Deciphering DeFi: A Comprehensive Analysis and Visualization of Risks in Decentralized Finance

Abstract

Decentralized finance (DeFi) promises a revolution in financial accessibility, transparency, and automation. Yet, its very novelty exposes participants to a number of additional risks and challenges. This study aims to address the risks associated with DeFi, while also conducting a comparative analysis to those of classical/traditional finance (TradFi). After introducing DeFi and its defining characteristics, such as the use of smart contracts, blockchain technology, and decentralized governance, the paper outlines the principal risks associated with DeFi. Drawing insights from an extensive literature review of 200 recent articles, of which 50 were thoroughly analyzed, the study compares risks of DeFi and TradFi, categorizing these into systematic and unsystematic risks. Furthermore, we introduce the ‘risk wheel’, an innovative tool tailored to understand and navigate the subtleties of DeFi risks, finding potential applications in risk assessment, management, and even education. This paper’s primary objective is to provide a detailed and impartial examination of the risks associated with DeFi and their comparison to traditional finance in order to assist stakeholders in making informed decisions and mitigating possible losses.

1. Introduction

The emergence of decentralized finance (DeFi) has brought many innovations and benefits to the financial industry, such as increased accessibility, transparency, and automation. DeFi protocols and applications offer new ways to lend, borrow, trade, and invest. However, they also introduce unique risks that need careful consideration. In this research, we will compare the risks associated with DeFi to those of traditional finance.

We will focus on systematic and unsystematic risks, which are often used in finance to characterize the causes and effects of risk. Systematic risks, usually referred to as market risks, are inherent to the market as a whole and influence all market assets. It is difficult to diversify or hedge systemic risks, which are driven by external factors such as economic conditions, political events, and technological advancements. Inflation, deflation, recession, and conflicts are examples of systematic risks. Unsystematic risks, often known as specific risks, are asset- or industry-specific risks that can be diversified or hedged. They are generated by internal factors such as the quality of management, the performance of the asset, and the rivalry in the industry.

First, we explain DeFi and highlight its most pivotal products, emphasizing its foundational technologies and functionalities. The third section focuses on the risk landscape. We explain the risk categories prevalent in traditional finance. Drawing from a robust analysis of academic literature—encompassing a quantitative review of 50 selected papers from a pool of 200—we elaborate on the multifaceted risks intrinsic to DeFi. Following this, the fourth section introduces a novel risk categorization that divides DeFi risks into systematic and unsystematic categories, paving the way for a more nuanced understanding. In Section 5, we present our ‘risk wheel’, a tool designed to assess DeFi risks. We highlight the diverse range of applications of this concept, with a particular focus on its effectiveness in the realms of risk assessment and risk management. We conclude with a rigorous discussion of our findings, obtained from our research. Overall, this paper aims to provide a comprehensive and balanced analysis of the risks of DeFi and a tool to visualize and assess them.

2. Decentralized Finance

Decentralized finance (DeFi) is a recent paradigm in the financial sector that combines blockchain technology and smart contracts to provide financial services without intermediaries. DeFi is a rapidly expanding segment of the crypto financial industry that offers numerous advantages over traditional financing.

The following DeFi features stand out from traditional finance:

• Decentralization: DeFi is based on decentralized networks, notably blockchain, which is a decentralized and distributed ledger technology that records transactions across multiple computers securely, transparently, and immutably, as well as peer-to-peer networks. These technologies function without a central authority or intermediaries.
• Smart contracts: DeFi relies on smart contracts, defined as self-executing contracts, where the terms are directly written into code and run on a blockchain, ensuring that they are not only tamper-proof but also automatically enforceable without the need for a centralized authority. These blockchain-encoded, self-executing, and enforceable computer programs enable DeFi to automate complex operations, remove the need for intermediaries, and increase efficiency and trust;
• Crypto assets: DeFi makes use of crypto assets, such as cryptocurrencies and tokens, as a means of exchanging and storing wealth. Crypto assets provide DeFi products with higher liquidity, flexibility, increased speed and accessibility than conventional assets, allowing DeFi to offer innovative financial products and services;
• Open finance: Open finance is the use of open protocols, standards, and networks to facilitate financial innovation and interoperability. Open finance enables DeFi to offer more inclusive, interoperable, and decentralized financial services than traditional finance;
• DeFi applications: Decentralized applications, also known as dApps, provide the user interface for financial services that run on blockchain systems. DeFi-powered decentralized applications include decentralized exchanges, lending systems, stablecoins, insurance, and prediction markets;
• DeFi ecosystem: The DeFi ecosystem includes blockchain technology and cryptocurrencies, platforms, and communities. Developers, users, investors, academics, regulators, and other stakeholders all contribute to the development and evolution of DeFi.

DeFi is the umbrella term for a variety of products that incorporate many or all of the features described above. Examples include Stablecoins, Liquidity Pools, Lending Pools, Staking, Insurance Products, Digital Exchanges (DEXs), or Automated Market Makers (AMMs). Some of these products are briefly described below to help readers better understand the subsequent content.

2.1. Stablecoins

Stablecoins are a type of token tied to a stable asset, such as a fiat currency, a commodity, or a diversified portfolio of assets. Stablecoins are intended to offer greater predictability and stability than other cryptocurrencies or tokens, which are frequently volatile and susceptible to changes.

There are various types of stablecoins based on the underlying asset to which they are linked. These are some of the most prevalent types of stablecoins:

• Fiat-backed stablecoins: Stablecoins are backed by fiat currencies, such as the US dollar, the euro, or other currencies. They are issued and maintained by centralized entities that hold reserves of the corresponding fiat currency;
• Commodity-backed stablecoins: Stablecoins backed by a commodity, like gold or oil. They are also issued and maintained by centralized entities and are supported by reserves of the respective commodity;
• Algorithmic stablecoins: These stablecoins use computer algorithms to keep their value stable. They are not backed by real-world assets but rely on tech solutions instead. Decentralized systems, such as MakerDAO1 and Frax2, issue and control algorithmic stablecoins (Kjäer et al. 2021).

