Independent DeFi security desk · Status: operationalMethodology & corrections · Submit an incident
DeFi Safety · Fact checked

How to Check a Dapp's Documentation Against Its Interface

A source-first comparison routine for interface labels, permissions and transaction steps.

This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.

DeFi Safety — illustration keyed to this article's identifier. Source documents are listed under Sources and are not reproduced here.

Documentation drifts. A project publishes a guide, then ships a version that renames a setting, moves a toggle, or changes what a confirmation means — and the guide keeps saying the old thing. Reading only the documentation is therefore not verification; it is reading one historical snapshot. The comparison itself is the check.

Start with the version number, not the feature name

Find the deployed version before comparing anything. Most interfaces expose it in the footer, in a settings panel, or in the page’s JavaScript bundle. If the docs describe “v2 of the staking contract” and the interface reports a different deployment, you are comparing a document to history. Every difference you find after that point is noise.

The three places drift shows up first

Approval wording. Docs written before a standard change tend to describe approve(spender, amount); interfaces built afterwards use permit or an increase-allowance flow. If the interface asks you to sign a permit with a deadline and an allowance cap, that is a materially different risk profile from a one-off approval, and older documentation frequently does not mention it.

Where the transaction actually goes. Documentation links to a contract address on an explorer. Interfaces change the address on upgrade. Compare the address the interface’s calldata targets against the address in the docs, character by character. This is the one difference worth stopping everything for.

What the confirmation dialog means. Many interfaces once showed “you are approving the contract to spend your tokens” and now show “you are authorising this position”. The second can mean a delegated operator rather than a spend approval. The wording change is not cosmetic, because the signature you are asked for has changed with it.

How to run the comparison without wasting an afternoon

  1. Open the docs in one window and the interface in another.
  2. Work through the single most consequential action the docs describe — the one that moves funds or grants a permission.
  3. At each step, note what the docs claim, what the interface asks for, and whether the difference is explainable by the version gap you found in step one.
  4. Anything left unexplained is either a docs bug or a problem with the interface. You cannot tell which from the outside, so treat it as the second.

When the documentation is simply absent

A project with no published technical documentation is not automatically unsafe — some are small and new — but the burden shifts to you. You are then relying on verification that costs more: a published audit, a verifiable deployment address that has been live for a meaningful period, an open-source repository whose deployed bytecode matches the source. Without any of these, the appropriate size of a first deposit is one you would be willing to lose entirely.

What this does not cover

This checks for inconsistency between what a project says and what its interface does. It does not evaluate whether the interface is well designed, whether the underlying contracts are correct, or whether the project’s governance can change the rules underneath you. A perfectly consistent interface can front a protocol that is unsound, and a documentation mismatch can be a stale blog post rather than a compromise.

Sources