A DeFi deposit can look simple: choose a pool, deposit, and let the yield accrue. But once the transaction is confirmed, do you really need to keep monitoring the position?
Yes. The conditions behind the opportunity keep changing after you deposit. APY, utilization, withdrawal liquidity, collateral and oracle health, governance decisions, and execution costs can all move while your capital remains exposed. Due diligence helps decide whether to enter. Continuous monitoring helps decide whether to stay, rebalance, exit, or leave funds idle.
Due diligence takes a snapshot. Monitoring tracks change.
Before any pool becomes available to Zyfai Agents, our quant team reviews the protocol, contracts, audits, exploit history, oracle design, collateral, liquidity, governance, source of yield, and exit conditions. We add only pools that pass the requirements in our Risk Framework. This initial review filters out opportunities that should never receive user capital.
Just as a code audit captures a protocol at one point in time, a pool review captures market conditions at one point in time. Neither tells us whether the position will remain attractive or liquid tomorrow. OpenZeppelin makes the same broader security point: code audits establish a necessary baseline, while continuous coverage tracks protocol, key-management, governance, and integration risk.
The same principle applies to managing capital onchain. Continuous health and risk monitoring helps keep capital protected and returns competitive as market conditions change. A DeFi pool is a live market. Borrowing demand changes utilization and APY, incentives expire, stablecoins can depeg, and governance or curator decisions can alter a position while capital is deployed. Risk also varies across chains, collateral sets, oracles, and deployments, even inside the same protocol. We explained how we think about that trade-off in our recent article.
A useful way to think about the difference is:
Stage | Core question | Typical decision |
|---|---|---|
Due diligence | Should this opportunity be accessible at all? | Approve or reject |
Pre-allocation checks | Does this deposit fit the pool right now? | Enter or wait |
Continuous monitoring | Has the risk-return profile changed? | Stay, rebalance, exit, or hold idle |
Incident response | How you should react? | Emergency exit, delist, pause execution |
Once funds enter a pool, monitoring checks whether the assumptions behind the original allocation decision still hold.
The signals that can change after you deposit
Continuous DeFi risk monitoring needs more than a single “risk score.” Different signals describe different failure modes, and they often become meaningful when read together.
1. APY stability and the source of yield
Headline APY tells you the current rate. Understanding the opportunity requires knowing where that rate comes from and whether it can last.
A lending rate can rise for different reasons. Healthy borrower demand may lift utilization gradually and support organic yield. A sudden utilization spike can push the market close to its kink, where withdrawals become harder. Vault APY can also be boosted by temporary token incentives or leverage, which adds collateral, liquidation, and unwind risk.
To assess a rate, separate yield created by organic borrowing demand and protocol fees from yield boosted by temporary incentives, points, or leverage. Then compare the rate with its history, account for the risk required to earn it, and estimate how your own deposit would change utilization and APY.
Zyfai compares the current APY with the pool’s typical rate over the previous 14 days. A sharp spike or drop can signal that something changed. When unusual APY moves appear together with falling TVL, our framework treats the pool as potentially deteriorating.
2. TVL and available liquidity measure different things
TVL shows the total value supplied to a market. Available liquidity shows how much capital can be withdrawn now.
A lending market can report substantial supplied assets while much of that capital is borrowed. A vault can hold positions that take time or market depth to unwind. A pool can also shrink rapidly when large depositors leave, turning a previously small position into a concentrated one.
Morpho’s own market documentation states that lenders can withdraw only when the market has enough liquidity. Serious monitoring therefore has to compare the position with available exit liquidity and total supplied value.
Liquidity analysis should estimate how much can be withdrawn now, the position’s share of remaining liquidity, and the slippage of a full exit. It should also track whether liquidity is becoming concentrated or leaving the pool unusually quickly.
Before we enter a pool, Zyfai checks that our total position remains small enough relative to the liquidity available for withdrawal. We keep monitoring that ratio after entry and maintain a buffer so Agents have room to exit if conditions worsen.
