Strategy 02 · DeFi & Yield

Protocol Diligence

No capital before review. No exception.

Every yield source in this mandate is a piece of software holding other people’s money under rules its authors wrote. The review of that software, its authors and its rules is the strategy’s primary risk control. It is done before deposit, repeated on a schedule, and its output is a limit.

Code

Audit history and the quality of the auditors; whether findings were fixed and re-audited; whether the deployed code matches what was audited; time in production without incident; the scope and payout history of any bug bounty. An unaudited protocol does not receive capital. A protocol whose latest deployment has not been audited is treated as unaudited.

Control

Who can change the protocol, how quickly, and what they can change. Admin keys and their custody arrangements; multisig thresholds and signer identity; time-locks on parameter changes and upgrades; whether governance can be captured by a token holder with a sufficient stake. A protocol whose administrators can drain or repoint funds without delay is a counterparty, and is sized as one.

Dependencies

Which oracles the protocol reads and how they can be manipulated; which other protocols’ tokens it accepts as collateral and what happens if they fail; which chains and bridges it runs across. A protocol is only as sound as the weakest dependency it cannot control.

Economics

Total value locked and how concentrated it is among depositors; how the protocol behaves in a liquidation cascade or a de-peg of a major collateral; whether yield is organic or emission-driven; the incentives of the largest participants. Historical incidents on the protocol and on forks of its code are read as evidence of how it fails.

Limits

The output of the review is not a yes or a no but a number: the maximum exposure the fund will hold in that protocol, and within it per market, per chain and per collateral type. Limits are reviewed when the protocol changes and on a fixed schedule regardless, and are reduced before they are breached rather than after.

Practice

How Wesvel approaches it

  • 01A written review covering code, control, dependencies and economics precedes any deposit, and is refreshed on a schedule and on any material change.
  • 02Protocols with unrestricted admin control are treated as counterparties and sized under counterparty limits.
  • 03Exposure limits are set per protocol, per chain and per collateral type, and are enforced by the systems that deploy capital, not by intention.
  • 04Incident response (pause, withdraw, hedge) is written in advance for each protocol in the book.

More in DeFi & Yield