How to judge a protocol's risk
A practical framework to size up any Solana app in ten minutes: contracts, keys, oracles, liquidity, team and track record.
Solana DeFi has had real losses, even in 2026: Drift was exploited for about $285 million in April before relaunching as Velocity, and Raydium lost $1.34 million from a retired program in June. Audits and big names reduce risk; they don't remove it. This framework helps you size any position.
The ten-minute check
1. What's the yield source? Borrowers, trading fees, staking, real-world income, or token incentives? If you can't name it, don't deposit.
2. How old is it, and how big? Code that has held large deposits for years is battle-tested in a way new code isn't. Check TVL history on DefiLlama: steady growth beats a sudden spike from incentives.
3. Audits and bug bounty. Who audited, when, and was the current version covered? A public bug bounty (Kamino, Orca and Exponent all run one) pays white hats to report instead of exploit. Formal verification, like Certora's review of Kamino Lend, is a strong extra.
4. Who can change the code? Most Solana programs are upgradeable. Is the upgrade key a single wallet, or a Squads multisig? Is there a timelock that gives users time to exit before an upgrade? Kamino, for instance, uses a 5-of-10 multisig with a 24-hour timelock.
5. Oracles. Lending and perps depend on price feeds. Which oracle, and what happens if it fails or is manipulated? In September 2026 the Switchboard oracle network announced it was shutting down, forcing integrators to migrate.
6. Liquidity to exit. Can you withdraw today at fair value? Watch utilization on lending markets and redemption queues on yield products.
7. Team and track record. Public team, history of incidents, how they handled them. Loopscale resolved its 2025 exploit within 72 hours and re-audited; that response matters.
A simple scoring habit
| Factor | Lower risk | Higher risk |
|---|---|---|
| Age | 2+ years live | Weeks |
| Yield | Fees, interest, staking | Mostly incentives |
| Keys | Multisig + timelock | Single key |
| Audits | Several, recent, public | None or outdated |
| Exit | Instant at fair value | Queues, thin pools |
Position sizing
Spread larger amounts across several protocols. Cap what goes into anything new. Treat yields above roughly 15% on stablecoins as a sign of extra risk, not a free lunch. And remember that stacking products (an LST, in a lending market, looped, with a PT on top) multiplies the ways things can fail.
Key takeaways
- Every DeFi position stacks risks: wallet, chain, contracts, oracles, collateral, leverage.
- Check audits, age, TVL history, upgrade keys and bug bounty before depositing.
- Upgradeable contracts behind a multisig with a timelock are safer than a single key.
- Size positions so no single protocol failure hurts badly.
Check yourself
3 questions. Get them all right to mark this lesson complete.
Try it
Facts checked Oct 19, 2026. Educational content, not financial advice.
