How DeFi
protocols fail.
Each analysis examines a class of DeFi protocol, the historical exploits that have targeted it, and the attack vectors that remain live in protocols being built today. Drawn from public post-mortems, on-chain data, and Deep Guard's threat modeling work.
Governance Protocol
Every governance protocol introduces a mechanism for changing protocol behaviour through a vote. That mechanism is also an attack vector. When voting power can be borrowed, proposal execution skips a timelock, or proposals can carry hidden code, the entire protocol becomes an adversarial surface. This analysis examines how governance protocols have been exploited across DeFi history and what the threat model looks like for any team building in this space.
Cross-Chain Bridge
Between 2021 and 2023, bridge exploits accounted for approximately 50% of all DeFi hack losses by dollar value. The reason is not poor implementation — it is that the fundamental security problem of a bridge is unsolved. Any mechanism that releases funds on chain B based on an event on chain A must trust something to verify that event. Every design decision about what that something is and how verification works is a potential attack vector. This analysis examines the structural vulnerability classes that have produced the largest losses in DeFi history.
On-Chain Perpetuals & Derivatives
Perpetuals protocols combine price oracles, liquidation engines, collateral accounting, and fee mechanisms in a tightly coupled architecture where errors in any single component can be used to drain the entire system. The liquidation path is particularly dangerous: it involves external calls, collateral transfers, and position state updates that must occur in a precise order and with no re-entrancy exposure. This analysis examines the historical exploits that have targeted on-chain derivatives protocols and the threat model that any perpetuals team must understand before deployment.
Building one of these protocol types?
Talk to a Deep Guard engineer about your specific threat model before you deploy.