The Crypto Linkup

Learn / Experienced · DeFi and Apps

Reading a smart contract’s promise

A decentralised finance app, or DeFi app, is a set of smart contracts that promise to do something with your tokens: swap, lend, pool, or move them. The contract does exactly what its code says, which is not always what its marketing says. This module teaches you to read the promise behind the screen.

You do not need to read code. You need to know which questions to ask and where to look.

Education only, not financial advice. Examples use made-up numbers, not live prices.

Code is the promise

A bank promises with a contract and a regulator behind it. A smart contract promises with code. If the code has a flaw, or an administrator has hidden powers, the “promise” on the website may not hold. That is why a calm look at the contract is more useful than trust in a logo.

What an audit tells you, and what it does not

An audit is a review of a project’s code by an outside security firm. It is useful, and the absence of one is a warning. But an audit is not a guarantee:

Questions to ask a contract

Use a block explorer such as Etherscan, a public website that lets anyone inspect contracts and transactions. For any app you are thinking of using, check:

Why bridges are such a target

A bridge holds a pool of assets on one chain and issues a matching claim on another. That pool is a huge prize in one place. In early 2022 the Wormhole bridge lost about 320 million US dollars after an attacker bypassed a signature check, and the Ronin bridge lost around 625 million after validator keys were compromised. In August 2022 the Nomad bridge lost about 190 million, in a free-for-all where many people copied the same exploit. Different failures, same pattern: complex code and concentrated funds. Reporting shows that in some cases the operators or backers covered the losses, and in others users bore most of them. You cannot rely on being made whole.

Hidden costs when you trade: slippage and MEV

When you swap on a decentralised exchange, the price you see can move before your trade lands. The gap is called slippage. Your wallet usually lets you set a tolerance, and a high tolerance gives others room to profit from your trade. In a related practice called MEV, short for maximal extractable value, bots reorder or insert transactions around yours to take a small profit from you. You cannot avoid these entirely, but you can trade smaller sizes on deep pools, set a sensible tolerance and avoid thin, new markets.

A Caribbean angle

Because there is no local helpline for a smart contract, your own checks matter more. Make a habit of writing down what you checked before you use a new app. If you cannot explain in a sentence who can change the contract and where your money goes, wait. The Module 8 rules lesson also explains that offering virtual-asset services as a business in T&T is currently restricted; using an app as an individual is different, but you should still understand who you are dealing with.

A pre-use checklist

Before you put money into any new app, write a short checklist and do not skip it because the app looks polished. Here is one that takes ten minutes.

One: find the official website through a trusted source, not through an advert or a message, and bookmark it. Two: find the contract address on that site and confirm it on a block explorer. Three: check that the source code is verified, and note the creation date. Four: find the audit report, its date and its scope. Five: identify the admin or upgrade powers, and whether a timelock delays changes. Six: look at how much value is locked and whether it is concentrated in a few wallets. Seven: decide the most you would be willing to lose, and use a small test amount first. Eight: record what you checked and when.

If you cannot complete a step, treat that as information. “I could not find the audit” is a reason to wait, not a reason to hope.

Common mistakes

Treating “audited” as “safe”. Read the audit’s date and scope.

Ignoring admin powers. One key that can upgrade the code is a single point of failure.

Setting slippage very high. It makes your trade easier to exploit.

Bridging large sums casually. Bridges have repeatedly been the largest losses in the space.

Try it yourself

Pick a well-known DeFi app and find its main contract on a block explorer. Answer: is the code verified, when was it created, who is the admin, and how much value is locked? Then find the app’s audit report and write down the date, the firm, and what the scope says was reviewed.

Keep in mind

Key terms from this lesson

Sources and credits

Explained in our own words from these sources. Figures are approximate and reported by the sources named; check them yourself. Education only, not financial advice.

Module quiz

3 questions. Tap an answer to see if you are right and why. Get 2 right to complete the module.

1. What does an audit prove?

2. Why are bridges attractive to attackers?

3. Which check helps you judge an app’s promise?

Back to Experienced →

Back to Learn →