DeFi Protocol Development
Build DeFi protocols: AMM mechanics, liquidity pools, lending/borrowing, flash loans, and yield farming with security-first architecture.
DeFi (Decentralized Finance) protocols automate financial services on-chain: trading, lending, borrowing, and yield generation. Building DeFi requires deep understanding of economic mechanisms, smart contract security, and MEV (Maximal Extractable Value).
DeFi protocols handle billions in value and are exploited regularly. Security is existential-get formal verification or multiple audits before deploying with real funds. Start on testnets, build on established primitives (Uniswap v3, Aave) rather than reinventing.
Workflow
- Understand core DeFi primitivesDeFi protocols compose on top of proven primitives; understanding them prevents re-inventing (and re-breaking) the wheel.
- Implement price oracles securelyOracle manipulation is the #1 DeFi exploit vector; using spot price from an AMM as an oracle is dangerous.
- Design economic security (tokenomics and liquidations)Badly designed liquidation mechanisms or tokenomics can cause death spirals (see LUNA/UST collapse).
- Protect against MEV and front-runningOn-chain transactions are visible in the mempool before execution; MEV bots extract value by reordering them.
- Secure flash loan implementationsFlash loans enable capital-free attacks - if your protocol can be exploited with a flash loan, it will be.
Output Format
DeFi protocol with Chainlink oracle, TWAP price feeds, liquidation mechanism, slippage/deadline protection, flash loan integration, formal verification or audit.
Examples
Uniswap TWAP: `function getTWAP(address pool, uint32 secondsAgo) public view returns (int24 arithmeticMeanTick) { (int56[] memory tickCumulatives, ) = IUniswapV3Pool(pool).observe([secondsAgo, 0]); arithmeticMeanTick = int24((tickCumulatives[1] - tickCumulatives[0]) / int56(uint56(secondsAgo))); }`Slippage protection: `function swap(uint256 amountIn, uint256 minAmountOut) external { uint256 out = _calculateOut(amountIn); require(out >= minAmountOut, "Slippage exceeded"); _execute(amountIn, out); }`Flash loan: `function flashLoan(address receiver, address token, uint256 amount, bytes calldata data) external { uint256 fee = amount * 9 / 10000; IERC20(token).transfer(receiver, amount); IFlashLoanReceiver(receiver).executeOperation(token, amount, fee, data); require(IERC20(token).balanceOf(address(this)) >= before + fee); }`Edge Cases & Gotchas
- Re-entrancy via ERC-777 tokens: tokens with transfer hooks can re-enter during flash loans; use ReentrancyGuard on all external calls
- Precision loss: Solidity integer division truncates; multiply before dividing; use ray/wad math (1e18 = 1 WAD) for financial calculations
- Bridge exploits: cross-chain DeFi introduces bridge security assumptions; treat bridged assets as potentially not-1:1 with originals
When to Break These Rules
- For simple token distribution or DAO treasuries, full DeFi protocol complexity is overkill - use existing protocols (Uniswap, Aave) as infrastructure rather than building from scratch.
Reference Files
Uniswap v2 whitepaper: https://uniswap.org/whitepaper.pdfAave v3 docs: https://docs.aave.com/developers/DeFi Hack Analysis: https://rekt.news/ERC-3156 Flash Loans: https://eips.ethereum.org/EIPS/eip-3156