Decentralization in DeFi: DeFiScan

Transcript

Centralization is [music] going to come naturally from this by by having informed community. We believe that those are all questions users should be able to answer easily and before they put any funds in the protocol. The challenge in all [music] of that is transparency. You realize usually too late that you're entirely uh dependent on a centralized entity. You don't have to be mutable to be decentralized to be stage two. You just have to keep the user interest at heart. [music] Decentralization is a popular term in web3 space. This is used in many context

and it carries different [music] meaning across the ecosystem. But have you ever thought about what decentralization really means in the context [music] of D5 protocols? Well, many projects call themselves decentralized. [music] But is there a way to verify that? The answer is yes. And that's exactly what we are exploring in today's episode. Transparency on decentralization and defi. [music] Welcome back to ecosystem project demo. This is episode 27 brought to you by EC institute. I'm your host Puja Ranjan joined by Akash and from our team. Today we are talking about something that could really build trust in DeFi and

find out how decentralized a project actually is. [music] Our guest is working on a tool called D5 scan that looks at this directly. We will talk about why it matters for user, what it means for builders and how the whole ecosystem can be moved forward. Please welcome Amelia Duke. Welcome Amelia. Thank you so much. Uh thank you for having me. I'm very happy to be here. >> Thank you so much for joining us here today. Generally speaking, we love to start the conversation with a little introduction. So, if you could please share a little bit about yourself, how you joined the ecosystem.

>> Yeah, of course. I'd love to. I'm Amelia. I joined the ecosystem about I would say four years ago roughly while in university. I'd like to mention I first heard about uh blockchains and ecosystem on um in a course how blockchains were a tool to for democracies to self-organize and uh I think got me hooked on blockchain and DeFi while that's when I started exploring it and then slowly I got more involved. I I've done some academic research during my studies. I've been involved with D5 protocols as well. I've done many hackathons and then about last year I also joined the defi scan to kind

of help transparency in defi and user protection. So very happy to be here to present it. >> So you have followed a great path starting from hackathon universities and doing some research getting into the space and started working on a tool. It's so inspiring. All right. I understand today we have got a presentation. Uh so without further ado let's get into it. Yeah, of course. Defy scan. This is a project that's been rolled out by the DeFi collective. The collective is actually turning 2 years old just today. And um its goal is to promote true DeFi. So we we're going to see what that actually means throughout the presentation. So we all know what

DeFi is. It's a wide term. It can involve a lot of things. So decentralized exchanges, lending platforms, yield opportunities, liquid staking, restaking as well through for example IGON layer. So it's all of that can be considered somewhat DeFi. And all of those we try to to look into to analyze and to to report about the value in DeFi has been growing a lot especially this year. You can see today it's roughly $250 billion worth of value in DeFi. But along with that, you also have a lot of value that's being stolen.

That's uh DeFi Lama data. They report the total value hacked in protocols. It's about 15.5 billion over time. Interestingly, if you look at 2025, at the beginning of the year, we had a big one at the baby tag. I think it's interesting to mention if you remember back then, what happened is the safe UI was disabled out of just security prevention. They wanted to check nothing was wrong when that happened. And for about two to three days, the safe UI is how people interact with their multisig and their funds. So for about two to three days, people had no idea how to touch the funds that ran to their multisigs. Even though this is something that's onchain and that you can do

without the UI, without any issue, usually people just didn't know how to. So that's how you realize usually too [clears throat] late that you're entirely uh dependent on a centralized entity. So the safe UI the front end was how most people accessed their multisig and then when it was down people didn't access their multisig for a few for some time. Um so that was an interesting event and something to note. Another one you don't have to read into all the details. basically a D5 protocol with a vault in which people put their funds to get yield. But what turns out is a hacker got a a hold of the admin key and they were able to just drain the whole

vault and all the funds. So um you're told it is decentralized until too late you notice oh actually there was an admin key that could drain all the funds and people didn't know about it. So the challenge in all of that is transparency. So questions like who operates the protocol? How can the failure affect my myself and my funds? What are the risk of tools being used by the protocol itself? How mature the technology is? We believe that those are all questions users should be able to answer easily and before they put any funds in the protocol. So that's our mission. We came up with a framework to categorize D5 protocols and um inform users to try and protect them. So we

developed tools to do that. And we also support D5 protocols early on. So when you have true true D5 protocols, we're going to see what that means. Then we try to support them from the start in their journey because it's quite hard to when you something is purely decentralized, it's also harder to grow and harder to have momentum. So we try to support them this way as well. So how do we decide what's true? We have five criteria. The first one almost the most important one is upgradability.

