How DeFi investing works, and its risks

A DeFi protocol replaces the bank or broker that would normally hold and manage an investment with a smart contract on a public blockchain. The Bank for International Settlements groups what people do with DeFi protocols into trading, lending and investment. Lending a protocol crypto means depositing it so a borrower can draw against it, earning interest funded by the borrower's payments. Supplying a liquidity pool means depositing two assets into a pool that a decentralized exchange uses to fill trades, earning a share of the trading fees. Staking, on some blockchains, means locking a token to help validate transactions in exchange for a reward. What is decentralized finance? covers how the underlying protocols work.

A DeFi lending protocol cannot run a credit check on an anonymous wallet, so it asks the borrower to post collateral worth more than the loan, and it sells that collateral automatically if its value falls below a set threshold. That collateral requirement, the BIS notes, is what keeps a lending protocol solvent without a bank's underwriting process behind it. An investor supplying capital to the lending side earns the interest borrowers pay; a borrower earns nothing directly, but can use the loan to make a leveraged bet on another asset.

A liquidity pool works differently: two investors' deposits form a pool, and the pool's exchange rate moves as traders swap between the two assets. When the price of one asset moves a lot relative to the other, a liquidity provider can end up with less value than if they had simply held both assets, a risk known in the field as impermanent loss.

ESMA has flagged "the lack of a clearly identified responsible party" as a risk to investor protection in DeFi, alongside newer forms of market manipulation such as maximal extractable value and flash loan attacks, where an attacker borrows and repays within a single blockchain transaction to manipulate a price along the way. The Financial Stability Board says DeFi "does not differ substantially from traditional finance in the functions it performs or the vulnerabilities to which it is exposed," and that crypto-assets which "lack inherent value and are highly volatile" magnify those vulnerabilities. A DeFi lending or liquidity position can also depend on a blockchain oracle for its pricing; oracle networks covers a case where a manipulated price feed let a trader withdraw more than 110 million dollars against inflated collateral.

None of this is investment advice, and no protocol named here is a recommendation. A person weighing DeFi investing checks who, if anyone, still controls the protocol's governance, since the BIS calls the gap between the DeFi name and the practice a "decentralisation illusion": running a protocol still needs some level of centralization, even where the marketing claims otherwise.

Finance Loop is the meeting place for people who study, build or invest in DeFi protocols in Germany, Austria and Switzerland. Finance Loop has a long-term partnership with BTC-ECHO, a Bitcoin and blockchain media platform in the DACH region, on crypto assets, DeFi and Web3. At a Chainlink panel at TechQuartier in Frankfurt, speakers from Chainlink Labs and FinPlanet discussed how DeFi meets traditional capital markets. Related pages: DeFi in Germany, DeFi in Frankfurt and onchain finance.

DeFi carries the risks of traditional finance plus risks of its own, according to the Financial Stability Board: operational fragilities, liquidity and maturity mismatches, leverage and interconnectedness, magnified by the volatility of the underlying crypto-assets. ESMA adds that DeFi usually lacks a clearly identified responsible party.

Impermanent loss happens when a liquidity provider's two pooled assets move in price relative to each other, leaving the provider with less combined value than if they had simply held both assets outside the pool. The loss becomes permanent only if the provider withdraws while the price gap is still open.

MiCA excludes crypto-asset services provided in a fully decentralized manner without any intermediary, under its recital 22. A DeFi protocol that still has a controlling company or governance group behind it is more likely to fall under MiCA's authorization rules, and BaFin decides that question case by case in Germany. DeFi in Germany covers where that line sits.