The goal is to preserve capital first and keep it liquid, even if that means giving up the last few basis points of yield.
3. Utilization and interest-rate kinks
Utilization connects yield and liquidity.
In a lending market, higher utilization means more supplied capital has been borrowed. This can raise the supply APY, but it can also leave less capital immediately available for lenders who want to withdraw.
The “kink” is the point where the curve becomes steeper. It is designed to encourage repayment and attract new liquidity when utilization is high. As utilization rises, supply APY can become more attractive while withdrawal liquidity gets thinner. That combination can draw in more capital just as exit conditions worsen.
A monitoring system therefore needs the pool’s actual interest-rate model. Zyfai tracks live utilization and protocol-specific kink conditions, blocks new allocation when a market becomes too crowded, and can rotate existing exposure out before withdrawals become materially constrained.
4. Collateral quality, depegs, and oracle behavior
Lending yield is only as healthy as the assets and pricing systems behind the loans.
A protocol can keep running exactly as designed while depositors still lose money because collateral loses value, an asset loses backing, or an oracle updates too slowly. Stablecoin depegs are the clearest example. Collateral risk also depends on liquidity, backing and redemption mechanisms, and concentration, such as when too much of a market relies on one asset, issuer, or borrower.
We monitor the asset users supply and the collateral borrowers post against it. A short price move may be harmless, while a persistent depeg, failed redemption, thin liquidity, or an oracle price that differs from the market can put lenders at risk. Any new collateral added by a curator needs a fresh review.
We continuously monitor base assets and collateral stablecoins. Under our current rules, a 0.5% depeg can autonomously trigger rebalancing, while a 1% deviation is classified as risky.
Zyfai uses Chainlink as the primary price source and DeFiLlama as a fallback. Comparing more than one source helps us verify that a depeg signal is real before the Agent acts.
5. Vault composition and curator decisions
A vault name does not fully describe its risk.
Curators can allocate liquidity across several underlying markets. Their collateral mix, allocation weights, liquidity, and exposure can change over time. A vault that passed review yesterday may add a market that does not fit the same assumptions today.
Async vaults add another variable: time. Exiting an ERC-7540 strategy can require a notice period while positions are unwound, NAV is calculated, and the withdrawal is processed in a queue. Monitoring therefore needs to track both whether an opportunity remains healthy and whether its exit mechanics can respond quickly enough for the chosen strategy.
For hierarchical allocation structures, Zyfai maps the underlying allocation path, accepted collateral, and capital flows, then continues reviewing the structure as curators adjust allocations.
6. Governance, upgrades, and operational risk
Not every major DeFi failure begins with a bug in a lending contract.
Risk can emerge through compromised keys, faulty governance actions, oracle updates, front-end compromise, bridge dependencies, or changes to privileged roles. Monitoring must track who can change a protocol, what they can change, and how those changes affect open positions.
Our Security Agents watch depegs, liquidity, TVL, and unusual protocol or governance activity. Our quant team designs the models, performs deeper protocol reviews, and coordinates incident response.
We also monitor FUD and credible security warnings on social media. They can give us an early reason to check a protocol before a problem is fully visible in prices or liquidity. During the Aave and Kelp DAO incident , those signals helped us review conditions and rebalance.
7. Concentration and position size
An opportunity can be acceptable for a small deposit and unsuitable for a large one.
Position size changes the economics of a pool. A larger deposit can dilute APY and increase concentration.
Zyfai can split larger deposits across several approved pools after simulating how each allocation would affect APY. By default, Capital Splitting is used when the split improves expected yield. Force Splitting lets users spread capital across pools for diversification even when it does not increase yield.
8. Execution costs and the cost of being wrong
Monitoring should not cause constant movement.
Every rebalance can create gas costs, slippage, time out of market, and new smart contract exposure. Chasing a small APY improvement may reduce net return rather than increase it.