So can contracts be upgraded. When you upgrade a contract everything can change. So you could reassign all the funds, the ownership, everything. And in addition to contract upgrades, we look of course if there are functions that can move the funds and that could basically use either the funds or the yield or anything that could affect users. Those are called permissions. And um what's key with upgradability is the exit window. So it's okay to have some critical permissions, but how long do you have between when the permission is activated and when it takes effect? If a contract can be upgraded without delay, this is a huge vulnerability in a way.

Whereas what we ask for medium risk is 7 days delay and for low risk we ask for 30 days delay. So a whole month. This is one of the criteria that's the hardest for protocols to respect because there's also a question of security. They want to have the access themselves to prevent attacks if they find any. So it's a hard balance to play with between protecting users from the team or from hackers getting a hold of admin keys for example and then protecting users from security bugs and attacks on the contracts themselves. So it's a hard balance. You also have autonomy. Um a lot of protocols use price feeds oracles. If

those can be manipulated this can impact user funds. So we look at that to try and determine if it's a high-risk dependency, medium risk. Also depends if the dependency itself is centralized or decentralized. We also look accessibility front ends. I've mentioned the safe UI. That would be an accessibility issue to be considered lowrisk. You need multiple independent front ends. If you can self-host, it's already uh a mitigation. You can be medium. But we try to really encourage protocols to not have a single website to access the protocol. And uh finally chain it's more debatable. Ethereum bitcoin we consider low risk. And for

L2s for example we use L2B scoring to determine um the evolution of the chain and how decentralized it is. Those are our five criteria. The main one and what we use to determine how mature a protocol is. So we put all those together and we get a scale first step on the scale. It's actually not D5. So we had this case in the past. So if you have no docs or if it's not open source critically the assets are not are held by a centralized entity. This happens in some protocols that came to be D5 then we consider it not D5. But then we have three stages. Zero is full training wheels but you meet basic requirements.

So it's all on chain and it's still at least at the contract level decentralized. You can have operators. You may have upgrades but the basis is here. It's a normal stage in the development of a protocol. And then we want to encourage them to evolve towards better decentralization. So stage one critical permissions or upgrades. We want to protect them with a 7 days delay. Or then we also accept a security council which is a multisc but with very strong requirements. So it cannot be just the team it has to be also external people and um the team itself cannot have a majority and it has to be seven signers overall. So it's stronger requirements and uh then stage two it's

the pineacle of D5. Ideally you have immutable contracts or you can have 7 days delay on critical permissions with typically it would be onchain governance but that would be also okay if you have multi as long as you have 30 days delay. So users really have time to decide whether they want to stay in the protocol when you decide on an upgrade. And we think that's key to to true decentralization. That's the scoring detail. But we don't have to go into the details. I'm going to just show you the website. I think it would be interesting. Here you have an overview of how much of D5 we have reviewed. So actually we reviewed $124 billion worth of TVL in um so in protocols. So that's

27 reviews. That's roughly half of D5. We have some big protocols also coming that would increase that number around the 60% at the moment. We can see on the right that well decentralization is of the process. A lot of protocols are stage zero which is critical but they tend to evolve some tend to evolve towards stage one stage two and uh we definitely try to encourage that. Then you have the list of all the protocols. you get a quick idea of their score and how why they score this way. So according to the criteria and then you can dive into the details on the review page. So here you're going to see um

quick overview. For example, morpher is stage one and you see why they're not stage two at the moment. And um then you have a very in plain English and easy language. We explain what is moro and why they score this way for each criteria in a way that's understandable. For example, upgradability. Moro markets are immutable. So that would be low risk. But the morpho token in itself is upgradeable and can be is in the control of a multisig. So the morpho token is a reward token. It's yield. So that means it's for us it's medium risk that uh the yield is at risk for users. So we