Stablecoins serve as a medium of commerce, unit of account, store of value, and collateral for loans, among other functions. Other DeFi products such as decentralized exchanges, loan systems, and prediction markets utilize them. Stablecoins offer DeFi greater liquidity, stability, and accessibility than other cryptocurrencies, allowing DeFi to offer new financial products and services.

2.2. Liquidity Pools

Liquidity pools, integral to DeFi protocols, allow decentralized applications (dApps) to operate and provide crypto investors with a way to earn yield on their digital assets. A liquidity pool represents a collection of digital assets in a smart contract that is used to facilitate trades between the assets on a decentralized exchange (DEX). Instead of traditional markets of buyers and sellers, many DeFi platforms use Automated Market Makers (AMMs), which allow digital assets to be traded in an automatic and permissionless manner through the use of liquidity pools.

As an essential part of DEXes, liquidity pools provide the liquidity that is necessary for these exchanges to function. They are created when users lock their cryptocurrency into smart contracts, which then enable them to be used by others. In exchange for providing liquidity, those who fund this pool earn a percentage of transaction fees for each interaction by users. Without liquidity, AMMs would not be able to match buyers and sellers of assets on a DEX, and the whole system would grind to a halt.

Liquidity pools use smart contracts to make trades. But if there is a mistake in the code, it can be exploited by hackers (Rivas 2022). They play a crucial role in attacks, as they often become the mechanism for price manipulation that leads to flash loan (Qin et al. 2021) and vampire attacks (Xu et al. 2022) to drain the liquidity of the pools.

2.3. Lending Pools

Lending protocols, which are decentralized, provide the rules, algorithms, and incentives governing the lending process within lending pools (Bartoletti et al. 2021). A lending pool is an instrument that facilitates the involvement of several borrowers and lenders in a decentralized lending market. Lending pools are utilized regularly in DeFi to provide liquidity, accessibility, and transparency to the lending market.

Like other DeFi products, lending pools fundamentally operate on decentralization, use smart contracts, and involve the exchange and collateralization of crypto assets. A lending pool must have adequate liquidity in order to issue loans. Thus, lending pools often depend on liquidity pools to maintain the necessary liquidity.

2.4. Automated Market Makers

Automated Market Makers (AMMs) are decentralized protocols that allow the creation and oversight of liquidity pools within a decentralized exchange (DEX) (Mohan 2020; Pourpouneh et al. 2020). AMMs utilize algorithms and smart contracts to automatically connect buyers and sellers, as well as to decide the prices and quantities of assets in the liquidity pool. They offer fair, transparent, and secure pricing on the DEX market.

AMMs serve multiple functions, including providing liquidity to the DEX market, letting users trade assets swiftly and easily, and allowing liquidity providers to make returns on their assets.

3. Risks in Traditional Finance and DeFi

DeFi is a fresh and game-changing approach to the financial sector offering a suite of financial services without the need for traditional intermediaries such as banks, brokers, or insurance companies. Accessibility, financial inclusion, transparency, self sovereign control over assets, and programmability are only some of the benefits that come with DeFi. Nevertheless, it also comes with its own set of risks, mixing new tech challenges with the usual challenges of handling money and finance. This section presents a comparative overview of the risks inherent in traditional finance (TradFi), which have been extensively studied and documented over an extended period, and the risks associated with Decentralized Finance (DeFi). We conducted both a qualitative analysis and a quantitative literature review on DeFi risks.

3.1. Risk Categories in TradFi

The Basel III risk categories are a set of rules that banks and other financial institutions use to manage and reduce their risks (King and Tarbert 2011; Shakdwipee and Mehta 2017). These criteria are established by the Basel Committee on Banking Supervision (BCBS) (Basel Committee on Banking Supervision 2011), an international regulatory body whose mission is to enhance financial system stability and integrity.

The main risk categories according to the Basel III regulatory framework are:

• Credit risk: This is the risk of default or loss on a loan or investment due to the borrower’s or issuer’s inability or reluctance to make regular payments. Credit risk is the primary risk category in traditional finance. It is managed through the establishment of appropriate capital requirements, implementing credit rules and processes, and conducting thorough credit risk assessments;
• Market risk: This is the risk of loss resulting from changes in market pricing or conditions, including interest rates, exchange rates, and stock prices. Market risk is controlled by imposing limitations on market exposure, developing frameworks for market risk management, and conducting routine stress testing;
• Operational risk: This is the risk associated with inadequate or failing internal processes, people, and systems, or external occurrences. Operational risk is managed by creating robust risk management frameworks, conducting regular internal audits, and executing effective contingency plans;
• Liquidity risk: This risk addresses the danger of incurring a loss or being unable to meet financial obligations owing to a lack of liquid assets or finances. Liquidity risk is managed by setting appropriate liquidity ratios, performing liquidity stress tests, and maintaining adequate funding sources;
• Concentration risk: This is the risk of loss resulting from a concentration of exposures to a single counterparty, sector, or geographic region. To manage concentration risk, diversification techniques are implemented, concentration limits are established, and exposures are regularly reviewed and monitored.

3.2. Qualitative Analysis of Risks in DeFi

Decentralized finance contains unique and novel financial risks for a variety of reasons. First, DeFi, being a nascent and rapidly growing sector of the financial industry, faces significant uncertainty and volatility. Several DeFi programs and methods are experimental in nature, and there is considerable doubt regarding their long-term feasibility and sustainability. Second, since DeFi relies on blockchain technology and smart contracts, it introduces additional risks and challenges not typically found in traditional financial systems. For instance, DeFi projects and protocols are often independent and decentralized, meaning there is no central authority or mediator that can provide oversight or control. This can make it more challenging to manage and mitigate risks and expose DeFi users to new forms of threats, such as fraud and hacking. Third, since DeFi frequently involves the usage of digital assets, such as cryptocurrencies and tokens, the offered financial services can be extremely volatile and subject to substantial price swings. This means that DeFi users may be exposed to substantial financial risks, such as the possibility of losing their investment or the value of their assets.