Our rules compare the extra yield from a rebalance with its gas and slippage costs. For a normal opportunity move, the expected gain must cover at least 14 days of slippage cost. Emergency exits can bypass that requirement when staying creates more risk.
Monitoring should connect detection to action
Detection only matters if it leads to a defined response. A complete system detects a breach or credible warning, validates it against strategy rules and current data, executes a permitted response, and confirms the resulting position and remaining exposure.
Many dashboards stop at the alert and wait for a manual response. Zyfai connects monitors with rule-based execution, so a verified depeg, liquidity issues, or unhealthy collateral can initiate the response allowed by the user's mandate.
This does not make every exit instantaneous or guaranteed. It reduces the delay between knowing and acting, which can be critical when many market participants are trying to use the same liquidity.
How continuous risk monitoring works in Zyfai
Zyfai treats yield management as a closed loop rather than a one-time allocation.
1. Filter and monitor approved opportunities
Before a pool becomes available, Zyfai evaluates protocol, collateral, and pool-level risk, including the source of yield, liquidity, utilization, exit conditions, and strategy fit. Once approved, pools are continuously scored across smart contract, economic, counterparty, collateral, liquidity, and yield stability dimensions. Users can inspect live pool data, aggregate exposure, approved contract addresses, function selectors, and Agent permissions in the Zyfai Risk Dashboard.
The mandate is user-defined. Conservative, Aggressive, and Yield Maxxing strategies apply different pool-eligibility and liquidity boundaries, while users can further customize the networks, protocols, and pools the Agent may access. Monitoring and execution stay inside that selected scope.
2. Apply rules and execute within the mandate
An Agent does not move simply because a higher APY appears. The target must clear gates for pool size, yield improvement, APY stability, cost, liquidity, utilization, collateral health, and TVL stability.
When a position breaches the rules, the Agent can move to another approved opportunity or leave capital unallocated in the user’s Smart Account. Zyfai can also pause delegated execution globally without moving or seizing funds held in users’ accounts.
Risk rules decide whether an action should happen. Permission rules decide whether the Agent is allowed to execute it.
3. Escalate and verify
Funds remain in individual, user-owned Safe Smart Accounts. The Security Proxy Gateway checks the contract, function, and transaction parameters, rejecting Agents’ requests outside the approved registry. For each rebalance, Zyfai’s execution layer generates a ZK proof and anchors it to the Agent’s identity in the ERC-8004 Validation Registry, creating an auditable history of rule-compliant actions.
Our track record during market stress
Continuous monitoring has already helped us protect users during several market incidents.
Our emergency-response history includes:
Stream Finance: we exited positions before losses reached Zyfai users.
Resolv: we moved positions to safer pools before USR collapsed.
Aave and Kelp DAO incident: we detected worsening conditions, moved capital to safer positions or left it idle, and no Zyfai users were affected.
These incidents do not guarantee the same outcome in every future event. They do show a proven track record of detecting risk, acting on it, and protecting Zyfai users when market conditions deteriorated.
Risk-adjusted yield depends on the decision loop
DeFi markets change after entry. A position can become unattractive, concentrated, or difficult to exit even when the protocol keeps operating as designed.
Continuous risk monitoring checks whether the original assumptions still hold. It connects warning signs to predefined responses and treats idle funds as a valid outcome when no approved opportunity meets the rules.
Zyfai applies this approach through independent risk assessment and continuous monitoring, 24/7 Security Agents, human quant oversight, and rule-based rebalancing. Funds remain in user-owned Safe Smart Accounts, while the Security Proxy Gateway limits each Agent’s actions.
A practical DeFi yield risk monitoring checklist
Before allocating capital, and while the position remains open, ask:
Yield
What creates the APY?
How much comes from borrowing demand, fees, incentives, leverage, or points?
Is the current rate normal relative to its history?