explain this for each criteria in a way that's easy to understand. But if you want to go into the rabbit hole and uh if you're technical or if you even with Maro, you can dive into the details of the contracts. Everything we had to analyze, we publish. So we explain all the contracts, all the functions. And this is very important documentation that's not necessarily available for protocols. It's I would go as far as to say that it's might be more thorough than some documentations of protocols. So we explain everything. you have uh the multisigs the contracts listed and um this is the documentation part every permission in the protocol is explained it's so we explain what it does and how

it could be used maliciously if it can who owns the permission as well so it's very crucial resources that uh we try to expose for every defi protocol out there and I think that's roughly what defy scan is I think we can we can dive into questions if you have any >> awesome Thank you for the presentation and sharing starts on assets on chain and even the hacked value. Sometimes we overlook how sensitive these information is, how important it is to know the project is actually decentralized and that actually helps build our trust into the financial system and it is for our own protection. So people should learn about it. Thank you for talking about the selection criterias of your project

like how you define decentralization and talking about your framework. It was good. >> Thank you. >> I do have a few follow-up questions. I'm just trying to understand this is pretty interesting that you have already defined everything how you are coming up to a conclusion like this project is this much decentralized. So for an average D5 user why do you think these decentralization stage matters? >> Yeah, that's a great question. I think you have multiple factors to take into account, but as a user, it's quite hard to know actually how mature a protocol is. A lot of DeFi and decentralization is a selling point because you have this saying that code is low in the sense that you put your money in DeFi and it's

just going to do its thing. If it's lending, then the contract is going to handle it, right? But the truth is in a D5 protocol, this is not just you publish the code and that's it. it's done. Building a D5 protocol is a process and at the beginning it's normal that a lot of protocols still have admins want to keep permissions. They want to be able to update if there are security issues. It has centralized entities and that's something that users don't necessarily know. They don't necessarily know how much permission people have on a protocol. So, it's important to put it into the spotlight and uh inform them. It's okay to interact with the neuro protocols but you should just be aware who actually

you're trusting. It's just not code is low at this point >> right and as we can see right here on the screen that uh these are divided into different stages but most of the project listed here are under stage zero. So is the recommendation when project are in stage zero less likely to get engaged with or they are more vulnerable than any other project. what is the general advice that you would like to send out via this stages? >> Yeah, well, you highlight a very interesting point. We call kind of the stage zero fallacy in a lot of the older big D5 project protocols that are well established actually score stage zero into the current conditions because they're so big and there's always maybe some small elements that makes it stage

zero or some dependency. So of course it's you could interpret it as is you shouldn't interact with those but you can also there is of course a reputation to take into account for those bigger protocols as I said it's an indication and then you have as a user you make the choice who do you actually trust but a lot of those are are moving towards better decentralization in this sense we're also changing the framework a little bit to take that better into account so we're hoping to see also evolution In that regard, >> beautiful like putting it into phase zero fallacy. That's a pretty interesting term and I can understand why it is called as fallacy right over

here. Perhaps it's it could be the wakeup point for even project to consider it making it even more decentralized. Right? They may have a lot of avenues to fill in the gap and make the project even more trustworthy. Very well. My next question is when project is evolving can we track it via D5 scan? Say for example currently one project is in stage zero and it is going to stage one. For example, this is also possible that a project is presently in stage one and it come back to stage zero. Can user rely on defy scan to track when a project improves or regress over time?

>> This is a great question. I'm glad you asked. At the moment the reports that we publish are in a sense static. So that means at the time of publication this reflects perfectly the state of the protocol but then we have to manually make updates if the protocol changes. This is a lot of work. For example protocol like lido a those are huge protocols. If you look at the permission functions that we document it's about like roughly 300 permissions that we have to look into for now. It takes some time of course to account for updates.

We do it as much as possible. In the future, in the coming weeks, we're hoping to have something dynamic so that we would automatically monitor those changes on chain. Roughly um majority of them could be all updated without our action. So that would be much more quicker update rate than now. But this is all coming soon hopefully. But it's not the case at the moment. >> That's pretty cool. It's important that it is in consideration. So we are going to have something there in place in the course of time.

