance to attacks. The more validators there are, the more difficult it is for a malicious actor to take control of the network, which increases the overall security of the blockchain. A high number of validators also suggests greater user participation and trust in the network.

Conversely, if the number of validators is low, the blockchain becomes more vulnerable to attacks, such as the 51% attack, where a single group can take control of the majority of the network. A limited number of validators can also mean that the network is more centralized, which reduces transparency and trust in the security of the blockchain.

The number of validators that control 51% or more of a blockchain's tokens is a key factor in assessing its security and decentralization. If only a few validators have control of the majority of tokens, this means that the network is vulnerable to a 51% attack, where those validators could manipulate the blockchain, perform fraudulent transactions or rewrite parts of the blockchain's history.

On the other hand, if tokens are distributed among a large number of validators, the network is more secure and tamper-resistant, as it would be much more difficult for a single group to control the majority of tokens. Greater decentralization in the control of tokens strengthens security and trust in the blockchain.

Cooldown and Warm-up periods for validators are important mechanisms that affect the security and stability of the blockchain. The Cooldown is the period in which a validator, after withdrawing their participation, must wait before they can withdraw their rewards or funds. This period helps protect the network from validators who try to rush in and out to profit without taking long-term risks.

Warm-up, on the other hand, is the time a new validator must wait before starting to validate transactions. This period guarantees that only committed and trusted validators can participate in the security of the network. Both mechanisms ensure that the network is not vulnerable to sudden attacks or manipulations by untrusted validators.

Rollups are scalable solutions that allow transactions to be processed outside the main chain more quickly and economically. However, they present some specific risks. One of the main risks is the technical complexity in their implementation. Rollups use mechanisms such as validity testing or fraud testing to ensure the security of off-chain transactions. If these mechanisms are not well implemented, they could compromise the security of the platform.

Another risk is centralization. Some rollups rely on a limited number of validators or sequencers to process transactions. This can generate risks of excessive control by a few players, which can affect the decentralization and security of the system.

For this criterion, we based our scoring on the risk analysis performed by the security research firm specializing in rollups L2 Beat.

When a blockchain stops, it can be a worrying sign about its stability and reliability. Outages in a blockchain can occur due to technical failures, attacks, or consensus issues, and can negatively affect the confidence of users and developers. A halt can lead to the freezing of transactions, temporary loss of funds, or even manipulation of data.

If a blockchain has experienced outages in the past, it is important to investigate how those incidents were handled. A quick response and implementation of improvements after an outage can mitigate the impact on trust. However, if outages are frequent or not addressed effectively, the blockchain may be viewed as unstable and unsecure.

Total Value Locked (TVL) measures the total amount of money or assets locked in a DeFi protocol. It is an indicator of users' popularity and trust in the platform, as a high TVL usually means that many people trust their funds to it, which can be a sign of stability and security.

LTV gives an idea of the size of the platform and its adoption in the market. A low LTV may indicate that the platform is new or less trusted, but it may also represent opportunities, such as fewer competitors for returns.

If a platform has suffered from any controversy, this can affect user confidence and the platform's reputation. Controversies may include security issues, mismanagement of funds or conflicts in the community, which could make users hesitant to entrust their assets to the protocol.

The dispute history gives an idea of the transparency and robustness of the project. A platform with serious or frequent disputes may indicate underlying problems, while one without disputes or with resolved issues may generate more trust among users.

When the utility of a platform depends on the price of its token, this means that the value of the token directly influences how users interact with the platform. If the token loses value, the incentives to use the platform could decrease, which can negatively affect its adoption and usage.

On the other hand, a platform that does not depend on the price of its token has greater stability in terms of its functionality. This means that regardless of token volatility, users can continue to use its services without worrying about price fluctuations.

Knowing whether the current version of a platform has been audited is crucial to assessing its security. An audit implies that security experts have reviewed the code to detect possible vulnerabilities or bugs. If a platform has been audited, it increases the confidence of users, as it has been proven that it works securely and follows good development practices.

If it has not been audited, the risks increase, as there could be undetected failures that compromise users' funds or the stability of the platform. Audits are a key tool to protect users and strengthen the platform's reputation.

A Bug Bounty is a program that rewards those who find and report vulnerabilities in the platform. The existence of a Bug Bounty demonstrates the platform's commitment to security, as it encourages external experts to identify problems before they can be exploited.

