How DeFi actually works, and the specific ways it breaks

Decentralised finance is a set of programs that perform the functions of financial intermediaries — lending, exchanging, issuing — without one. The programs are public, anyone can call them, and once deployed they usually cannot be stopped. Understanding what that buys and what it costs requires looking at how the main pieces actually operate.

Swapping without an order book

A traditional exchange matches buyers with sellers. Most DeFi exchanges do not match anyone. They hold pools of two assets and price trades by a formula.

The common design keeps the product of the two balances constant. If a pool holds a hundred of asset A and a hundred of asset B, removing ten A requires adding enough B to keep the product unchanged — which means the price moves against you as your trade grows. Buying ten units from a hundred-unit pool moves the price roughly eleven percent. That is not a fee and not slippage in the order-book sense; it is the mechanism working as designed, and it is why large trades on thin pools are expensive.

Pools exist because liquidity providers deposit both assets and earn a share of trading fees. Their risk has a badly chosen name. When the relative price of the two assets diverges, the pool automatically sells the appreciating one, so the provider ends up with less of the winner than if they had simply held. It is called impermanent loss, but it is only impermanent if prices return to their original ratio. On withdrawal it is realised and entirely permanent.

Lending against collateral, and only against collateral

DeFi lending has no credit assessment, because there is no identity and no recourse. Every loan is over-collateralised: you deposit more value than you borrow, and if the collateral falls far enough, anyone can trigger a liquidation that sells it to repay the debt.

Liquidation is performed by third parties who are paid a bonus for doing it, which is what makes the system self-sustaining without a collections department. It is also why liquidations cluster. A falling price pushes many positions past their threshold simultaneously; liquidators sell the collateral; those sales push the price lower; more positions become liquidatable. The cascade is a structural property of the design, not a malfunction, and it is why leverage in DeFi behaves worse in a sharp move than the headline ratio suggests.

The oracle problem

A contract deciding whether to liquidate needs a price, and a blockchain has no native knowledge of prices. That figure comes from an oracle — a service that reports external data on-chain.

This is the most under-appreciated dependency in DeFi. A protocol is only as sound as its price feed, and manipulating the feed can be cheaper than attacking the protocol. If a contract reads the price from a single thin pool, an attacker can move that pool, borrow against a briefly false valuation, and leave with the difference. Robust protocols use time-weighted averages, multiple independent sources, and sanity bounds. Weak ones read one number and trust it. The difference is invisible in the interface and decisive in a crisis.

Composability, and why failures spread

DeFi protocols are designed to be used by other protocols. A yield product may deposit into a lending market that accepts a token representing a stake in a third system. Each layer works; each layer adds a dependency.

The consequence is that a failure in an obscure component can propagate into products whose users had never heard of it. Assessing a DeFi position therefore means assessing everything it depends on, and that dependency graph is rarely disclosed in full. “Composability” and “systemic risk” describe the same property from opposite directions.

Code does what it says, not what was meant

An audit reduces risk; it does not remove it. Contracts holding very large sums have failed years after deployment, sometimes through a subtle interaction between two individually correct components.

Two related risks sit beside the code itself. Most protocols retain privileged functions — pausing, upgrading, adjusting parameters — and whoever holds those keys can change the rules under you. And governance tokens mean rules can be voted into place; where voting power is concentrated, “decentralised governance” can amount to a small group with formal process attached.

Then there is the approval mechanic. Interacting with a contract usually means granting it permission to move a token on your behalf, and those permissions are frequently unlimited and permanent unless revoked. A contract approved months ago can drain that token later. Reviewing what you sign, granting limited allowances, and periodically revoking unused approvals are the practical defences — and none of them is provided by default.

What DeFi genuinely removes

It is worth stating the upside precisely, because the risks above are easier to enumerate than the benefits. DeFi removes discretion. A lending market cannot decide it dislikes you, cannot freeze a position because of who you are, and cannot quietly change terms on an existing loan without that change being visible on-chain. Anyone can audit the rules, anyone can call the same functions on the same terms, and the system runs without asking permission.

It also removes settlement delay and, in principle, opacity: positions, collateral ratios and reserves are all publicly inspectable in real time rather than disclosed quarterly. Whether that transparency is usable depends on whether anyone is actually reading it, but the data exists, which is more than can be said for most of the traditional system it imitates.

Reading a DeFi opportunity honestly

Yields are usually a mix of genuine fee revenue and token emissions. Fee revenue is durable; emissions are a subsidy that dilutes holders and typically falls over time. A very high advertised rate is often a description of the risk being taken rather than compensation for it, and a rate denominated in a token whose price is falling can be a loss in real terms.

The questions worth answering before committing: where does the yield actually come from; what does the price feed depend on; what privileged functions exist and who holds them; what happens in a sharp adverse move; and what else does this depend on that I have not looked at. If a protocol’s materials do not let you answer those, that is itself the answer. Definitions for the terms here are in the glossary, and the custody trade-offs are covered in security tips.