How a DeFi protocol gets broken
DeFi protocols fail in three places: in the code that holds the money, in the data the code trusts, and in the integrations the code never planned for. Auditing the code without auditing the data and the integrations is auditing the wrong protocol.
The cost of a missed bug is paid in user funds. The cost of a finding marked Low when it should have been High is paid the same way.
What we look at first
Before we open a single Solidity file, we look at four things.
The composability surface. Every external protocol the contract calls, every protocol that calls into the contract, every token the contract holds, every callback the protocol exposes to outside code. DeFi protocols rarely fail on their own. They fail because of an interaction with a protocol nobody specified.
The oracle dependencies. Every price feed, every off-chain data source, every TWAP, every Chainlink aggregator, every internal price calculation. A protocol that uses spot price from a DEX as input to a liquidation calculation is a protocol with a flash-loan vulnerability. We have not opened the code yet, and the audit hypothesis is already formed.
The governance authority. The role list. Who can change parameters. Who can pause. Who can upgrade. The proposal-to-execution path. Whether the time-lock is real or a constructor argument that a single key can rotate.
The MEV exposure. Every operation whose result depends on the ordering of transactions in a block. Some of these are intentional (DEX swaps). The dangerous ones are accidental: liquidations that pay the wrong actor, governance votes that aren't time-locked, rebases that can be sandwiched.
Then we open the code.
The attack patterns
A reviewer hunting through a DeFi protocol carries a working pattern catalog.
Flash-loan price manipulation. Any operation that reads a spot price and acts on it in the same transaction is exposed to flash loans. The attacker borrows a stack of one asset, moves the spot price of a target pool with that stack, triggers the consuming protocol's action while the price is moved, and unwinds. We look anywhere a price is read from a DEX inside a transaction that also changes state.
Oracle staleness and deviation. The oracle was right ten minutes ago. The thing it is pricing has moved. The protocol does not check the timestamp on the oracle response, or it accepts a deviation that is too wide, or the fallback path is the same source. Each is a finding, in the operational sense of the word.
Governance hijack via flash voting. A protocol that lets users vote based on their balance at the time of the proposal is exposed to flash loans of the governance token. The attacker borrows the token, votes a malicious proposal, repays, waits for the time-lock to elapse, executes. The mitigation is snapshotting balances at proposal-creation block. The mitigation is sometimes implemented badly.
Reentrancy across composed protocols. Reentrancy inside a single contract is well understood, but not gone. Reentrancy across protocols (a callback into another protocol that then re-enters ours through a different entrypoint) is alive and well. ERC-777 receiver hooks, ERC-721 receiver hooks, and multicall patterns all enable this. We look anywhere an external call to an unknown contract happens before state settles.
Sandwich and front-running on accidental MEV. Some operations are inherently MEV-exposed (DEX trades). Some are accidentally exposed: a refund that anyone can claim, a rebase that adjusts user balances, a liquidation reward paid to the first liquidator. Each one is a sandwich target.
Bridge integration as a trust extension. A protocol that accepts bridged assets has extended its trust model to include every bridge that produced those assets. If a bridge is compromised, the protocol that accepts its outputs is compromised. We trace every accepted asset back to its mint authority.
Case anatomies
The case literature is the reference, not the curriculum.
The 2020 Harvest Finance attack used a flash loan to move USDC against USDT on Curve, depositing manipulated assets into Harvest's vaults at an inflated rate, then withdrawing at the same inflated rate. Approximately $34M extracted. The protocol's price calculation read spot from Curve. The pattern is published and named; we still find it in code under audit.
The 2022 Beanstalk governance hijack borrowed enough governance tokens through flash loans to immediately pass a malicious proposal that drained the treasury. Approximately $182M. The time-lock was a vote-weighted parameter that the same flash-borrowed tokens could elide.
The August 2021 Cream Finance exploit used reentrancy through an ERC-777 token (AMP) to re-enter Cream's borrowing logic before the first borrow settled. Approximately $18M. A reentrancy guard would have caught it. A separate October 2021 incident took roughly $130M through flash-loan oracle manipulation on yUSD pricing – same protocol, different mechanism.
The 2023 Curve Vyper-compiler-bug exploit (~$70M, July) is a different class. The Vyper compiler shipped with a reentrancy-lock bug for specific compiler versions; pools compiled with the affected versions inherited the bug regardless of their own defensive code. The pattern: a DeFi protocol fails because of an integration its author never specified, including the compiler.
These are not exotic. They are the patterns above, on production protocols, after audits.
Defensive primitives
A protocol that wants to survive the patterns above relies on a small set of defensive primitives.
Time-weighted average prices instead of spot. The cost is one block of latency. The benefit is that single-transaction price manipulation no longer works on the same target. Most modern lending protocols use TWAP for liquidation calculations.
Reentrancy guards on every external-call function, including the ones that look harmless. The cost is one storage slot per call. The benefit is closing an attack class.
Time-locks on every governance action, with no constructor-argument override. The cost is operational latency. The benefit is that the community can react to a malicious proposal before it executes.
Withdrawal queues on protocols holding large pools. The cost is user friction. The benefit is that an exploit-in-progress hits a wall instead of draining the pool atomically.
Pull-over-push for payouts. The cost is one extra transaction per claim. The benefit is that the receiver cannot reenter the sender.
MEV protection at the application layer. Flashbots Protect, MEV-Share, and similar private-mempool integrations move sensitive operations (large swaps, user-triggered liquidations, governance executions) off the public mempool. The cost is a centralized relay dependency. The benefit is that the operation cannot be sandwiched or front-run by anyone reading the mempool.
None of these defenses are novel. The protocols that get exploited usually skipped one or two of them. We check for all of them.
What we audit on a DeFi protocol
We audit the composability surface explicitly. We trace every external call, every token interaction, every callback. We pressure-test every oracle dependency for staleness, deviation, and manipulability under flash-loan conditions. We map the governance authority and check whether the time-lock can be bypassed. We model the MEV exposure of every state-changing operation.
The deliverable is the audit report described in our methodology: findings ranked by severity, reproducible evidence for every Critical and High, residual-risk section, and a fix-confirmation pass after patches.
What clean means
A clean DeFi audit means we did not find what we looked for. It does not mean the protocol is safe under composition with other protocols we did not audit. That is a different problem, and we say so explicitly.