What Is DeFi? How It Works, Uses, Yield and Risks

Decentralized finance, or DeFi, is a collection of blockchain-based protocols that provide trading, lending, borrowing and other financial functions through smart contracts. A user normally interacts with these contracts from a self-custody wallet instead of opening a conventional account with a bank or broker. DeFi can make financial software open and verifiable, but it also transfers substantial security and transaction responsibility to the user.

This guide explains how DeFi works beneath the interface, where yield comes from, why lending positions are liquidated and how token approvals, price oracles, bridges and smart-contract dependencies create risks that a displayed interest rate does not reveal.

DeFi explained in plain English

A traditional financial application usually keeps balances in a private database and executes instructions through the company’s internal systems. A DeFi application sends transactions to smart contracts deployed on a blockchain. Those contracts contain rules for activities such as swapping tokens, supplying liquidity, borrowing against collateral or distributing rewards.

“Decentralized” is not an all-or-nothing label. A protocol can use immutable public contracts while still depending on a development team, governance vote, administrator key, hosted website, price oracle, centralized stablecoin or cloud-based interface. A careful user asks which components are decentralized and which parties retain control.

How a DeFi transaction works

A token swap or deposit may appear to require one button, but the complete process includes several distinct decisions.

1. The wallet connects to an application

Connecting usually shares a public address and lets the site request signatures. It does not by itself reveal the recovery phrase, and it should not transfer assets. A malicious interface can still prepare deceptive requests, so connection is not proof that a site is safe.

2. The user selects a network and action

The wallet and application must use the same blockchain. A token with the same symbol can have different contract addresses on Ethereum, an Layer 2 network or another chain. The user then chooses an action such as swap, supply, borrow, repay or withdraw.

3. A token approval may be required

Many token standards require the owner to authorize a contract to transfer tokens on the owner’s behalf. Approval is a separate onchain transaction from the later swap or deposit. The allowance can be limited to one amount or remain large enough for future interactions.

4. The application prepares a contract call

The interface encodes the selected amounts, routes, limits and recipient into transaction data. The wallet shows a confirmation request with the network fee and whatever details it can decode. Users should verify the destination contract, requested action and spending permission rather than treating every wallet prompt as routine.

5. The blockchain executes the smart contract

After the user signs and broadcasts the transaction, validators or miners include it in a block. Network nodes execute the same contract rules and agree on the resulting state. A successful transaction can move tokens, issue a liquidity-position token, create debt or update several protocols in one atomic operation.

6. The position remains onchain

A completed transaction does not mean risk has ended. Borrowing positions can approach liquidation, liquidity positions can lose value relative to holding, approvals can remain active and protocol parameters can change through governance.

The main components of DeFi

Blockchain: records transactions and executes protocol rules.
Smart contracts: programs that hold assets and enforce application logic.
Wallet: protects keys, displays assets and signs requests.
Tokens: represent transferable assets, claims, governance rights or protocol positions.
Stablecoins: provide units intended to track a currency or other reference asset.
Liquidity pools: smart contracts containing assets used for swaps, loans or settlement.
Oracles: deliver external prices or other data needed by protocols.
Frontend: the website or application that makes contracts easier to use.
Governance: the process for adjusting parameters, upgrading contracts or allocating treasury assets.

These components can come from different teams. A lending protocol may depend on a stablecoin issuer, oracle network, Layer 2, bridge and wallet provider. Each dependency adds capabilities and its own failure modes.

Protocol versus frontend

A DeFi protocol is the set of deployed contracts, governance rules and related infrastructure. A frontend is one interface that helps users call those contracts. If a website is offline or blocks a region, technically capable users may still interact through another interface or directly with the contracts—provided the protocol itself remains operational.

This separation does not make frontends unimportant. A compromised interface can display a false address, change transaction parameters or request a malicious signature. Bookmark verified domains, compare contract addresses with official documentation and treat search advertisements as untrusted.

Decentralized exchanges and token swaps

A decentralized exchange, or DEX, lets users exchange tokens through smart contracts while retaining wallet control until a transaction executes. Some DEXs use onchain order books, while many rely on automated market makers.

Automated market makers

An automated market maker, or AMM, calculates prices from assets held in liquidity pools. The exact formula differs by protocol and pool design. A trader sends one token into the pool and receives another, while the pool price moves according to the trade and available liquidity.

Routing

A swap router can search direct pools or multi-hop paths. Trading token A for token C may route through token B if that produces a better estimated result. Aggregators may compare several liquidity sources, but a more complex route can increase gas use and contract dependencies.

