Smart contract risk: when the code itself fails

What smart contract risk is

A smart contract is a program stored on a blockchain that runs exactly as written whenever someone sends it a transaction. In DeFi, that code holds the deposits, sets the interest rates and decides who may withdraw. Smart contract risk is the chance that the code, or the people who control it, behave in a way you did not expect, and your funds are lost, frozen or taken.

The hard part is that a blockchain does not care about intent. If a contract has a flaw that lets someone withdraw more than they deposited, the network processes that withdrawal as faithfully as any other. There is usually no help desk, no chargeback and no deposit insurer standing behind the code.

How it happens

Most smart contract losses trace back to a handful of mechanisms. Knowing them helps you ask better questions before you deposit anything.

• Plain bugs. A rounding error, a missing check or a function that can be called in an unexpected order. Code that handles money has to be right in every edge case, and attackers spend their time hunting for the one that was missed.
• Upgradeable contracts. Many protocols can replace their code after launch so they can fix problems. The same switch that allows a fix also allows a harmful change, so you are trusting whoever controls that switch.
• Admin keys. Some contracts give special powers, such as pausing withdrawals, changing fees or moving funds, to one key or a small group of keys (a multisig). If those keys are stolen, lost or misused, the contract does what the keyholder says.
• Economic design flaws. The code can work exactly as written and still fail if the design assumed prices, liquidity or user behaviour that did not hold. This overlaps with oracle manipulation.
• Composability chains. DeFi contracts plug into one another. A vault may deposit into a lending market that accepts a pool token as collateral, which in turn depends on a price feed. Your deposit inherits the weakest link in that whole chain, including parts you never looked at.

An audit is a review of the code by an outside security firm. It is worth looking for, but it is not a guarantee. Auditors can miss issues, an audit covers a specific version of the code, and an upgrade after the audit can change what you are actually using. A report that lists unresolved findings deserves a close read rather than being treated as a badge of safety.

Formal verification, bug bounties and long track records add further comfort, and each has the same limit: they lower the odds of a failure without removing them.

See the full infographic with notes.

A hypothetical example

The numbers below are invented to show how a chain of contracts can fail. They do not describe any real protocol.

Notice that the vault you chose could have had a clean audit. The failure came two steps away, in a contract you may not have known you were relying on. That is composability risk in one picture.

Warning signs

None of these prove a contract is unsafe, and their absence does not prove it is safe. They are reasons to slow down and look harder.

• No public audit, or an audit that covers an older version than the code now deployed.
• Admin powers held by a single key, or no clear disclosure of who holds them.
• Upgrades that can take effect immediately, with no time delay (often called a timelock) for users to react.
• Source code that has not been published or verified on a block explorer.
• Returns well above what similar products pay, with no clear explanation of where they come from.
• A product that stacks several protocols on top of each other without listing them.
• A very recent launch holding large deposits with little operating history.

How to reduce it

• Read what the contract can do. Look for documentation that explains admin powers, upgrade paths and any timelock. If you cannot find it, treat that as an answer.
• Map the dependencies. Write down every protocol, bridge and price feed your deposit relies on. The protocol risk scorecard walks you through the questions.
• Size positions for total loss. Only put into a single contract what you could lose entirely without changing your plans.
• Spread exposure. Splitting funds across unrelated contracts limits the damage from any one bug, though it adds complexity and fees.
• Limit approvals. Approve only the amount you need and revoke old approvals. See wallet approvals and signing.
• Give weight to time. Contracts that have held funds for years without incident are not safe, but they have survived more scrutiny than brand-new ones.

The Canadian angle

The Canadian Securities Administrators’ crypto-assets investor page (last updated 2025-10-22) warns that crypto assets can be very volatile and risky and that you could lose some or all of your funds. Canada’s registration rules for crypto trading platforms are aimed at the businesses that hold and trade assets for clients. When you connect your own wallet straight to a protocol, there may be no registered firm between you and the code.

Tax is the other gap. As of 2026-10-30, CRA has published no DeFi-specific guidance on lending, liquidity pools or wrapping, and its crypto pages do not address losses from a contract failure. Keep records of every deposit and transaction, as CRA’s records page (modified 2025-11-10) asks, and speak with a tax professional if a loss happens.

Your checklist

• Find and read the audit report, and check which code version it covers.
• Find out who holds admin or upgrade keys and whether a timelock applies.
• List every protocol, bridge and price feed your deposit depends on.
• Decide the most you could lose in this one contract, and stay under it.
• Approve only the amount you need, and revoke old approvals.
• Save transaction records for each deposit and withdrawal.

Sources and dates

• Introduction to smart contracts — ethereum.orgreference
  No date shown on page · checked 2026-10-31. What a smart contract is and how it executes.
• Ethereum security and scam prevention — ethereum.orgreference
  No date shown on page · checked 2026-10-31. Wallet security habits and common scams.
• Decentralized finance (DeFi) — ethereum.orgreference
  No date shown on page · checked 2026-10-31. Overview of DeFi building blocks on Ethereum.
• What's covered — Canada Deposit Insurance Corporationin force
  No date shown on page · checked 2026-10-30. Up to $100,000 per category per member institution; cryptocurrencies, including stablecoins, are not covered.
• Investor tools — crypto assets — Canadian Securities Administratorsreference
  Page date 2025-10-22 · checked 2026-10-30. Crypto assets can be very volatile and risky; you could lose some or all of your funds.
• Information for crypto-asset users and tax professionals — Canada Revenue Agencyin force
  Page date 2025-10-29 · checked 2026-10-30. CRA's current crypto-asset guidance set (replaced the older 'Guide for cryptocurrency users').
• Keeping books and records of crypto-assets for tax filing — Canada Revenue Agencyin force
  Page date 2025-11-10 · checked 2026-10-30. What to record per transaction, wallet addresses, yearly balances; export platform history; keep records at least six years.