In recent years, several publications have analyzed the risks associated with DeFi. The first systematic literature review of DeFi research directions was conducted by Meyer et al. (2022). While Werner et al. (2021) give a general overview of DeFi and also the mostly technical risks associated with it, Zhou et al. (2023) specifically addresses DeFi attacks. In their article, Schär (2021) explains the architecture, market mechanisms and price calculations of some DeFi products and also addresses the associated new risks. The survey of DeFi security by Li et al. (2022) also focuses primarily on technical aspects. However, the article also includes governance risks like inappropriate key management.

Much of the current literature focuses on the technical risks that arise with the new technology, some of which are fundamentally different from previous financial risks. Some, like Qin et al. (2021), address market manipulation with new technological features like flash loans. Comprehensive risk assessments which also include economical and market risks are rarely found, as in Meegan (2020) or Carter and Jeng (2021). Only recently, a first approach on a categorization of risks was presented by Chang et al. (2022). They present a framework of six main risk categories in their paper: smart contract risks, cybersecurity operational risks, blockchain infrastructure risks, social and people risks, financial risks, and societal risks.

In the following sections, we summarize the risks from the literature to provide a comprehensive overview that is not limited to technological risks.

3.2.1. Technology Risks

Risks from Smart Contracts

While smart contract technology is reshaping traditional industries and business processes, there are several potential hazards associated with its misuse in DeFi. We categorize these challenges according to the life cycle of smart contracts.

• Creation risks: Contract creation is an important step to implement smart contracts. Developers have to code their own contracts and then deploy them in various blockchain platforms. Translating the smart contract using the programming languages, can introduce exploitable vulnerabilities or errors. There might also be arithmetic vulnerabilities, which are types of vulnerabilities caused by flaws or errors in the contract’s arithmetic computations. Other vulnerabilities in this category are re-entrancy vulnerability (Li et al. 2020), block randomness vulnerability (Bonneau et al. 2015), and overcharging (Chen et al. 2017).
• Deployment risks: Smart contracts need to be checked carefully before deploying on blockchain platforms to avoid potential bugs that can be exploited by malicious behaviors. However, it is challenging to verify the correctness of smart contracts due to the complexity of modeling smart contracts, it is of vital importance to evaluate the correctness of smart contracts before the formal deployment (Luu et al. 2016).
• Execution risks: The execution phase is pivotal to smart contracts, as it determines the final state of smart contracts. Since smart contracts cannot work without real-world information, it is necessary to rely on a trustworthy oracle (Al-Breiki et al. 2020). Also, the dependence of the order of transactions is challenging to solve it in smart contracts, and developers should be aware to mitigate potential losses (Mavridou and Laszka 2017). Finally, smart contracts are executed in serialization, which limits the system performance. There are some software transactional memory systems that help to improve the execution efficiency of smart contracts (Bragagnolo et al. 2018), but more work needs to be performed.
• Completion risks: The proliferation of smart contracts brings additional concerns. Most current smart contract and blockchain platforms lack privacy-preserving mechanisms, especially concerning transactional privacy. Consequently, all the transactions are visible to everyone in the networks. Although some blockchain systems use pseudonymous public keys to improve the anonymity of the transactions, most transaction data are still publicly visible (Ron and Shamir 2013).

Risks from the Blockchain Protocol

DeFi products operate on a distributed ledger system. Therefore, they heavily rely on the blockchain’s underlying protocol and its flawless and ongoing functioning (Carter and Jeng 2021). Possible protocol errors could be:

• Changes to the protocol: Changes to the blockchain protocol can happen via hard forks, soft forks, protocol upgrades, or modifications from a governance process. A hard fork is a modification to the blockchain protocol that is not backward-compatible, requiring all network participants to update to the latest version of the program. A soft fork is a backward-compatible update to the blockchain protocol that may be executed without needing all users to upgrade their software. Some blockchain protocols, including Ethereum, have a method for executing protocol upgrades. Depending on the nature of the modifications being made, these enhancements may be introduced via a hard fork or a soft fork. Some blockchain networks provide a governance procedure that enables users to propose and vote on protocol modifications. The execution method for these modifications depends on the specific network, the type of proposed change, and the community’s social structure. They can be implemented through a hard fork, a soft fork, or another method. There is the risk of fraud or sub-optimal outcomes of these change processes, as described in Barrera and Hurder (2018).
• Centralization: Consensus protocols, such as proof-of-work (PoW) or proof-of-stake (PoS), might be susceptible to centralization, which occurs when a small number of users control a considerable majority of the network’s computational capacity (Gencer et al. (2018)). This is called a 51% attack. PoS protocols depend on a limited set of validators to validate transactions and establish consensus on the blockchain’s state. If these validators are hacked or do not function in the best interests of the network, it might pose a risk to DeFi users. Further risks specific to the used consensus protocols are: selfish mining, pool hopping attack, Sybil attack, or nothing at stake attack.
• Performance and scalability: DeFi products can also be affected by the speed and scalability of a consensus mechanism. If the protocol cannot manage a huge amount of transactions or has a high latency, it might cause DeFi users to experience delays and other issues.
• Front running: Front running is a method of trading that includes profiting on knowledge of a future deal. This risk already existed in traditional finance (Cai 2003). A person or entity can engage in front running in the context of decentralized finance (DeFi) if they are able to monitor a trade that is about to be performed on a blockchain and then arrange their own trade ahead of it to gain an advantage. Often, the transaction pool (mempool) is used for front running. We also include attacks like sandwich attacks this category.

Risks from the Use of Oracles

Oracles are entities that supply smart contracts on a blockchain with external data (Caldarelli 2020). Since smart contracts cannot access anything outside of a blockchain, oracles must provide all required data from external sources. They serve as a link between the smart contract and the “outside world”, providing the contract with the necessary data to execute its conditions.