Slippage and price impact

Price impact is the change caused by the trade relative to pool liquidity. Slippage tolerance is the user’s permitted difference between the quote and execution. Setting tolerance too low can make a transaction fail; setting it unnecessarily high can expose the trade to a worse fill or transaction-ordering attacks.

Always review the minimum amount received, token contract, route, price impact and network fee. A ticker and logo can be copied by a scam token.

Liquidity providers and pool returns

Liquidity providers deposit assets into a pool so other users can trade. In return, they may receive a portion of trading fees and separate token incentives. The position’s value changes as traders alter the pool composition.

Concentrated-liquidity designs can let providers choose a price range. Capital may earn more fees while the market stays in range, but the position can become composed almost entirely of one asset after price movement. Active management, gas costs and range selection affect the result.

Impermanent loss

Impermanent loss describes underperformance of a liquidity position compared with simply holding the deposited assets when their relative prices change. The name can be misleading: withdrawing crystallizes the current result, and prices do not have to return.

Trading fees or incentives may offset the difference, but they are not guaranteed to do so. Evaluate total return after asset price changes, fees, rewards, transaction costs and taxes—not only the displayed annual percentage rate.

DeFi lending and borrowing

In a pooled lending protocol, suppliers deposit assets into smart contracts and borrowers draw available liquidity by posting collateral. Interest rates can adjust with utilization: when a large share of available liquidity is borrowed, rates may rise to attract supply and encourage repayment.

Most public DeFi loans are overcollateralized because the protocol generally does not know a borrower’s income or legal identity and cannot rely on conventional debt collection. Instead, the contracts protect lenders by allowing collateral liquidation when a position crosses a defined threshold.

Loan-to-value and liquidation threshold

Loan-to-value describes debt relative to eligible collateral value. The liquidation threshold identifies when collateral no longer provides the required buffer. Each asset can have different parameters based on volatility, liquidity and protocol governance.

Health factor

Protocols can summarize liquidation safety with a health factor or similar metric. On Aave, a health factor below 1 indicates that a position is eligible for liquidation. The value moves as collateral prices, debt prices, accrued interest and protocol parameters change.

Liquidation

When a position becomes eligible, an independent liquidator can repay part or all of the debt and receive collateral plus an incentive according to protocol rules. Liquidation is automatic contract execution, not a customer-support decision. A rapid price move or oracle update can trigger it before the borrower reacts.

Keeping a position barely above the displayed threshold is dangerous. Users need a buffer appropriate to asset volatility and must understand that interest and prices can change while they are offline.

Where DeFi yield comes from

Yield is not created merely because assets are placed onchain. Sustainable returns need an identifiable source:

fees paid by traders;
interest paid by borrowers;
protocol revenue shared under defined rules;
staking rewards securing a proof-of-stake network;
token incentives issued to attract users or liquidity.

Token incentives can increase a displayed annual rate without creating equivalent external revenue. If rewards are paid mainly through newly issued tokens, their market value can decline as recipients sell. Ask who pays the yield, why they pay it, which asset denominates it and what can reduce or stop it.

Yield farming, staking and lending are different

Activity	Primary return source	Important risks
Protocol lending	Interest from borrowers and possible incentives.	Smart contracts, bad debt, oracle and collateral risk.
Liquidity provision	Trading fees and possible incentives.	Impermanent loss, range, token and pool risk.
Network staking	Protocol issuance and transaction-related rewards.	Validator, slashing, lockup and asset-price risk.
Yield farming	Combines positions and often token incentives.	Layered contracts, leverage and reward-token dilution.

A platform can market several activities as “staking” even when the underlying position is lending or liquidity provision. Read what the smart contract actually does with the assets.

Stablecoins in DeFi

Stablecoins provide common quote, collateral and settlement assets. They can reduce exposure to day-to-day volatility of other cryptoassets, but “stable” describes a target rather than a guarantee.

Fiat-backed tokens depend on an issuer, reserves, banks and redemption terms.
Crypto-collateralized tokens depend on collateral value, liquidation systems and governance.
Synthetic or algorithmic designs depend on market incentives and can fail when confidence or liquidity disappears.

A pool containing several stablecoins can still suffer when one asset depegs. Low historical volatility is not proof that issuer, reserve, smart-contract or redemption risk is absent.

Why DeFi needs price oracles

A smart contract cannot independently know the external market price of an asset. Oracles collect or calculate data and deliver values that contracts can use. Lending protocols need prices to measure collateral and debt, while derivatives and stablecoins can depend on them for settlement.

