What is a DeFi vault?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 4 min
In short
A vault is a smart contract that takes deposits and runs a predefined strategy with them. Users are spared the individual steps, but in exchange they see less of what is actually happening inside. If the contract encoding that strategy has a flaw, every deposit is exposed at once.
Key points
- A contract that runs a set strategy on pooled deposits
- Convenience comes at the cost of visibility
- A flaw in the contract affects every depositor at once
- Who can change the strategy is a central question
Definition
A smart contract that accepts deposits and executes a predefined strategy automatically, usually issuing depositors a token representing their share of the pool.
The usual flow: you deposit stablecoins, receive a share token, and the vault routes the capital into lending or liquidity provision. Gains and losses show up in the value of each share token. To exit you return the shares and receive assets worth whatever a share is worth at that moment.
The appeal is saved effort. Running a multi-protocol routine yourself costs gas on every transaction and invites mistakes. A vault batches many users' funds, so the per-user cost falls. The trade-off is that the contract's code decides where the money goes, and depositors cannot pick their own risks within it.
The question to ask is who can change the strategy. If an admin key can point the vault at a new destination, a stolen key can point it at a malicious contract. Funds have been drained exactly this way, through abused admin rights and leaked keys. An audit is worth checking for, though audited vaults have been exploited too.
Watch out for
- · Contract vulnerabilities have drained entire vaults in a single transaction, more than once
- · Where an admin key can redirect the strategy, a leaked key means every deposit is at risk
- · If an underlying protocol fails or takes on bad debt, the share value falls with it