Oracles do not provide the robust security properties of native blockchain protocols. Therefore, they can be manipulated by either technical or social vulnerabilities (Li et al. 2020). Yet, they are very sensitive and need always to be accurate.

Padding oracle attacks (Rorot 2014) and compression oracle attacks (Rorot 2013) are an example of oracle attacks that exploit the system’s availability. Recently, an attack on the Solend lending platform incurred a debt of USD 1.26 million (Hines 2022). The hacker exploited a weakness in the platform’s price data oracle, stole funds, and increased the value of the assets. This attack impacted three loan pools that held stablecoins.

There are solutions that try to provide strong guarantees of data authenticity. PADVA (Szalachowski 2019) and TownCrier (Zhang et al. 2016) are oracles that provide cryptographically checkable information as they attest to the content of websites accessed using the Hypertext Transfer Protocol Secure (HTTPS) protocol. The underlying idea behind these oracles is that they verify attestations due to the use of transport layer security (TLS). However, TLS does not guarantee that every visitor to the site sees the same information. Additionally, a website could maliciously alter its output to influence on-chain attestations, creating a centralized point of failure in the system.

Augur is a prediction market platform that uses an oracle to determine the outcomes of events (Peterson et al. 2018). The platform pays participants based on the outcome determined by the oracle. To ensure accurate reporting, the oracle may require certain users to report the outcome at designated times or face a financial penalty. If a user intentionally reports incorrect results, they may be subject to a dispute resolution process. However, Augur’s oracle does not allow users to easily enter or leave the system, which can negatively impact the usability of the platform.

Risks from the Use of Liquidity Pools

Liquidity pools remove a lot of the risk that centralized exchanges have. However, there are still risks that can be serious problems for the crypto world:

• Impermanent loss: During extreme market fluctuations, liquidity pools risk impermanent loss. In simple terms, impermanent loss means that the FIAT value of a user’s crypto assets deposited to a pool could decline over time.
• Smart contract vulnerabilities: Once assets have been added to a liquidity pool, they are controlled exclusively by a smart contract, with no central authority or custodian. So, if a bug or some vulnerability is exploited, they could lose the coins for good.
• Liquidation risk: As liquidity pools are often leveraged, there is a risk of forced liquidation if the price of the assets devalues. The highly volatile market of the crypto-currencies and the vulnerabilities can lead to liquidity problems. Recently, the missing payments on USD 17.7 million of loans from lending pools after a sudden implosion of FTX percolated to creditors on lending protocols (Sandor 2022). Solend, a decentralized lending protocol on the Solana network, has narrowly avoided having 95% of the SOL deposits in its lending pool liquidated (Elliot 2022). As the price of SOL continued to drop and the collateral is used for liquidation, Solend almost ended with no SOL.
• Flash loan attack: Flash loans are unlimited and non-collateralized loans in which a user borrows funds and returns them in the same transaction. Malicious actors use flash loans to manipulate the price of the market, resulting in the theft of assets. In 2021, a flash loan attack caused the value of the token to drop 95% (Crawley 2021). The attacker profited USD 3 million and left the company to adapt their strategy to prioritize security instead of product release. These attacks are becoming a serious problem in cryptocurrency and are increasing yearly. In 2021, attackers gained over USD 3.2 billion in various attacks, hacks, and scams. In 2022, this value raised to USD 3.7 billion (Malwa 2022).
• Vampire attack: Although unusual, vampire attacks can lead to the depletion of a liquidity pool. This attack drains the liquidity from one exchange to another source. Uniswap has become a victim of a vampire attack when a cloned exchange called SushiSwap siphoned USD 1.2 billion in liquidity (Kelly and Balakrishnan 2020). Although SushiSwap returned USD 14 million in Ether, this attack cast a shadow on the confidence of DeFi’s community in this DEX.

Risks from the Use of Lending Pools

Lending pools (LPs) allow mutually untrusted users to lend and borrow crypto assets. All the parameters of a loan, like its interests, maturity periods or token prices, are determined by a smart contract, which also includes mechanisms to incentivize correct behavior.

Similar to smart contracts, lending pools are inherently complicated to design. Besides the typical difficulty of implementing secure smart contracts Zhao et al. (2017), lending pools feature complex economic incentive mechanisms, which makes it difficult to understand when a lending pool actually achieves the economic goals it was designed for. Recently, a cross-contract reentrancy attack on a lending pool allowed the exploiter to redeem the assets at inflated prices (Sovryn 2022).

But there are other risks that are serious problems for LPs:

• Liquidity risk: Currently, the main depositors contribute to most liquidity in LPs (Gudgeon et al. 2020) and a small group of borrowers account for most loans. For instance, when dual-role users supply stablecoins, they can launch illiquidity risks by withdrawing their deposits and not repay the loans. Aave protocol benefit from more revenue when potential risks are higher. This is consistent with the logic around LPs. LPs rely on users to provide liquidity. Therefore, these dual-role users can booster the growth of Aave by depositing their stablecoins. In contrast, this protocol faces negative consequences when the risk of potential illiquidity increases, because it can lead to devaluations of Aave protocol.
• Counterparty risk: Counterparty risk happens when one party in a financial transaction cannot fulfill their commitments. A reentrancy attack can be used as a tool to drain the liquidity. Since blockchain allows smart contracts to work without the need to trust any party except the smart contract itself, the untrusted contract then calls back to the original function in an attempt to drain funds. To avoid this risk, the security of a smart contract is a vital in DeFi.

Risks from Internet and Online Access

The internet and online access to DeFi and blockchain in general bring several concerns. Cybersecurity is a significant threat, as these systems are susceptible to hackers and theft. By getting access to users’ private keys or by exploiting flaws in the smart contracts that operate on blockchain networks, hackers may attempt to steal users’ assets.

In Distributed Denial of Service (DDoS) attacks, a network of hacked computers is used to flood a website or network with traffic, rendering it unreachable to authorized users. This can render a DeFi platform inaccessible, preventing users from accessing their cash or engaging in transactions.

