The Complete Guide to Solana DeFi Risk

Solana DeFi risk breaks into nine categories — smart contract, custody, oracle, rug pull, liquidation, impermanent loss, depeg, bridge, and regulatory — and any given action only exposes you to a handful of them at once. This guide is the map: every category in one place, so you can weigh them together instead of one at a time. Which categories are structural facts about DeFi (smart contract risk exists for all code) versus which depend on a specific protocol’s specific implementation is noted per section below.

Smart contract risk

Every protocol you interact with is software that can contain bugs, and bugs in code holding real value can be — and regularly are — exploited. Longer track record, higher total value already entrusted, and a real audit history all reduce but never eliminate this risk. There is no protocol, however established, for which smart contract risk is zero.

Custody and wallet risk

DeFi is self-custodial, which means the security of your assets ultimately depends on your wallet setup and behavior, not the protocols you use. Seed-phrase compromise, phishing sites, and malicious transaction approvals cause more real-world losses than most protocol-level exploits. See our wallets guide.

Oracle risk

Lending, derivatives, and many other DeFi protocols depend on price oracles to function correctly — determining when to liquidate a position, or what a synthetic asset is worth. Oracle manipulation or failure has caused real, large losses across DeFi history. Protocols using well-established, manipulation-resistant oracle infrastructure are meaningfully safer on this dimension.

Rug pulls and outright scams

Not every project that looks like a legitimate protocol is one. A “rug pull” is when a project’s team or a malicious actor drains liquidity or exercises hidden control to take user funds directly, rather than through a technical exploit. This risk is concentrated in newer, less-established, and unaudited projects — extreme caution with anything brand new and unverified is warranted, independent of how attractive the advertised yield looks.

Liquidation risk

Specific to borrowing and leveraged positions — see our dedicated liquidation guide. This is the most common way people lose money in lending and perpetuals, and it’s directly a function of how close to the maximum you choose to borrow or leverage.

Impermanent loss

Specific to providing liquidity — see our dedicated guide. Not a hack or a fee, but a real, mathematically predictable cost of AMM liquidity provision when prices diverge.

Depeg risk

Specific to liquid staking tokens and other pegged assets — see our LST depeg guide. Usually temporary on established protocols, but can cause real realized losses if you need liquidity, or get liquidated, during the depeg window.

Bridge risk

Cross-chain bridges have historically been the single most exploited category of infrastructure in crypto, because they concentrate large amounts of value behind (often) newer and more complex code than a typical single-chain protocol. See our bridge security guide before moving assets across chains.

Regulatory risk

DeFi’s regulatory treatment continues to evolve and varies by jurisdiction. This doesn’t map to a specific technical mitigation the way the other risks do, but it’s a real category worth being aware of, particularly for anything resembling a security or for platforms operating in ways that may not be legally settled in your jurisdiction.

How to actually use this

Don’t try to eliminate every risk category — that’s not possible in DeFi. Instead, understand which categories apply to a specific action you’re about to take (a stablecoin lending deposit has a very different risk profile than leveraged perpetuals trading on a brand-new platform), and size your position accordingly.