Independent DeFi security desk · Status: operationalMethodology & corrections · Submit an incident
DeFi Safety · Fact checked

How to Read DeFi Documentation Before a First Deposit

A preparation sequence for finding risks, limits, eligibility and withdrawal details.

This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.

DeFi Safety — illustration keyed to this article's identifier. Source documents are listed under Sources and are not reproduced here.

Reading documentation before a first deposit is the one step that costs you nothing and can save the whole amount. The documentation is where the protocol states its deposit cap, its withdrawal delay, its emergency controls and its fee rules. Every one of those numbers decides what happens to your money, and none of them appear on the deposit button.

Most people read it afterwards. They read it when a withdrawal is stuck, when a cap has been hit, or when a transaction reverted for a reason nobody could name. At that point the deposit is already made and the document is only useful for complaint writing.

Reading it first takes four passes, and each pass asks a different question.

Pass one: confirm the document belongs to the protocol

Check three things before you read a single clause.

The domain comes first. A site claiming to publish a protocol’s documentation can sit on a subdomain that has nothing to do with the protocol. The real documentation is served from the project’s own domain. You cannot infer that address from the project’s name.

The date comes second. Documentation changes, and a page with no visible update date should be treated as older than it appears. A deposit cap described two years ago may no longer exist. A withdrawal function may have been removed.

The network comes third. The same function can behave differently on two networks. A withdrawal that is instant on one network can sit behind a queue on another. If the document does not state which network each rule applies to, that silence is itself a finding.

If any of the three fails, stop. Not because the document is fake, but because you are about to deposit against text of unknown origin and unknown age.

Pass two: the deposit limits, not the withdrawal limits

Look for the limits that apply to entering the position. This is where first deposits are actually constrained.

There is usually a per-asset cap. There is often a protocol-wide cap. The first says how much you can add. The second says how much the system can accept in total.

These caps are asymmetric, and the asymmetry works in your favour. When an asset reaches its cap, new deposits are usually blocked while existing participants can still withdraw. The cap is a filter on entry, not a door that closes for everyone inside.

Then look for a waiting period on entry. Some markets impose one so the system can reconcile its state before a position can exit. If such a period exists, your deposit is not a spendable balance. It is a position with a date attached.

Write down both numbers before you continue. If you cannot find a cap anywhere in the documentation, treat the absence as an unanswered question rather than as an absence of limits.

Pass three: what it costs to get out

The exit side is the pass people skip, and it is the one that costs the most when it turns out to be wrong.

Gas is charged on the way in and on the way out. A plain transfer costs about 21,000 units of gas. A deposit into a liquidity pool or a lending market costs more, because the contract does more work. The fee is the gas used multiplied by the cost per unit, and it is paid whether the transaction succeeds or fails.

That last point matters more than it sounds. A failed transaction still costs gas. An operation that runs out of gas partway through reverts the state change, but the gas already spent is still charged to you.

Check whether your exit is one transaction or several. A withdrawal that requires a claim step, a cooldown and a final redemption is three chances to be delayed or to meet a moving condition. An interface that shows a single withdraw button may still be running a multi-step process underneath.

Also look for withdrawal fees and for any lock-up period. A protocol that documents neither is not necessarily unsafe, but you should be certain you saw the absence rather than assuming it.

Pass four: who can stop it

Every documentation set describes controls, and your job is to find who holds them.

Look for a pause function. Look for an upgrade key. Look for a withdrawal cap that an administrator can lower. These are normal features of deployed systems, and their existence alone is not a warning. What matters is whether the documentation names the role that can use them and whether that role is a multisig with published signers or a single address.

A protocol that documents its admin role, publishes the signer set and links the addresses is telling you how to check on it later. A protocol that documents nothing about control leaves you unable to answer the question at all.

Record each control next to the address or role that holds it. That list is the thing you re-check periodically, because it is the part most likely to change without an announcement.

A working order

Read in this order and keep notes. Identity of the document, meaning domain, date and network. Entry limits, meaning per-asset cap, protocol cap and any entry waiting period. Exit conditions, meaning number of steps, gas cost, fees and lock-up. Administrative controls, meaning pause, upgrade and withdrawal caps with the addresses attached.

Then answer one question before you deposit: is this position something you can leave on demand, or is leaving a process with a queue and a date on it?

If the answer is a process, size your first deposit as a test of that process rather than as a commitment to the protocol.

What the documentation cannot tell you

A document does not tell you whether the contract holding your deposit matches the one described. It does not tell you whether the interface you are reading is the real one. It does not tell you whether the yield figure was generated from real activity.

Those are separate checks, against the deployed contract and the transaction history. What the documentation can do is tell you the conditions before you are exposed to them, which is the only point at which the information still has value.

A protocol that publishes dated documentation on a network-specific basis has already done the harder half of the work. Reading it first is what turns that work into a decision instead of a surprise.

Sources