3.2.2. Market and Financial Risks

Market and financial risks arise from either the financial market itself or the participants involved in financial transactions. Many of these risks are similar to risks of traditional finance. Nevertheless, the reasons are often different since DeFi uses a decentralized and often anonymous environment.

• Counterparty risk: Since DeFi depends on an interconnected network of smart contracts and other applications, the failure of a single component can have cascading effects on the entire system. The term for this is counterparty risk.
• Volatility and leverage: The values of cryptocurrencies and other assets utilized in DeFi often have an enormous leverage effect and can be extremely volatile, meaning that users may incur substantial losses if the value of their assets declines.
• Liquidity risk: Some DeFi systems and protocols may have restricted liquidity, making it challenging for users to purchase or sell particular assets. This can generate liquidity risk, since consumers may be unable to readily transfer their assets into cash or other kinds of value.
• Credit risk: Certain DeFi products, including decentralized exchanges (DEXs) and lending platforms, extend credit to customers. This can create credit risk, as there is a chance that borrowers will default on their loans or that the value of the collateralized assets would drop. Credit risks in DeFi differ from traditional finance because loans are typically overcollateralized.

3.2.3. Operational Risks

Operational risks are the risks of loss caused by poor or failing internal processes, people, or systems, or by external events that can interrupt the flow of corporate operations. The financial losses may be direct or indirect. Due to the fact that the functioning of DeFi products is fundamentally distinct from conventional finance, operational risks also vary substantially.

• Governance risks: Governance risks in DeFi relate to the uncertainties associated with the procedures and mechanisms that are used to make decisions concerning the operation and development of DeFi platforms and protocols. This could be the lack of transparency, making it difficult for consumers to comprehend how and by whom decisions are made Makridis et al. (2023). Also, some DeFi governance organizations may not be responsible to users, meaning that consumers may have few options if anything goes wrong or if they disagree with the decisions made. If a small number of persons or entities has disproportionate control over DeFi governance procedures, this might pose hazards for DeFi users, since these individuals or businesses may be able to make choices that are not in the best interests of the larger community. These decision-making processes utilized by DeFi governing bodies may be inefficient or susceptible to bias, which might result in subpar decision-making and cause hazards for DeFi users.
• Inappropriate key management: One aspect of governance risk involves the mishandling of private keys. The vast majority of DeFi smart contracts permit an update or even a trade halt. These transactions are performed using the product administrators’ wallet and private keys. Any unauthorized use or theft of these private keys might lead to the loss of all funds. These may occur both intentionally and accidentally.
• Prospectus risks: “Depending on the country and legal structure of the underlying tokens, DeFi products might fall in the category of securities or asset tokens. For example, in Switzerland this token category result in prospectus requirements under the Swiss Code of Obligations” (FINMA 2018, pp. 6/11). This means that missing prospectus or errors in the descriptions can have legal consequences for the issuer.

3.2.4. Legislative, Regulatory and Governance Risks

The legislative and regulatory environment for DeFi is very challenging. Not only is this a very new and innovative technology, it must also be taken into account that DeFi products are available worldwide. Therefore, any country-specific laws must be taken into account.

• Legal status of smart contracts: Since smart contracts are self-executing, there is typically no legal redress when anything goes wrong. This implies that it may be difficult or impossible to remedy the issue if a contract is abused or a mistake is made in the code.
• Legal, regulatory, and compliance risk: DeFi is a very new and mostly unregulated field, which implies that there is a lack of legal and regulatory control. This can pose dangers for DeFi users, since they may have little options if something goes wrong. These risks can arise if either already existing legal requirements are not complied with or if the legal framework changes but the DeFi product is not or cannot be adapted.

3.2.5. Strategic and Reputational Risks

Strategic and reputational risks in DeFi are issues related to the long-term survival and reputation of DeFi platforms, protocols, and associated companies. DeFi is a fast expanding and very competitive industry, and new platforms and protocols are continuously being created. Risks associated with this category include:

• Changes in technology: the DeFi area is characterized by fast technical development, and platforms and protocols that do not keep up with these changes risk becoming obsolete or less appealing to consumers;
• Reputational risk: the reputation of a DeFi platform or protocol is crucial to its success, and any unfavorable press or security breaches might harm its reputation and reduce its appeal to users;
• Leave risk: if a DeFi platform or protocol encounters substantial issues or loses the confidence of its users, there is a danger that users would “exit” the platform, which might result in a loss of value or the platform’s demise.

3.3. Quantitative Literature Review of DeFi Risks

To gain a deep understanding of DeFi-associated risks, we thoroughly analyzed pertinent academic literature. We conducted a comprehensive search in two academic databases, namely Google Scholar and Scopus, utilizing a carefully constructed search string to identify relevant scholarly literature pertaining to the diverse risks associated with DeFi. After our initial review, we excluded medical papers because they often referenced “defibrillators,” causing terminological overlaps. The search string utilized for our final analysis was:

«Risk» OR «Risks» AND «Decentralized Finance» OR «Defi» NOT Defibrillator -Medicine -Health -Diabetes -Disease -Cancer

Due to the extensive search results, we sorted them by the number of references, limiting ourselves to the top 200 outcomes and focusing on publications from 2020 to 2023. Out of the 200 obtained results, 46 entries were excluded from consideration due to either incongruent titles or unavailability. Initially, we reviewed the literature based on the relevance of their titles, specifically looking for those that matched the topic “Risks of Decentralized Finance”. We deemed a title relevant if it pertained to Traditional Finance (TradFi) or if it highlighted specific DeFi protocols. In this first step, we focused on the core principles of DeFi described above. Using this approach, we narrowed down our list from 154 publications to 96.

