This is why we track realized APY for Solana DeFi strategies and deliver it to you for free. What are you waiting for to start using YieldCompass?

Ok @toly, a few months ago you called for the need of a "Moody's of Solana DeFi". We shipped it. And it is now live. It's more than time we start raising the information standards in DeFi. Feedback welcome.

If there is one thing the Drift exploit should remind us about risk: It's the weakest link in the chain that ultimately matters. Your smart contract can be very robust. But if your multisig gets compromised, it's game over. And that's what happened to Drift. ~$270M drained from a social engineering attack on multisig signers. I won't go into the details here and I'm genuinely sorry for those affected. But let's take this as an important reminder to all that DeFi carries unique risk vectors. As an industry, we should work together to promote better standards for risk so that DeFi users better understand what they're exposed to, and go beyond the "I put my SOL to work here because KOL x said it was a good farm." With that said, here are a few heuristics to keep in mind for better DD of risk: 1/ Complexity = risk. This one sounds obvious. But not enough people acknowledge that. As a rule of thumb, the higher the number of dependencies & complexity -> the higher the risk. For instance, an LST (like JitoSOL) is inherently less risky than a vault run discretionarily by a strategist across different markets and protocols. Every layer you add is another thing that can break. 2 / Upgradeability & multisig control is very important. Who can upgrade the contracts? How many signers? Are they actually different people? What emergency mechanism do you have in place? A 6/10 multisig where one entity controls all 10 wallets is a 1/1. A 2/5 where two signers get socially engineered and you are cooked. 3/ Never underestimate oracle dependency risk. A bad oracle setup means price feeds that can lag, get manipulated, or go stale and this is a known attack vector. Ask yourself: Does the strategy I'm in depend on an oracle? If yes, how robust is the oracle setup? 4/ Exit mechanism DeFi is not risky until it is. So you need to prepare accordingly. Before entering a strategy, understand the exit mechanism. Is there a primary market at all times? Is withdrawal FIFO, gated, or only dependent on secondary market? What happens if the front end goes down? You should be comfortable with the answer. 5/ Don't rely on TVL as a gauge of security Today, TVL is one of the most gamed metrics in DeFi. Points programs, private deals, and mercenary capital mean that TVL often says more about incentives than about trust. More TVL does not necessarily mean the strategy is safer. Don't confuse liquidity with security. I am building @yieldcompass (very early) to help bring more transparency around DeFi strategies on Solana with a proper framework for risk and return. DM me if you want to learn more or help improve the framework.