>> Exactly. >> All right. So my next question is with respect to the usage of this tool D5 scan to the protocol builders. How do you see D5 protocol actually is using this framework? Is it like self assessment, independent scoring or both? or uh do you have any plan to offer any kind of independent scoring and verification to these projects if it is not there in place already? >> Yeah. So if I reformulate how do we actually do those reports, right? It's a mix of both. So protocols can self assess and write their own report but then of course we're going to proofread it and we're going to reproduce their results to make sure they're accurate.

But most of the ones that are published at the moment, even the biggest ones, we've done in an independent manner. So we're not being funded by DeFi protocols as well to avoid conflict of interest. So we write those reports as an external independent actor. And we also have a community program where we encourage actually users to to do the research and report the facts and then we put it all together and proofread the content. >> That is very good. So that means a user or a project can self assess themsel and you are also there to hold hand and help them get to the state where they are actually standing.

>> Yeah, >> that's pretty cool to know. Yeah, I'm also trying to get a little bit deeper into decentralization the terms. So what is the biggest misconception developers have found about decentralization maturity? Like you have reviewed multiple projects. So you think that some project call themselves as more decentralized and matured but they aren't actually? >> That's a great question. You could see it in different ways I think. So one misconception probably people have about decentralization is immutability. So an immutable protocol you have to be immutable to be decentralized. It's two different path in the sense that some protocols go with immutability. So they release one version like unis swap and

those versions are immutable. So they very decentralized whereas some goes like a go with something more iteration based. So the a governance is in charge and they're going to do updates quite often actually to improve the protocol. You can be decentralized and still have upgrades and still evolve and all of that. you just have this user protection in mind which is not the case for every protocol in the sense that um you need to allow users to react to your changes to decide if they want to stay in the protocol when you make a change. So you don't have to be mutable to be

decentralized to be stage two. You just have to keep the user interest at heart. >> So true. Yeah, I believe upgradability is a good factor. It will keep the protocol lively. So we should have that in place. So of course it depends on what is the most important criteria for an individual user or a project to like consider themsel as a decentralized. Good that we have this tool. >> Great. >> We have some uh comparison ground set up there. Well my next question is with respect to governance like you briefly touched about governance there. So have any governance community or DAO shown interest in adopting your stages as risk model to guide upgrades, audits or

funding decision or do you even think that the model that D5 scan is using right now could be used for governance and DAO in future? >> Yeah, so this is definitely something we have in mind because decentralization is a process as I've said. So that means when we give a another good score or stage zero to a protocol then we also want to think about how can they improve. So this is something we're developing as well. But every time we publish a report we're going to give indications on what would be the next stage for the next step for them the changes required to reach stage uh stage one or stage two. Usually the smallest protocol you make actually the changes they're very happy to to collaborate.

Then the biggest one is harder because it's a big governance. You have to convince a lot of people. We try to inform mostly on the the the steps to take and how they could move towards more decentralization. So that's something we are try to work as much with the protocols as possible. >> As much as there are steps provided as guidance for these projects to move forward from one stage to another stage, what do you think is the main motivation factor for these projects from move from stage zero to stage one or two? Is it like driven by reputation, security, compliance, user trust or what do you think is the main motivation behind it?

>> Yeah, I think this is an interesting question because it touches a little bit of everything we do in the sense that actually moving from stage zero to stage one. I think a lot of protocols don't want to do that because of security concerns. So because they want to keep a a hand on the protocol such that they can react to security bugs or security attacks for example. And that's only possible if they have decentralized access to the protocol. Um so I think security is a concern actually that takes back prevents evolution towards decentralization in some cases whereas reputation is definitely a motivation.

We talk about immutability. It's a big selling point. It's a good marketing to have an immutable protocol. And uh you've mentioned I think compliance. We don't see it at the moment, but we firmly believe at least at Defy Scan that decentralization will eventually be legally defined and um you're going to have to have an actual decentralized protocol to file to fall into this uh regulation that's coming in in some countries especially in the US, >> right? Yeah. Multiple factors may affect depending upon where the government of that country may affect uh some priorities of these selection criteria.