Subsequently, the abstracts of the remaining 96 publications were analyzed. To ensure a thorough evaluation, a set of criteria was established. Two researchers independently assessed each abstract based on these criteria. Their evaluations were then combined to derive a final score for each publication, ensuring a comprehensive comparison and identification of the most relevant works. The following scoring system was utilized: a score of 0 indicates no relevance, a score of 1 indicates some level of relevance, and a score of 2 indicates high relevance (see

Table A1. Literature analysis.

Title	Reference	Year	DeFi	DeFi Risks	DeFi Protocol	TradFi	Total	Smart Contracts	Attacks	Missing Regulation	Oracle	Liquidation	Scalability	Stablecoins	Governance	Composability	Volatility/Leverage	Other Risks
DeFi protocol risks: the paradox of DeFi	Carter and Jeng (2021)	2021	2	2	2	2	8	X		X			X	X				Operational Risk
DeFi risks and the decentralisation illusion	Aramonte et al. (2021)	2021	2	2	1	2	7					X		X			X
A Risk Classification Framework for Decentralized Finance Protocols	Chang et al. (2022)	2022	2	2	2	1	7	X	X									MEV, network effect
Decentralized Finance (DeFi): Foundations, Applications, Potentials, and Challenges	Gramlich et al. (2022)	2022	2	2	2	1	7	X	X	X		X	X
Security and efficiency of collateral in decentralized finance	Harz (2022)	2022	2	2	2	1	7				X	X			X			Governance, technical security
Risks in DeFi-Lending Protocols-An Exploratory Categorization and Analysis of Interest Rate Differences	Huber and Treytl (2022)	2022	2	2	2	1	7	X			X		X		X			Operational risk
A Survey of DeFi Security: Challenges and Opportunities	Li et al. (2022)	2022	2	2	2	1	7	X			X							Cybersecurity, design issues
An empirical study of DeFi liquidations: Incentives, risks, and instabilities	Qin et al. (2021)	2021	2	2	2	1	7					X						Flash loans
Deceptive Assurance? A Conceptual View on Systemic Risk in Decentralized Finance (DeFi)	Bekemeier (2021)	2021	1	2	1	2	6	X		X	X	X	X		X	X
DeFi Potential, Advantages and Challenges	Borisov (2022)	2022	1	2	2	1	6	X		X	X		X			X		Infrastructure risk
Decentralized Finance (DeFi): Transformative Potential & Associated Risks	Carapella et al. (2022)	2022	1	2	2	1	6	X	X	X	X	X	X		X	X
Security analysis of DeFi: Vulnerabilities, attacks and advances	Li et al. (2022)	2022	1	2	2	1	6	X			X
Cryptocurrencies and decentralized finance (DeFi)	Makarov and Schoar (2022)	2022	2	1	1	2	6	X						X				Leverage
Flash crash for cash: Cyber threats in decentralized finance	Oosthoek (2021)	2021	2	2	2	0	6	X	X
Speculative multipliers on DeFi: Quantifying on-chain leverage risks	Wang et al. (2022)	2022	2	2	2	0	6	X	X							X
Centralized and decentralized finance: Coexistence or convergence?	Wieandt and Heppding (2023)	2023	2	1	1	2	6	X		X	X		X	X
Defining DeFi: Challenges & pathway	Amler et al. (2021)	2021	1	1	1	2	5	X		X	X		X			X		Data protection, infrastructure
Embedded Supervision: How to Build Regulation Into Decentralized Finance	Auer (2022)	2022	1	1	1	2	5							X				Exchanges
DeFi Survival Analysis: Insights into Risks and User Behavior	Green et al. (2022)	2023	1	2	2	0	5										X	Lending protocol
SoK: Preventing Transaction Reordering Manipulations in Decentralized Finance	Heimbach and Wattenhofer (2022)	2022	1	2	2	0	5		X
Advantages and disadvantages of decentralized financial (DeFi) services	Kirvesoja (2022)	2022	2	1	0	2	5			X	X		X					Flash loans, illegal activities, systemic risk
Stablecoins and Their Risks to Financial Stability	MacDonald and Zhao (2022)	2022	1	1	2	1	5							X
Risks and benefits of centralized and decentralized cryptocurrency exchanges and services	Nummelin (2022)	2022	2	2	0	1	5		X									Fraud, scams
Decentralized finance (DeFi)–the lego of finance	Popescu (2020)	2020	2	1	2	0	5	X									X	Fraud
Decentralized finance: On blockchain-and smart contract-based financial markets	Schär (2021)	2021	2	2	1	0	5	X			X		X			X
Decentralized finance (DeFi)	Zetzsche et al. (2020)	2020	2	1	0	2	5				X							Lack of support in times of crisis, technological dependency, price manipulation
SoK: lending pools in decentralized finance	Bartoletti et al. (2021)	2021	1	2	1	0	4	X	X			X
Governing Decentralized Finance (Defi)	Bhambhwani (2023)	2022	1	1	2	0	4								X
A deep dive into crypto financial risks: stablecoins, DeFi and climate transition risk	Born et al. (2022)	2022	0	1	2	1	4			X		X		X			X	Risk appetite, spillover effect
Risk Analysis of Crypto Assets	Botte and Nigro (2021)	2021	0	2	1	1	4											Correlation, complexability,
Flashot: a snapshot of flash loan attack on DeFi ecosystem	Cao et al. (2021)	2021	2	1	1	0	4	X	X									Flash loans
Blockchain disruption and decentralized finance: The rise of decentralized business models	Chen and Bellavitis (2020)	2020	2	1	1	0	4			X							X	Data protection
Decentralized finance (DeFi): an emergent alternative financial architecture	Chohan (2021)	2021	1	1	1	1	4	X	X	X								Arbitrage, manipulationen, money laundry
Do we still need financial intermediation? The case of decentralized finance–DeFi	Grassi et al. (2022)	2022	1	1	1	1	4	X	X									Technology risks
Manage Risk in DeFi Portfolio	Inzirillo and De Quénetain (2022)	2022	1	2	1	0	4	X	X			X		X				Double Spending attack
An introduction to decentralized finance (DeFi)	Jensen et al. (2021)	2021	1	2	1	0	4	X					X		X	X
Stablecoins 2.0: Economic foundations and risk-based models	Klages-Mundt et al. (2020)	2020	1	1	1	1	4	X		X				X	X			Stability, counterparty risk
MiCA and DeFi (‘Proposal for a Regulation on Market in Crypto-Assets’ and ‘Decentralised Finance’)	Maia and Vieira dos Santos (2021)	2021	2	1	1	0	4		X			X
DeFi Risk Transfer: Towards A Fully Decentralized Insurance Protocol	Nadler et al. (2022)	2022	1	1	2	0	4	X	X		X				X
Decentralized Finance & Centralized Finance Analogy	Pardhi et al. (2022)		2	1	0	1	4	X										Missing customer service
Liquidations: DeFi on a Knife-edge	Perez et al. (2021)	2021	1	1	2	0	4					X
Attacking the DeFi ecosystem with flash loans for fun and profit	Qin et al. (2021)	2021	1	2	1	0	4				X
Challenges and approaches to regulating decentralized finance	Salami (2021)	2021	1	1	1	1	4			X				X				Know-Your-Customer Challenge
Decentralized finance (DeFi) compliance and operations	Scharfman and Scharfman (2022)	2022	2	1	1	0	4		X	X
DeFi: decentralized finance-an introduction and overview	Schueffel (2021)	2021	2	0	1	1	4	X				X	X
P2P-The Key Behind Regulatory Framework of DeFi Services	Shalini et al. (2023)	2023	1	2	0	1	4	X	X	X					X		X
Liquidity Risks in Lending Protocols (LPs): Evidence from Aave Protocol	Sun (2022)	2022	1	1	2	0	4					X
Rethinking the Rule and Role of Law in Decentralized Finance	Wang (2022)	2022	1	1	1	1	4					X						Unstable loss, arbitrage
Blockeye: Hunting for DeFi attacks on blockchain	Wang et al. (2021)	2021	1	2	1	0	4	X	X
Sok: Decentralized finance (DeFi) incidents	Zhou et al. (2023)	2023	1	1	2	0	4	X	X		X							Cyber risks, front running
50 sources								29	18	15	15	14	12	10	9	7	6

