Independent DeFi security desk · Status: operationalMethodology & corrections · Submit an incident
DeFi Safety · Fact checked

How to Organize DeFi Research by Review Period

A practical note structure for documentation, transaction records, screenshots and follow-up checks.

This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.

DeFi Safety — illustration keyed to this article's identifier. Source documents are listed under Sources and are not reproduced here.

Research on a DeFi protocol goes stale on a predictable schedule, so the useful unit of organization is the review period rather than the topic.

Pick the period before you pick the folder

Most reading falls into one of three cadences.

A weekly period suits anything that changes daily: liquidity pool balances, utilization rates, borrowing rates, and the price of a token against its peg.

A monthly period suits parameter changes, treasury reports, incentive programs, and anything involving a vote or a governance proposal.

A quarterly period suits structural questions: how a protocol makes revenue, how concentrated its validator or signer set is, and whether the custody arrangement described in last quarter’s documentation still matches reality.

Writing the period into the filename is what makes a later audit possible. A note called lido-2026-10.md tells a reader how old it is without opening it.

What each period should contain

Every review period needs the same four blocks, even when most of them are short.

The first block is the state at the start of the period. Record the values you are going to compare against later, because a comparison needs a fixed baseline and a number written down three months ago is the only honest baseline available.

The second block is what changed. List the protocol announcements, governance votes, and parameter updates you actually read, with dates. If nothing changed, record that too; an empty change log is itself a finding and it prevents you from re-reading the same announcement next period.

The third block is what you verified yourself. Note the specific pages you opened, the figures you pulled from a block explorer, and the screenshots you saved. Distinguish clearly between a number you read yourself and a number a third party reported.

The fourth block is what remains open. Unresolved questions carry forward to the next period instead of disappearing.

Separate what you read from what you concluded

Research notes tend to blur together because both are written in your own voice. Keep them apart.

A reading note says: the documentation for this feature was updated on this date, and the parameter now reads this value.

A conclusion says: this change appears to reduce the risk of X.

Only the first kind can be checked by someone else. When a conclusion is recorded without the reading underneath it, a later reader has no way to tell whether the reasoning was sound or merely confident.

Handle screenshots as dated evidence

Screenshots are useful because they capture interfaces that change without notice. They are also easy to misfile.

Name each screenshot with the protocol, the page, and the date. Keep the date in the filename rather than trusting the file modification timestamp, because copying a file between machines rewrites that timestamp without changing what the image shows.

Attach each screenshot to exactly one review period. A screenshot that belongs to no period will eventually be cited as evidence for a claim made in a different one.

Keep a source list that can be re-checked

For each claim you intend to rely on, record the domain, the page, and the date you read it.

Domains matter more than page names. Protocol documentation moves between subdomains, and support articles get renumbered or retired without redirects. A domain plus a date lets a later reader find the current version even when your saved link is dead.

Keep the original list intact and add corrections in a separate note rather than editing the original entry. The value of the first record is that it shows what you believed at the time.

Decide what ends the period

A review period should end with a decision, even if the decision is to wait.

Common endings: the position is unchanged and no action is needed; the position is unchanged but a specific item must be re-checked next period; or the exposure is reduced because a documented limit was reached.

Write the decision down. A period that closes without one tends to be re-opened repeatedly, and re-reading the same material each month is the most common way research time disappears without any conclusion ever being reached.

Keep this separate from position sizing

Review periods organize reading. They do not decide how much to commit.

The distinction protects you from a specific failure: treating a well-documented protocol as a safe one. Thorough reading reduces uncertainty about what a protocol does. It says nothing about whether the outcome will be favorable, and no amount of documentation changes that.

Keep the two activities in separate notes with separate headings, and let the reading inform the decision without ever replacing it.

Sources