DeFi is a marketing word for applications that settle on a public chain instead of in a company’s database. The useful picture is a vending machine: you put coins in, the machine runs its code, coins come out — or they do not. There is no manager to complain to if you pushed the wrong button. There may be an admin key that can pause the machine. There may not. Both designs exist. “Decentralised” is a spectrum, not a halo.
Most of what you will meet still lives on Ethereum or on a network that copies its account model. Ethereum without the jargon is the chain. This page is the applications. Compound’s 2020 COMP drip is the dated peg for “DeFi summer”. We are not writing a second overlapping TVL explainer. We are writing the risks that were already in the contracts when the screenshots were green.
The approval is the front door
On Ethereum, a token lives in a contract. To let an application move that token later, you sign an approval: a permission for that application’s contract to pull up to some amount. Unlimited approvals are convenient. They are also a spare key to that token, sitting with whatever the application becomes tomorrow — including a hacked front end, an upgraded implementation, or a lookalike site you did not notice.
Revoking approvals you do not use is hygiene, like taking the house key back from a flatmate who moved out. A surprise token in the wallet is often bait to make you visit a site that asks for a new signature. Ignore it. The security checklist covers the phishing half. This paragraph is why DeFi users get drained without “losing the seed”: they signed a permission.
A verified contract on an explorer is not a safety certificate.
An audit is a snapshot of some code on some date, not a lifetime guarantee.
“Sign to login” and “sign to approve spending” are different actions. Read the wallet’s warning.
Swaps are pools, not shopkeepers
A typical decentralised exchange is an automated market maker: a pool of two assets, a formula that sets a price from the ratio in the pool, and a fee for people who provided the assets. You are not buying from a person who goes to fetch inventory. You are trading against the pool. Large trades move the price inside the pool (slippage). Thin pools move more. Front-running and sandwiching are what it looks like when other people’s bots see your trade in the waiting room and stand in front of you. You do not need a how-to. You need to know that a public mempool is a public mempool.
Providing liquidity — depositing both sides of the pool — earns a share of fees and takes a different risk: if the price of the two assets diverges, you can end up with more of the one that did worse. People call that impermanent loss, which is a calming name for a permanent change in what you hold if you withdraw at the wrong time. It is not a glitch. It is the formula.
Lending is a liquidation engine with a friendly form
A lending protocol lets you deposit an asset as collateral and borrow another. If the collateral’s price falls relative to the debt, the protocol sells the collateral to pay the lenders. That sale is a liquidation. It is the product working. Keepers (bots, not knights) do the selling when it pays. In a crash, gas spikes, keepers miss, and auctions go ugly. Black Thursday 2020 on Maker was weather plus that engine. We wrote it as news. The lesson for this guide: a loan on a chain has no hardship department.
Interest rates on these protocols are utilisation maths, not a central bank. They can jump. Borrowing to farm a second token is how 2020 felt clever. It is still a loan. The second token can fall faster than the interest. We will not rank farms.
Oracles are how the contract learns a price
A smart contract cannot look out the window. It is told a price by an oracle — a feed, a committee, a formula on other pools. If the feed is wrong, the liquidations are wrong. If the feed can be shoved around in a thin market, someone will try. That is not a puzzle we will set. It is why “the code is the code” still depends on data someone else supplied. Read whether a protocol you cannot name uses an oracle you cannot name. If both answers are shrug, you are guessing.
Admin keys, pauses, and “governance”
Some contracts can be upgraded. Some can pause. Some can change parameters with a token vote that a few large holders dominate. Some cannot, which is safer against a rogue team and worse if a bug needs a patch. Governance tokens you dump on a pool the same afternoon are coupons, not board seats. Compound’s COMP distribution was an incentive design. Treat a vote you will not read as a coupon.
A pause button can freeze your coins inside the contract while the team investigates. That can protect you from a drain. It can also strand you. Both have happened in this industry. The white paper’s adjectives will not tell you which. The admin-key documentation might.
How this is not an exchange login
On a custodial exchange, a freeze is a company decision and a support ticket. In DeFi, a freeze is a function call, or a lack of one. You can usually see the contract. You cannot usually sue it. You can lose money to a bug, an oracle, a liquidation, an approval, or a fake site that looks like the real application. You can also use these tools for years with small amounts and learn the send screen. Tuition is an amount you can afford to see stuck or gone. A life-changing deposit into a pool you found on a thread is not tuition.
What this guide will not do
It will not tell you where the yield is. Yield is someone else’s risk plus an emission. It will not tell you to “ape”. It will not walk through exploit steps. It will not pretend TVL is a safety rating — the same dollars get counted in circles. It will not tell you DeFi is fake or that it replaced banks. It is software. Software has bugs. Banks have hours and lawyers. You are allowed to prefer either. You are not allowed to confuse them.
If you still want to look, use a wallet you restored from a phrase that never touched a browser extension you do not remember installing. Match the network. Revoke approvals you are not using. Read the contract’s pause story. Then decide whether you needed to have a position today. Most days you did not. See how to read a crypto headline without getting played when the screenshot of a green APY arrives. Nothing here is an instruction to supply, borrow, swap, buy, or sell any token.