An oracle that is stale, manipulated or unavailable can cause incorrect borrowing limits or liquidations. Strong designs consider multiple data sources, update conditions, liquidity, fallback behavior and the difference between a temporary DEX price and a broader market price.

Flash loans

A flash loan allows assets to be borrowed without traditional collateral if the loan is repaid within the same atomic blockchain transaction. If repayment does not occur, the entire transaction reverts.

Developers use flash liquidity for arbitrage, refinancing and position management. Attackers can also use it to obtain temporary market power for oracle manipulation or governance exploits. The flash loan supplies capital; the underlying vulnerability is usually unsafe protocol design or dependence on a manipulable price.

Bridges and wrapped assets

A bridge connects activity between separate blockchains or rollups. One design may lock an asset on the source network and issue a representation on the destination. Another may rely on liquidity providers, message validators or native burn-and-mint controls.

Bridging adds security assumptions beyond either chain. Users should identify the official token contract, bridge operator or validator model, withdrawal delay and what claim a wrapped asset represents. A successful destination transfer does not eliminate source-chain, custodian or smart-contract risk.

Layer 1 and Layer 2 DeFi

Layer 2 networks can offer lower fees and greater transaction capacity while settling data or proofs to another blockchain. They may use different bridge contracts, withdrawal procedures, sequencers and security stages.

An address beginning with the same characters on two EVM-compatible networks does not make the balances interchangeable. Verify the selected chain in the wallet, application and receiving service. Keep enough of the network’s native asset to pay gas for later actions.

Token approvals and wallet signatures

Four actions that look similar can have very different consequences:

Connect wallet: shares the selected public address with the site.
Sign a message: proves control or authorizes typed data; some signatures can carry powerful permissions.
Approve token: grants a contract an allowance to transfer a specified token.
Send transaction: submits an onchain action that can move assets or change protocol state.

An unlimited approval can remain active after the original swap. If the approved contract or permission path is later exploited, the remaining allowance can matter. Prefer limited allowances when practical and periodically revoke approvals that are no longer needed. Revocation is itself an onchain transaction and cannot recover assets already transferred.

Benefits of DeFi

Open access: compatible wallets can interact without a traditional account relationship.
Self-custody: users can retain control until a signed transaction executes.
Verifiability: contract code, balances and transaction history can be inspected onchain.
Composability: applications can connect to other protocols and reuse tokenized positions.
Programmability: settlement and risk rules can execute automatically.
Market availability: public contracts can operate continuously while the underlying network is available.

These benefits are capabilities, not promises of profitability or safety. Open access also lets attackers interact with protocols, and composability can transmit a failure across several applications.

Major DeFi risks

Smart-contract vulnerabilities

Code can contain logic errors, unsafe assumptions or upgrade flaws. An audit can reduce uncertainty but does not prove the absence of vulnerabilities. Review audit scope, contract version and whether reported issues were resolved.

Administrator and governance control

Upgrade keys, pause functions and governance votes may change protocol behavior. A multisignature wallet can reduce dependence on one key while still concentrating authority among a small signer group.

Oracle and market manipulation

Illiquid prices can be moved sharply. If a protocol trusts a manipulable source, an attacker may borrow against inflated collateral or trigger unfair liquidations.

Liquidation and leverage

Borrowing against volatile collateral magnifies risk. Recursive strategies can create several linked positions whose safety deteriorates quickly during a market move.

Frontend and phishing attacks

A legitimate protocol can be accessed through a fake or compromised website. Wallet prompts are the final authorization boundary, so verify the domain and decoded request.

Bridge and cross-chain risk

A bridge can fail even when both connected chains continue operating. Wrapped assets can lose backing, liquidity or redemption access.

MEV and transaction ordering

Validators, builders and automated traders can observe pending activity and influence transaction order. Large or high-slippage swaps can be exposed to sandwich-style trading and worse execution.

Stablecoin and token risk

A token can depeg, be frozen, contain transfer restrictions or lose liquidity. Verify both the protocol and every asset deposited into it.

Network and gas risk

Congestion can make an urgent repayment or collateral deposit expensive or slow. A user without enough native gas token may be unable to protect a position.

Is DeFi really decentralized?

Evaluate decentralization component by component:

Can administrators upgrade or pause the contracts?
How are governance tokens distributed and delegated?
Which signers control emergency actions?
Does the protocol depend on one frontend, RPC provider or sequencer?
Can a stablecoin issuer freeze collateral?
Which oracle and bridge systems are required?
Can users exit through the contracts if the team disappears?

A project can be non-custodial but still have centralized governance. Another can have distributed governance but depend on a centralized asset. Avoid reducing a complex control model to one marketing label.

