What are the main risks of DeFi lending and borrowing?

Smart-contract risk

Aave's own risk page says smart contracts can contain bugs or other weaknesses, both in the protocol's code and in the tokens it holds.¹ It says Aave relies on public code, outside audits and a standing bug bounty to reduce this risk.¹

The FSB adds that DeFi transactions generally can't be undone. If a coding error or a fraudulent transaction happens, it is not easy to put things back.⁴ Module 10 covers code exploits.

Oracle risk

Aave relies on outside oracles for prices. Its risk page warns that an oracle that fails or is compromised could value assets wrongly.¹ The FSB says a bad oracle price can set off liquidations in one protocol, with knock-on effects in others.⁴ Module 15 covers oracles.

Liquidity risk for lenders

A lender can only withdraw what has not been lent out.² If a pool is nearly all lent out, high rates are meant to bring borrowers back to repay and lenders to supply more.⁵ Until that happens, a lender may have to wait for its money.²

Aave also uses supply caps and borrow caps: limits on how much of one token can be supplied or borrowed. Its documentation says they limit exposure to riskier assets.^3,6

Bad debt

If collateral falls faster than liquidations can keep up, a loan can end up worth more than its collateral. Aave's risk page calls this the risk of under-collateralisation or bad debt.¹ The 2022 BIS bulletin gives one case: on the Venus protocol, a price manipulation attack led to more than $200 million of liquidations and more than $100 million of credit losses.⁷

Someone has to absorb bad debt.^8,9

• Maker, 2020: MKR holders covered the March 2020 shortfall, as new MKR was created and sold.⁸
• Aave V3, today: Aave's Umbrella system lets users stake aTokens or Aave's GHO stablecoin for rewards. In return, their stake can be burned to cover bad debt in that asset.⁹

Aave's documentation says that in the first month of Aave version 3.3, about $400 of deficit built up across all pools, against nearly $9.5 billion of loans.⁹

The rules can change

LTVs, thresholds, rates and caps are not fixed. Aave's documentation says its governance watches the market and adjusts them, and the community votes on changes.³ As of October 2026, Aave's documentation said a standard change takes 13 days, from proposal through votes to execution. Appointed "stewards" can make smaller, bounded changes faster.¹⁰ Aave's glossary also describes a risk admin that can adjust risk settings without a governance vote.¹¹

A lower liquidation threshold lowers the health factor of every loan against that asset at once, because the threshold is part of the formula.¹² Compound III keeps its borrowing limits separate from its liquidation limits. It says this lets governance lower how much people can borrow without setting off liquidations of existing loans.¹³

The FSB warned that DeFi governance can be unclear, opaque, untested or easy to manipulate.⁴ Module 25 covers DAOs and governance.

Leverage and chains of loans

Borrowed tokens can be posted as collateral for another loan. The BIS authors give an example: post $100 of collateral to borrow $80 of stablecoins, then use those to borrow $60 of another token.⁷ The FSB calls these "collateral chains" and says they make the amount of leverage in DeFi hard to measure.⁴

The BIS authors also say lending built on collateral swings with prices. In booms, rising collateral values let lending grow. In busts, falling prices set off liquidations and lending shrinks.⁷

Network risk

Loans live on a blockchain. The FSB says outages or congestion can lead to forced liquidations and losses.⁴ It cites January 2022, when congestion on Solana stopped users topping up their collateral, and their positions were liquidated.⁴ Maker's post-mortem blamed congestion and high fees for many of its March 2020 problems.⁸