DeFi 101

Decentralised finance is lending, trading and derivatives run by smart contracts rather than by a company. No account, no application, no approval — you connect a wallet and the contract does what its code says.

The appeal and the danger are the same sentence. The rules are public code anyone can read and nobody can quietly change, which is genuinely new. And the code is the final authority, so a flaw in it is not a dispute you can appeal — it is a transfer that already happened.

The building block: a pool instead of a counterparty

Almost everything in DeFi rests on one substitution. A traditional market needs someone on the other side of your trade. DeFi replaces that person with a pool of assets that anyone can deposit into, and a formula that prices trades against it.

The common design is the automated market maker. A pool holds two assets, and the product of the two balances is held constant: buy one and you must add enough of the other to keep that product the same. Buying pushes the price up automatically, and no order book or matching engine exists at all.

Two consequences follow immediately, and they explain most of what confuses newcomers:

• Big trades in small pools move the price against you. That gap is called slippage, and it is not a fee anyone charges — it is the formula doing what it does.
• Depositing is not neutral. If the two assets move apart in price, you end up with more of the one that fell. Compared with simply holding both, that is a loss — impermanent loss, which is only impermanent if prices come back, and there is no reason they should.

Lending, and why you must over-collateralise

A DeFi loan has no credit check, because there is no identity to check and no court to pursue you in. The only thing the contract can rely on is collateral it already holds. So you borrow against more than you take out: lock a larger value in crypto, draw a smaller value in stablecoins.

If your collateral falls toward the amount you owe, the position is liquidated automatically — sold to repay the loan, usually with a penalty. No warning, no phone call, no grace period. That is not harshness; it is the only enforcement mechanism the system has.

This is also why DeFi lending is mostly not what “loan” means in ordinary life. Nobody borrows this way to buy something they cannot afford. They borrow to get leverage, or liquidity without selling, which are both positions rather than purchases.

Where the yield comes from

The single most useful habit in this whole subject is asking that question and refusing to move on without an answer. Yields in DeFi are real, but they come from somewhere specific, and the honest list is short:

• Fees paid by traders, shared with the people who supplied the pool. Genuine revenue, usually modest, and it shrinks as more capital arrives to share it.
• Interest paid by borrowers. Also genuine, and it moves with how badly people want leverage.
• Newly issued tokens, handed out to attract deposits. This is the one that produces spectacular headline numbers. It is not revenue — it is dilution, paid in a token whose price usually falls as the emissions continue.

A double-digit yield with no traders and no borrowers behind it is the third kind. That does not make it a scam; it makes it a marketing budget with an expiry date, and the people who arrive last hold the token when it stops.

Composability: the good idea with the bad failure mode

Because every contract is public and callable, protocols stack on each other. A token deposited in one protocol becomes collateral in a second, whose receipt gets deposited into a third. People call this money legos, and it is a real advantage: no partnership agreements, no integration meetings, no permission.

It also means risk stacks the same way. The third protocol has inherited every assumption of the first two, and the person using it usually cannot see that far down. Most of the largest DeFi failures were not one contract breaking on its own — they were one contract breaking and taking everything built on top of it.

How it actually goes wrong

Not usually by cryptography failing. By one of these, and they are worth recognising by shape:

• A bug in the contract. Audits reduce this and do not eliminate it. An audit is a review at a point in time, not a guarantee, and “audited” in marketing copy tells you a review happened, not what it said.
• Oracle manipulation. Contracts cannot see prices on their own; they are fed by an oracle. Move the price the oracle reports — easiest in a thin market — and you can trigger liquidations or borrow against collateral the protocol has mispriced. This is a well-established attack, not a hypothetical.
• Governance capture. If token holders can vote to change a protocol, then acquiring enough tokens is a way to change it in your favour.
• Bridge exploits. Moving assets between chains concentrates enormous balances in one contract, which has made bridges among the most profitable targets in the industry's history.
• The permission you granted. Not a protocol failure at all — an approval you signed once, used later by a contract you had forgotten about.

What DeFi is genuinely good at

It would be dishonest to end on the risks alone. Some things here work well and have no clean equivalent elsewhere: swapping between assets without an account or an identity check; borrowing against holdings at any hour without asking anyone; and a market whose entire position is publicly auditable, so you can verify solvency yourself instead of trusting a quarterly statement.

That last point is the real one. The recurring failure in centralised crypto has been companies quietly lending out customer assets. A protocol where the collateral is on-chain cannot hide that, because there is nowhere to hide it. Whether that is worth the contract risk you take on instead is a genuine trade, and it depends far more on the specific protocol than on the category.