If a platform offers high rewards for critical bugs, it is more likely to attract more researchers to review its code, which reduces the risk of attacks or serious bugs. Conversely, the absence of a Bug Bounty could indicate that the platform is not prioritizing proactive vulnerability detection.

If a platform has been hacked, it is a warning sign that could affect user confidence. A hack can mean the loss of funds, data or the interruption of services, which severely impacts the platform's reputation and security. In addition, it could be a sign that the team is not taking the necessary security measures, indicating deficiencies in its ability to protect users. However, it is also important to assess how the platform responded to the hack, whether security improvements were implemented and whether users were compensated.

A platform that has never been hacked offers a greater sense of security, although it does not guarantee that it is risk-free. What is crucial is to look at how security is managed and what preventive measures have been taken to protect users.

The time that has passed since the release of the latest version of a platform can also be a sign of robustness. If a version has been around for a long time without needing major updates, it is likely that it has already withstood several attack attempts by malicious actors. This may indicate that the platform is more secure, as any serious vulnerabilities would likely have been discovered and exploited.

Conversely, newer versions may be less tested against attacks, increasing the risk that undiscovered vulnerabilities still exist. A platform with older, stable versions builds confidence, as it has proven to be resilient over time.

If the latest version of a platform has been hacked, it is a sign that there may be serious vulnerabilities that the developers have not addressed effectively. A recent hack indicates that malicious actors have found and exploited flaws in the system, which can lead to distrust in the security of the platform.

On the other hand, if the latest version has not been hacked, especially after being in operation for a significant time, this reinforces confidence in its security. The longer a version withstands attacks without being compromised, the more likely it is to be stable and secure.

Up-to-date documentation is essential for users and developers to understand how a platform works and how to interact with it securely and efficiently. Documentation that is kept up to date reflects that the team is committed to transparency and accessibility, which facilitates troubleshooting and correct use of the platform.

If the documentation is not up to date, it can cause confusion, make it difficult to implement new functionalities or lead users to make mistakes when interacting with the platform. In addition, it may be an indication that the team is not paying the necessary attention to the maintenance and continuous improvement of the platform.

Oracles are services that provide external data to the blockchain, such as asset prices, market information or real-world events. If a platform relies on oracles, its performance is tied to the accuracy and security of that external data. Oracles are essential for platforms that need data outside the blockchain to reliably execute smart contracts.

However, this reliance also introduces risks. If an oracle provides incorrect information or is compromised by malicious actors, the platform could make wrong decisions or suffer financial losses. Therefore, it is important that a platform that relies on oracles uses several reliable and secure oracles.

If a platform's smart contracts are upgradeable, it means that they can be modified after they have been implemented on the blockchain. This can be an advantage, as it allows bugs to be fixed, new functions to be added or to adapt to changes in market conditions without the need to create a new contract from scratch.

However, this flexibility also carries certain risks. Upgradeable contracts can be exploited if upgrades are not managed properly or if control of upgrades is centralized in the hands of a few. A platform that enables upgrades must have transparent processes, such as DAO voting or multiple signatures, to ensure that changes are safe and in the best interest of the community.

Pauseable smart contracts allow platform administrators to temporarily halt platform operation in the event of an emergency, such as a security vulnerability or unexpected behavior. This can be very useful to prevent further damage while the problem is investigated and fixed, thus protecting users' funds and the integrity of the system.

However, the ability to pause a contract also introduces an element of centralized control, which could be seen as a risk by some users. It is important that platforms using pausable contracts have transparent processes and clear security measures on who can pause contracts and under what conditions.

Timelocks in smart contracts add an additional layer of security by introducing a time delay before changes or updates to the contract can be executed. This allows users and the community to audit and review proposed changes before they go into effect, reducing the risk of malicious changes or sudden errors.

The use of timelocks benefits users by providing more transparency and control, as it allows time to react in case an update or action appears suspicious. If a platform uses timelocks in its smart contracts, it demonstrates a commitment to security and the protection of users' funds.

The quality of smart contract code is essential to ensure the security and proper functioning of a platform. Well-written, clean and thoroughly tested code reduces the risk of bugs or vulnerabilities that can be exploited by malicious actors. In addition, the presence of unit tests and independent audits indicates that the development team is committed to quality and security.