Will the deposit itself dilute the expected return?
Liquidity
What amount is withdrawable now?
How large is the position relative to remaining liquidity?
What is the expected slippage for a full exit?
Is there a queue, lock, or asynchronous withdrawal period?
Market mechanics
What is the current utilization?
Where is the kink or target utilization in this market's IRM?
What happens to APY and withdrawal liquidity above that point?
Collateral and pricing
Which assets back the borrowers or vault?
How liquid are they onchain?
What are their backing and redemption mechanisms?
Which oracle is used, and what are its failure modes?
Can a curator add new collateral after the deposit?
Does the selected strategy allow async vaults, and how quickly can queued withdrawals clear?
Protocol and operations
Is the exact deployment audited and actively maintained?
Who controls upgrades, pauses, or parameter changes?
Are privileged actions protected by a multisig and timelock?
Does the strategy depend on a bridge, front end, offchain key, or other integration?
Execution and control
What event triggers an alert?
What event blocks new allocation?
What event triggers an exit?
Who or what is authorized to act?
Can capital remain idle if no alternative passes the rules?
Can the user independently withdraw or revoke the Agent's permissions?
Which networks, protocols, pools, and strategy tiers are inside the Agent's mandate?
A position deserves a set-and-forget label only when those questions have specific answers.
If you do not want to spend your time researching and monitoring every one of these variables, you can delegate the work to Zyfai. Our quant team vets the opportunities, and our rule-based Agents monitor positions and respond within the risk settings you choose.
Frequently asked questions
What is DeFi yield risk monitoring?
DeFi yield risk monitoring is the continuous observation of the conditions that affect a yield position, including APY stability, TVL flows, available liquidity, utilization, collateral health, oracle behavior, protocol changes, concentration, and exit costs. Its purpose is to determine whether a position should remain open, be restricted, be rebalanced, or be exited.
How often should DeFi yield risk be monitored?
The cadence should match how fast the risk can change. Peg deviations, utilization, available liquidity, and unusual protocol activity need continuous or near-real-time detection. Slower structural criteria, such as a protocol's operating history or a collateral review, can be reassessed periodically and whenever a material event occurs.
Why is initial DeFi due diligence not enough?
Due diligence evaluates an opportunity using information available before allocation. DeFi markets continue changing after capital enters. New collateral can be added, utilization can rise, liquidity can fall, incentives can end, and governance or operational conditions can change. Monitoring tests whether the assumptions behind the original decision are still valid.
Which DeFi risk metrics should be monitored?
The most useful set includes APY history, TVL flows, available withdrawal liquidity, utilization and IRM state, collateral backing and peg stability, oracle behavior, vault allocations, protocol and governance events, position concentration, and estimated slippage. No single metric is sufficient on its own.
Does a high APY always mean high risk?
No. A high APY can reflect genuine borrowing demand or productive fees. But it can also come from temporary incentives, leverage, thin liquidity, or stressed utilization. The source, stability, liquidity, and cost of earning the rate matter more than the headline number alone.
Can continuous monitoring make DeFi yield safe?
No. Continuous monitoring can improve detection, reaction time, consistency, and transparency, but it cannot remove underlying smart-contract, market, oracle, governance, operational, or execution risk. DeFi returns are variable and losses remain possible.
What should happen if no pool passes the risk checks?
Capital should not be forced into a position simply to remain productive. In Zyfai, an Agent can leave funds unallocated in the user's Smart Account until an approved opportunity meets the configured risk and return conditions.
See the live checks in the Zyfai Risk Dashboard.
Ready to automate monitoring and rule-based rebalancing? Deploy a Zyfai Yield Agent.
About Zyfai
Zyfai provides self-custodial access to rule-based DeFi strategies. Its Agents allocate capital across curated opportunities and rebalance under defined rules.
Returns are variable and DeFi risks remain. Your assets remain under your control through the supported self-custodial paths.