). Using this scoring system, we efficiently evaluated and compared various publications, assessing their importance in terms of DeFi domains, associated risks, protocols, and their connection to TradFi.

The articles that received the highest score from the evaluation process were selected for inclusion in the paper. Articles with a score of 4 or higher were included in this group. Consequently, the literature review thus resulted in a total of 50 publications. These remaining publications underwent a comprehensive analysis, wherein the described risks were carefully documented. This detailed analysis can be found in Appendix A.

Based on our analysis, Figure 1 highlights the ten most prominent risks. This figure represents the frequency of each risk’s mention across the 50 selected publications and is also summarized at the end of Appendix A.

4. Classification of Risks in DeFi

The classification of risks provides a clear and structured overview, making it simpler to comprehend and communicate about various risk types. In their 1952 work “Portfolio Selection” (Markowitz 1952), economist Harry Markowitz introduced the distinction between systematic and unsystematic risk, laying the foundation for modern portfolio theory. Examples of systematic risk include recessions, political instability, and natural disasters. In contrast, unsystematic risk is unique to a given asset or firm and is uncorrelated with the market as a whole. Unsystematic risk examples include company-specific financial performance, changes in management, and regulatory measures.

Drawing from Markowitz’s framework, we categorize risks associated with DeFi into systematic and unsystematic categories, the latter being those risks that can be managed or influenced by the DeFi product creator. We developed a further risk classification based on the findings of the qualitative and quantitative analysis described in Section 3.

We categorize operational risk under unsystematic risk as it can be managed by the DeFi smart contract’s creator. From a technological perspective, there are risks categorized as controllable, aligning them with systematic risks, such as all risks associated with the development of the smart contract, as well as unsystematic risks, which stem primarily from the protocol or external technological aspects, such as oracles or cryptography. With measures such as collateralization, certain financial risks can be addressed or at least mitigated, while other financial risks are indeed market-dependent and systemic. A similar principle is applicable to legislative and regulatory risks. Compliance with present rules is a risk that can be managed; however, regulatory changes are exogenous and hence unmanageable. In this uncertain landscape, it is even more important to seek a stable regulatory environment and proactively anticipate potential changes. Comparisons with traditional financial products and their regulatory conditions can help.

Figure 2 provides a detailed visualization of our categorized risks. The left half of the figure represents unsystematic risks, whereas the right half illustrates systematic risks. The inner colored circle denotes the level 1 categories, as detailed in Section 3.2. The outer circle delineates the level 2 risk categories, which are aligned with the level 1 risk categories based on their positioning. Notably, the top ten risks from Figure 1 are highlighted in yellow.

In the following section, we focus on the question how those risks can be measured and managed.

5. Assessing Risks in DeFi

Drawing inspiration from the principles of supply chain risk assessment and the risk wheel framework presented by Handfield and McCormack (2007), we formulated a parallel framework tailored for the DeFi sector. The DeFi risk categories, as illustrated in Figure 2, play a crucial role in streamlining this process. These categories serve as the foundation for multiple risk management tasks.

The risk wheel introduced here is versatile, applicable to tasks encompassing risk assessment, monitoring, and communication, as elaborated in the subsequent sections.

5.1. Static Risk Assessment

In practical scenarios, a common methodology is the risk matrix approach, which factors in the likelihood of a risk occurring (probability) and the potential fallout or damage should the risk manifest (impact). The risk wheel offers the possibility to visualize the varying probabilities and impacts of occurrences within their respective categories. As seen in Figure 3, the relevant areas can be visually represented in the risk wheel. This gives a comprehensive risk view at a glance.

5.2. Continuous Risk Monitoring

Dynamic risk factors refer to variables that are subject to change over time, influencing the likelihood and ramifications of potential risks. For instance, within DeFi, dynamic elements might include the total value locked (TVL) in a specific protocol or prevailing market sentiments influencing market risks. A sudden increase in TVL might increase the impact of a smart contract vulnerability. Also, traditional risk factors, like the Value at Risk (VaR), could be used.