Very well. My next question is with respect to limitation. I followed in the website it was mentioned there are certain things that defy scan do and there are certain things that defy scan do not do. Now my question to you here is about future exploration. Do you see some kind of partnership or uh maybe getting in touch with projects like L2B for some kind of collaboration for risk assessment platforms or something like that? Yeah, that's a very good point. So, we have collaborations on on different side that we're we're discussing. Yeah, as you mentioned, there are things that we don't do. So, we don't make any security claims on protocols, but decentralization and

security are two things that are related. So, of course, we are also open to partnerships in that sense that would aggregate information from also audit firms and combine this towards something more even more descriptive. that that's all things we we're considering L2 bit we also uh collaborate with in a sense that you could say with the L2 bit of D5 so we're trying to evolve in this sense we're going to see um how we we can evolve in in the ground >> right I think a few months earlier we had some conversation around public goods and we were seeing multiple projects coming around like how we can make sure that the project claiming themselves to be a public good is public

good and then we were working on defining the parameters of that like it should be open source it should be like you know freely contributing people are responsible accountable about things like that and I'm seeing the almost similar thing here in the case of D5 which is really good to see that we are growing the ecosystem uniformally well uh my next question is um is about the future vision like do you see D5 can become a public standard maybe for wallet explorer or analytical platforms that integrate to help users assess protocol maturity in real time.

Maybe after a few years with collaboration or different forms that you guys may have in your horizon. >> Yeah. Well, definitely that's a definitely a goal. We want to be a standard in terms of um of assessing D5 protocols and uh categorizing them. Um I think there's there's a lot of potential you've mentioned both with wallets also in terms of compliance. So defining legally what is decentralization. This is something that's going to happen eventually. So we're hoping to to have a role in that for sure. >> So a small followup that if you have to pick one environment what it would be would it be wallet explorer or a governance dashboard? What would be your first pick to move forward?

>> That's uh >> yeah the lowest hanging fruit in your mind for this one. >> Yeah. No, I think um you know the the lowest hanging part is definitely explorers, wallet explorers or or dashboards. It's all about visibility and at the moment that's what users see. So if you can have a place there definitely a game changer. >> Well, I think this is going to be an interesting question for me. It is definitely one and I hope the answer will help many of us to understand what a true decentralization mean. Which protocol do you think is currently [clears throat] closest to true decentralization and why do you think so?

>> Well, I'm not sure I should name one protocol for sure, but um if you look at the device scan website actually all stage two protocols, so that includes unis swap liquidity for example and uh pull together as well. I think that those are a great example of what true defi in the sense that they score perfectly in all criteria. That means they're either they are immutable, they have multiple front ends, it there's not one access point. If they have dependencies, so if they if they use external protocols, then they do that with security measures. So it's it's really the good examples. You have you also have some stage one protocols like aerodyrome drrome and smaller ones pone

for example they're stage one but they're in very good way of getting stage two someday and um for small protocols as I've said it's a process you cannot be stage two just on launch. So um I think they they all deserve a shout out in in a sense um because it's it's an evolution and they're all doing great with decentralization in mind. That's a great answer. So, we did not get one protocol, but we got a list of protocols. That's good. Good to know that I would recommend people to go out and check out stage two projects there if you are considering getting engaged with D5 protocol. So, that's a pretty good set. Test it, verify it, and you have all the criteria right in front of

you to like verify that these projects can be trusted. Of course, there is risk. People should not forget about it. >> Of course. Yeah, there's always risk. there's a code risk as well that we don't assess but um it's a good starting point and it's also as I've said plain English easy to understand so even if you don't know about the protocol it's always a good starting point >> indeed it is well I think uh T5 scan team is doing a great job out there to help and provide people to know all these protocols in in one place it's it's really helpful if you have an ask from the community what it would be to help and support D5 scan. Maybe your message or your call to action.

>> Well, use D5 scan in a sense be a true decentralized advocate. So that means inform yourself on what decentralization is and uh the decentralization of the protocols because DeFi is communitydriven. So we need people to be aware of that and uh decentralization is going to come naturally from this by by having informed community and uh I think this is the main point for change. >> Very well said. I understand Ethereum, blockchain, web 3 and [music] defy all these ecosystems are growing and being informed will help us grow in a positive direction. So thank you so [music] much Amelia for taking our time and talking

about this project today. >> Yeah, it was a pleasure. Thank you so much for having me. >> Dear listeners, if you are a builder, researcher or everyday user and you care about decentralization [music] and transparency in D5, check out D5 scan. We'll drop link in the description so you can explore more, give feedback and get involved. Thank you for tuning in. Until next time, stay curious, stay decentralized.