DeFi versus centralized finance

Question	DeFi	Centralized finance
Asset control	Usually a user wallet interacting with contracts.	A company records and controls customer balances.
Execution	Public smart contracts and blockchain settlement.	Private internal systems and company policies.
Account recovery	Usually depends on the wallet backup.	May use identity verification and customer support.
Transparency	Onchain positions and transactions can be inspected.	Internal liabilities and controls may be private.
Main risks	Contracts, keys, oracles, liquidation and bridges.	Custodian failure, freezes, breach and counterparty risk.

Neither model is universally safer. The relevant question is which risks the user understands and can manage.

How to start using DeFi more safely

Learn how the wallet displays connections, signatures, approvals and transactions.
Create a separate wallet for application use instead of exposing long-term holdings.
Fund it with a small amount and enough native token for gas.
Reach the application through verified official documentation or a saved bookmark.
Confirm the blockchain, token contract and protocol contract.
Read the transaction simulation or decoded wallet request.
Use a limited approval when practical.
Review minimum received, price impact, slippage and all fees.
Start with a small transaction and verify the result in a block explorer.
Monitor open positions and revoke permissions that are no longer required.

Never enter a recovery phrase into a DeFi website. A protocol interaction requires wallet signatures, not disclosure of the secret that controls the entire wallet.

How to evaluate a DeFi protocol

Contracts: are addresses verified, source code published and current deployments documented?
Control: who can upgrade, pause or change parameters, and is there a delay?
Audits: which code version and features were reviewed?
Economic design: where do yield and incentives originate?
Assets: what issuer, liquidity, collateral and freeze risks exist?
Oracle: how are prices calculated and what happens during an outage?
Liquidity: can users exit without extreme price impact?
Dependencies: which bridges, networks, frontends and external protocols are required?
Incident response: are pause controls and disclosures clear?
History: how long has the exact contract version operated with meaningful usage?

A large displayed deposit total or famous brand does not replace this review. Protocol conditions can change after an upgrade or governance decision.

Taxes and regulation

DeFi does not have one global legal or tax treatment. A swap, reward, loan, liquidation, liquidity deposit, wrapped token or bridge transfer may be classified differently depending on jurisdiction and facts.

Keep transaction hashes, wallet addresses, token quantities, timestamps, fiat values, fees and notes about the purpose of each transaction. Blockchain history alone may not explain ownership, cost basis or the legal nature of a position. Seek qualified local advice where reporting consequences are significant.

Frequently asked questions

Does DeFi require identity verification?

Many public contracts do not perform identity checks, but frontends, fiat providers and regulated services can restrict access or require verification. Local law still applies even when a contract is permissionless.

Is DeFi anonymous?

Usually not. Public addresses are pseudonymous, and their transaction histories are visible. Exchange records, address reuse and analytics can connect activity to a person or organization.

Is connecting a wallet safe?

Connection alone generally shares public account information, but the site can then request dangerous approvals or signatures. Safety depends on the domain, wallet prompt and subsequent authorization.

Can a DeFi transaction be cancelled?

A confirmed blockchain transaction normally cannot be reversed. A pending transaction may sometimes be replaced through wallet and network-specific methods, but users should not rely on cancellation as a safety control.

Can a user lose more than deposited?

Many isolated positions limit direct loss to supplied assets, but borrowing, leverage, derivatives or obligations across protocols can create additional exposure. Understand every linked position before signing.

Why does DeFi borrowing require collateral?

Public protocols usually cannot assess identity and future income or enforce unsecured debt through courts. Overcollateralization and automated liquidation protect pool solvency without traditional underwriting.

How is DeFi different from Bitcoin?

Bitcoin is primarily a peer-to-peer monetary network with its own asset. DeFi refers to programmable financial applications, most commonly built on smart-contract networks. Read What Is Bitcoin? for the Bitcoin network, mining and wallet model.

Key takeaways

DeFi uses blockchain smart contracts to provide trading, lending and other financial functions.
A non-custodial interface does not guarantee that every protocol component is decentralized.
Yield must come from fees, borrowers, protocol revenue, staking or token issuance.
Approvals, liquidations, oracles, bridges and stablecoins introduce risks beyond asset-price volatility.
Audits reduce uncertainty but cannot guarantee that contracts are safe.
Users should verify networks, contracts, wallet prompts and permissions before every material transaction.

Last reviewed: September 18, 2026. Protocol contracts, interfaces, risk parameters and regulations can change. Confirm current information in official documentation before committing funds. This guide is educational and does not constitute financial advice.