The risk categories and risk wheel described in this study can facilitate the process of continuous monitoring and offers the opportunity to include quantitative data. This offers the chance of visualizing both real risk events and simulated risk scenarios like stress tests. To deepen the understanding of how risks interplay, interactive tools like the one offered by Plandisk3 can be employed.

5.3. Risk-Based Comparison of DeFi Products

The risk wheel offers a thorough and all-encompassing perspective on the myriad risk factors linked to a DeFi product. Through the structured, circular presentation of risks, the vast spectrum and multifaceted nature of potential challenges and vulnerabilities for each product are more readily graspable. The more risks concentrated in specific sections of the wheel for a particular product, the more apparent its vulnerabilities in those areas.

For stakeholders unfamiliar with the intricacies of blockchain and DeFi, the risk wheel offers a more intuitive and accessible way to understand the risk landscape. It can act as a focal point in discussions, meetings, or presentations. Given their objective to provide a holistic perspective, researchers or analysts are less inclined to miss out on detailing risks. By visualizing and comparing risks of various DeFi products, the risk wheel can inform decisions about investment, product adoption, or risk mitigation strategies.

5.4. Subsequent Analysis of Risk Incidents

Since the risk wheel provides a 360-degree view of the risks, this tool can also be used for subsequent analysis of risk incidents. Following a risk incident, stakeholders can consult the risk wheel to pinpoint the pertinent segment the incident aligns with, determining if it was a previously recognized risk, an under-emphasized one, or an entirely unexpected occurrence. This helps in quickly pinpointing the specific category or intersection of risk factors implicated, thereby streamlining subsequent forensic analysis and response.

With a clear visual representation of the risks at hand, developers and protocol architects are better positioned to craft precise mitigation strategies. For instance, if oracle manipulation is a prominently represented risk, efforts can be directed towards developing more secure oracle mechanisms.

5.5. Educational Tool

Finally, the risk wheel stands as a valuable tool in elevating the learning journey, particularly when navigating complex topics such as DeFi. It provides a holistic view of the entire DeFi risk landscape and offers a snapshot of the diverse challenges and uncertainties inherent to the DeFi ecosystem. The above described interactive digital versions of risk wheels allows the users to click on specific risks to delve deeper into definitions, examples, or case studies. This interactivity can further engage learners, promoting a more in-depth exploration of the subject. By presenting risks visually and highlighting their interrelations, the risk wheel can encourage learners to think critically about the complexities of DeFi, prompting deeper exploration and understanding.

6. Discussion

Our study contributes several significant insights to the current body of research in the DeFi domain. Firstly, we highlight an increase in the number of publications addressing DeFi risks, as seen by 50 out of the 200 assessed articles being published during the period spanning from 2020 to 2023. This observed increase in research activity likely mirrors the growing interest and academic attention towards this sector. The comprehensive literature review identified the ten most often cited risks associated with DeFi: smart contracts, attacks, absence of regulation, oracles, liquidation, scalability, stablecoins, governance, composability, and volatility/leverage. This compiled inventory provides clarity in a complex and rapidly evolving landscape.

Secondly, we introduce a detailed risk wheel, adeptly categorizing the various DeFi risks, hence providing a visual tool to enhance comprehension and facilitate navigation within the complexities of this financial domain. The applications of this risk wheel are manifold, spanning basic risk assessment, quantitative risk evaluation, DeFi product comparison based on risk factors, subsequent analysis following risk incidents, and its utility as an educational tool.

Finally, our research provides an in-depth exploration of DeFi-associated risks, adopting both qualitative and quantitative methodologies. Nonetheless, we must recognize a few constraints inherent to our study. Similar to systematic reviews, our sample selection and interpretation of results may have been impacted by possible biases. Furthermore, in order to ensure concentration and adhere to limitations in terms of quantity, we made the decision to select a subset of 50 articles from the total pool of 200, therefore removing several prospective perspectives from the larger collection. Future studies might potentially explore the possibility of broadening the scope of this review by integrating related research domains, or doing more comprehensive analyses of the risk categories that have been identified.

By consolidating and presenting these insights, our work aims to offer a foundational framework for various stakeholders within the DeFi ecosystem to understand and address the numerous risks inherent to decentralized finance. Each group brings unique concerns and insights based on their distinct roles and interactions with DeFi systems. Investors, for instance, are concerned with profitability and the stability of their investments. Their concerns might focus on the robustness of smart contracts, potential vulnerabilities, the likelihood of large-scale breaches, and the clarity of regulations. Developers play a critical role in building and maintaining the infrastructure of DeFi systems. Their main concerns revolve around creating secure and efficient code, ensuring interoperability across various platforms, and keeping up with rapid technological advancements. Regulators are tasked with the challenging job of ensuring that DeFi platforms operate within legal boundaries while not stifling innovation. Their concerns include ensuring consumer protection, preventing money laundering or other illicit activities, and creating a regulatory framework that can adapt to the rapid evolution of the DeFi sector. Lastly, users of DeFi platforms, whether they are borrowers, lenders, or traders, are interested in the usability, security, and reliability of these systems. They are concerned with transaction fees, the transparency of protocols, the security of their assets, and the potential for improved financial returns or services compared to traditional finance.

Given the transformative potential of this financial system, it is also worth emphasizing the ethical and societal impact of DeFi, which has not been covered by our research yet. Aspects such as financial inclusion, privacy, and security play critical roles in shaping the future of DeFi. These considerations are especially crucial when evaluating the implications for vulnerable populations. Ensuring that DeFi systems are both transparent and inclusive, and that they prioritize the safety and privacy of users, is vital in fostering an equitable financial ecosystem. Future research could delve deeper into these ethical dimensions, examining the balance between innovation, risk, and societal benefit in the DeFi sector.