This guide is educational and is not financial advice. Crypto loans and crypto lending carry a risk of losing money. Check current terms directly with any platform before using it.
“Audited” is one of the most common claims on DeFi lending sites. An audit is useful evidence, but it is not a guarantee. This guide explains what an audit of a lending protocol checks, how to read a report and what risks remain.
What a smart contract audit is
An audit is a time-limited review of a protocol’s code by an external security firm. Auditors look for bugs and design flaws, classify findings by severity and check whether the team fixed them. Well-known firms include Trail of Bits, OpenZeppelin, Nethermind, PeckShield and Runtime Verification.
What auditors check in lending protocols
- Accounting: interest, shares and balances are calculated correctly and cannot be manipulated.
- Liquidations: undercollateralized positions can be liquidated, and liquidators cannot extract more than intended.
- Oracles: price feeds cannot be manipulated to borrow too much or trigger false liquidations.
- Access control: admin functions are restricted and upgrades are controlled.
- Edge cases: rounding errors, reentrancy and unusual token behaviour.
How to read an audit report
- Check the scope: which contracts and which code version were reviewed.
- Check the date: code deployed later may not be covered.
- Look at findings by severity and whether each was fixed, acknowledged or disputed.
- Check whether the deployed contracts match the audited code.
What audits do not cover
- Credit risk: whether borrowers will repay.
- Economic design flaws outside the review’s scope.
- Off-chain components, admin key security and operational mistakes.
- Code changed after the audit.
Checklist for lenders
- At least one recent audit by a recognised firm covering the deployed code.
- A public bug bounty programme.
- A track record of operating without major incidents.
- Clear information on admin keys, upgrades and emergency controls.
See also: how crypto lending works.
Our standards
This article was researched from primary sources and checked by a second person before publication. Found an error or an outdated number? Tell us and we will correct it. Corrections policy.