Poorly structured code, without testing or with unused functions, can be an indication of development problems and a sign of potential future risks. Transparency in code review and following good development practices are key to ensuring that smart contracts work securely and efficiently.

The market capitalization of a token is the total value of all tokens in circulation, calculated by multiplying the current price of the token by the total amount issued. This indicator is key to understanding the size and relevance of a token in the market. A token with a high market capitalization is usually more stable, as it implies that there is more liquidity and less volatility in its price.

On the other hand, a token with a low market capitalization may be more volatile and susceptible to manipulation, posing a greater risk to investors and users who participate in liquidity pools or use the token in other functions within the platform.

The intrinsic value of a token refers to whether the token has an actual use or backing beyond speculation on its price. A token with intrinsic value is usually linked to a utility within the platform, such as payment of commissions, governance, participation in liquidity pools, or some underlying asset. This gives it greater stability, since its value does not depend solely on speculative demand, but on its functionality within the ecosystem.

On the other hand, if a token has no intrinsic value, its price is mainly driven by market speculation. This makes it more vulnerable to volatility, as investors can quickly lose interest if the price drops, creating greater risk for those using it or storing it in liquidity pools.

Inflation of a token refers to the amount of new tokens that are issued over time. If a token is undergoing a lot of inflation, it means that new tokens are constantly being created, which can dilute the value of existing tokens. This is a risk for investors, as an increase in supply without a commensurate growth in demand can lead to a drop in the price of the token.

A token with high inflation can lose value quickly if there is insufficient incentive to keep its price stable. On the other hand, if inflation is controlled or low, the value of the token is more likely to remain stable, which generates greater confidence among users and investors.

A token is reflective when its price directly influences its use within the platform, creating a cycle that reinforces both price and adoption. If the price of the token goes up, more users and investors are attracted, which drives demand and causes the price to continue to rise. Conversely, if the price goes down, users may lose interest, leading to lower demand and, in turn, an even greater drop in price.

This type of behavior can be beneficial when the value of the token is rising, but it is also risky because it can generate high volatility. Reflective tokens rely heavily on speculation and are more vulnerable to sudden changes in the market.

A stablecoin is designed to maintain a stable value, usually linked to an underlying asset such as the US dollar. When a stablecoin decouples from its reference value, it means that its price fluctuates outside of its intended range, which can create uncertainty among users. If a stablecoin frequently delinks, this indicates that it is not adequately meeting its stability objective, which represents a significant risk for those who use it to hedge against market volatility.

A stablecoin that becomes unlinked may be suffering from backing or market confidence issues. In these cases, users may lose confidence in the currency and seek more stable alternatives, which could negatively affect projects that rely on that stablecoin.

A DeFi product has market risk when the price of one or more of the tokens on which it is based can fluctuate freely in public markets.

A decrease in the price of any of the tokens in the pool could negatively affect the value of your position.

Impermanent Loss risk refers to the risk that, by the mechanisms of some products, specifically Automated Market Makers, an investment in the product will be worth less than an equivalent investment in the tokens on which the product is based.

We explain it in more depth in the following articles:

• Liquidity pools: a complete guide
• What is impermanent loss?

The risk of slashing applies to products with a staking component (the fact of locking tokens as collateral by validators, the entities that verify and record transactions on blockchains _Proof Of Stake_).

Slashing_ _is a penalty applied to validators who act in a malicious or negligent manner, such as signing contradictory blocks or not participating in validation.

This mechanism reduces or confiscates the tokens they have in staking, incentivizing correct behavior and protecting the integrity of the network.

As an investor in a product with derivative risk, you could lose part of your position.

Products that use leverage to generate returns are exposed to liquidation risk.

A liquidation occurs when the value of a leveraged position falls below the value tolerated by the lenders granting the leverage.

In this case, the position is automatically sold and all or part of the recovered capital is granted to the lenders.

As an investor in a product with leverage risk, you could lose all or part of your position.

Products using derivatives such as options or structured products may be exposed to the risk of unrecoverable capital losses depending on market variations.

As an investor in a product with derivative risk, you could lose all or part of your position.

Products exposed to insurance risk could lose all or part of their capital if they have to make one or more payments to cover incidents related to the assets they insure.

As an investor in a product with insurance risk, you could lose all or part of your position.