Protocol Autopsist @Chainlink views my own and not financial advice
Joined November 2014
- Tweets2.5K
- Following595
- Followers318
- Likes2.5K
How about we make this DeFi United thing permanent? Like top protocols and orgs in the space come together to create an insurance fund sort of DAO and offer support to protocols in case of hacks where its deemed justified to.
Circle Ventures is purchasing $AAVE tokens because strong DeFi infrastructure does not build itself. Aave is helping to shape the future of onchain finance, and we’re backing that ecosystem and the entire community built around it.
DeFi United
Great to see the DeFi community stepping up to donate to Aave in the light of losses due to KelpDAO exploit however Aave has $220 million+ funds in safety module to use exactly for the times like this wondering if any amount from it will be utilized now.
A lot has been talked about 1/1 DVN issue in the KelpDAO exploit however what I am more concerned about is how were the RPCs poisened in the first place? No of DVNs wouldn't have mattered much in this case exploit would have still happened.
Like where your head’s at but this security metric breaks pretty fast under scrutiny: 👇
1. DSPR punishes scale, not risk
once you cross a certain security threshold, extra spend has brutal diminishing returns.
- a $5B TVL protocol might be way more battle-tested + hardened but show lower DSPR than some $50M farm throwing money around.
you end up rewarding inefficiency, not actual security.
2. completely gameable numbers:
a huge chunk of real security spend isn’t cleanly onchain (audits, internal teams, private bounties).
and even if you force “onchain receipts”, protocols can just… loop money, overpay friendly auditors, or label random spend as “security”.
you’re basically trusting self-reported accounting in a trust-minimized system lol.
3. Spend ≠ competence
throwing $$$ at security doesn’t mean shit if:
– audits are low quality
– findings aren’t actually fixed properly
– architecture is flawed at the base layer
– team just doesn’t have security culture.
we’ve seen protocols spend millions and still get nuked.
4. no signal on what actually matters
this ignores the real primitives of security:
code quality, formal verification, invariant testing, upgrade patterns, key management, time in market, exploit history, etc. Those are the things LPs actually care about, not some expense ratio.
5. perverse incentives teams could optimize for “looking secure” (high DSPR) instead of being secure. classic metric gaming → same shit tradfi did with ratings pre-2008.
imo if you want a real “DeFi risk premium” input, it has to be composite
+ behavior-driven, not just financial:
– code audit depth + auditor quality
– % of code formally verified
– bug bounty size and payout history
– time since last exploit / incident response quality
– upgradeability + admin key risk
– onchain monitoring + circuit breakers
yes, then maybe security spend as a minor factor
DeFi has lost between $730M and $3.1B to exploits every single year since 2021.
TVL has swung from $175B peak to $45B trough and back above $100B.
The loss rate as a % of TVL is 1–3% / year depending on the cycle.
I've been thinking about a simple metric to price this risk: the DeFi Security Premium Ratio (DSRP).
DSPR = Security Spend / TVL.
Reported quarterly. Both sides verifiable on-chain.
Five tiers: Hardened (>1%) / Protected (0.5–1%) / Baseline (0.2–0.5%) / Underspending (0.05–0.2%) / Exposed (<0.05%)
DSPR acts as a yield pricing input.
Low DSPR = higher required yield to compensate LP for security risk.
High DSPR = protocol earns a lower cost of capital.
We need a ratings mechanism on chain to price yield
Any protocol that is underspending in security needs to be called out and either spend more, divert more fees to an insurance fund, or both
@Blockworks you should add it to the token transparency portal. but now do one for protocol health
L1s should also carve out % of validator rewards or fees to DeFi protocols taking security seriously
Need to think more about how to verify and create manipulation-resistant security spend receipts @_SEAL_Org - any ideas?
are you a @Dolomite_io lender? run away with your funds as fast as you can.
It's absolutely nuts of them for not having optimum collateral caps for both WLFI and USD1 on such thin liquidity.
Current Uniswap V3 liquidity of USD1/USDC pool is $1.4M. The deepest WLFI pool is $6.12M.
If liquidators try swapping a USD1 amount greater than $4.7M the slippage is 80%+ making liquidation futile.
It's even worse for WLFI due to poorly optimised liquidity with slippage going berserk for swaps as low as $500K.
Even 0.5% of the WLFI pool can't be liquidated at profit and will result in bad debt.
This is just a time bomb at this point and lenders are going to be toast.
Don’t be exit liquidity for Trump’s cartel:
They deposited $484M of $WLFI tokens to borrow USDC.
Those loans will likely never be repaid.
Instead, when Trump leaves office, or even after the midterms if Republicans lose, $WLFI will dump, and Dolomite will be stuck with BAD DEBT.
As a result, USDC lending rates are at 13.5%. But even that APY isn’t worth the risk of not being able to withdraw your deposit.
Everyone knows this.
No surprise Dolomite's $DOLO trades at just $15M market cap because it's a turkey getting ready for Thanksgiving.
It's concerning how many of DeFi exploits lately have been non smart contract related. We have become TradFi with extra steps and mediocre security.
All crypto companies at this point should have a mandatory strong Ops security training plan/course for employees.
Been thinking about how delta-neutral stablecoins like
@ethena can manage funding risk as a first-order balance sheet problem. Put together a research piece with stress tests and hedge structures using @boros_fi. Curious to know your thoughts here @tn_pendle @PendleIntern @gdog97_
While @jumperapp is one of my fav bridge aggregators I can resonate with some of the annoying UX issues that @idlyboy_ dissected 👇
@jumperapp's UX makes me want to bang my head on a wall:
> There are two tabs - “Exchange” and “Gas”. They look identical.
> Same From/To, same token selectors, same layout. I'm supposed to investigate the difference between the two???
> I see a big callout + toggle that says “Get Arbitrum gas” and a CTA like “Get gas”
WTF does that mean in plain English?
> Am I getting ETH on Arbitrum deposited into my wallet?
> Is it a one-time gas subsidy just to complete this transaction?
> Is it a separate “buy gas” flow that happens instead of my swap?
> Is it bundled into the route as an extra leg? If yes, why is it not shown clearly?
FFFFFFUUUUUUUUUCCCCKKKKKKKKKK KMN
cryptickatz retweeted
(1/13)
@jumperapp is @lifiprotocol's bridge aggregator frontend and aims to be a 'super-app' for DeFi users. As much as I think that the LIFI team is cracked, the 'Exchange' tab (and pretty much the entire app) screams missed opportunity in the Consumer Product-UX department.
Love seeing this level of UX thinking applied to aggregators. A lot of churn really does come from tiny frictions between landing -> swap that teams underestimate.
(1/13) @matchaxyz is a clean DEX aggregator frontend, but some UX misses stand out and drives frustration/churn. In this thread, I teardown the landing → swap flow on the web app (I don't have access to user analytics data/funnels, so I might be wrong about some callouts).
Ending 2025 with nothing to show for it:
• lost 500k
• lost my network
• family falling apart
• depression
• months of coping + disappointment
• lost the most beautiful girl I’ve ever met
Five years evaporated, feels like I wasted everything, and I've become the waste.
