Beyond Numbers: Qualitative Risk Analysis in DeFi by Val John

hi everyone I'm Val from lamaris and over the last four years we've been making a name for ourselves for doing a deep dive in protocol risk and uh specifically on qualitative aspect of risk which is often Overlook so today I'm just bringing you in a quick Journey uh Beyond numbers so first of all some background lamaris has been operating since 2021 and we serve Blue Chip clients such as a curve and Ina and we help protect over 30 billion of uh dollars we're a group of analysts researchers data scientist quants and smart contract engineers and our goal is to provide independent deep and factual research to increase the defi use and transparency so first of all I want to make sure we're all on the same page I want to differentiate between quantitative and qualitative uh quantitative is everything that's data driven so basically we aggregate data and we're trying to make sense of it we try to ID identify Trends and we use agent based simulation and modeling uh at lar risk we do both quantitative and qualitative but today I want to focus on the qualitative aspect which is a bit less tangible but can have a material impact on risk let's start um system architecture so what we do first is we try to map out the different uh components of a protocol trying to really have a bird side view we look at deposit withdrawal flows we look at uh all yield is being acred the different parameters uh if there's a fee switch then we uh look at external dependencies is the protocol relying on the m amm is there an external Oracle and so on uh the documentation of a protocol can be a very useful reference uh document uh however sometime we find that it's missing uh key details or it's outdated or even it could include some kind of wish list items or marketing material so it's very important for us when we want to portray uh risk accurately that we look at what's actually being deployed on chain next up access controls so what are the levers that the protocol can have to operate the different uh uh admin functions so the gold standard in our industry is uh Ro based access control so basic basically a tiered permission system for example at a um we have the a guardian which uh is a multic of trusted individuals such as myself that can do a very limited amount of actions in case of emergency for example freezing a market uh all the rest is being enacted on chain through regular governance uh channels for the regular users it's not always easy to audit uh access controls you might might be lacking a a viewable function on chain and sometimes what we have to do is look at the contract storage and look at the events being emitted since the the contract deployment kind of reconstruct the full pictures of what are the the different uh action that can be performed and by who uh and then we turn our look at who's who's having those accesses is it an EA a non-chain multi or a MPC uh we do have a preference generally for unchain multi Sig because it provided more transparency although after the last week's events uh it's it's a bit more of a tricky discussion there's also MPCs that are often used by rary projects and they can have some advantages but there's also trade-off of course and in defi there's a lot of code that's not immutable uh so we want to make sure that uh there's a time lock behind the the proxies behind a time lock and there's sufficient time so that uh people can uh take actions if there's uh malicious code being injected then there's audits uh the best standard uh in in our opinion is to see a commit Ash that's being audited and it's a onetoone representation with what's being deployed on chain sometimes we hear from protocol we review that uh we just made a small change or we deployed a just a periphery contract but time and time again uh we've been proven that just a minute change can uh result in uh very catastrophic uh consequences such as last year with Prisma Finance we saw the Trove migrator that was unaddicted and led to1 million hack uh if we see too many findings sometimes for us especially the the medium and I we think maybe the code wasn't ready for to go to audit and go to go for for prime time and we also look at what did the team do with the audit report did they address the the different concern and how were they addressed the bugb D program so in our view no code is perfect and in 2025 it still baffles me that we need to convince protocol that uh a bug Bounty is a necessity when you go into your car you put your seat Bel on and when you Deploy on defy you have a bug Bounty it's as simple as that and it's a reflection on the seriousness that the protocol puts on security uh so in our view the onetime contest just doesn't cut it and the coverage and amounts are really important for example last week we saw the buy bit act for 1.5 billion dollars and the bug bony that was uh available to to potential White actx was only to uh in in the order of 4,000 usdm so it's inconsequential compared to to the potential Capital At Risk so overall the bug bound T program program for us it's a way to attract white acts and to give them the confidence that they will be a clear payout structure if they put in the work and find vulnerability in your code then there's uh counterparty risk so we try to understand what are the different trust assumption uh who custodies the fund for example um given let's let's talk about atina for example uh they use off exchange settlement uh with different um custodian such as Kobo uh and seu and on the exchange itself like last week with the the bybit act the only thing that's at risk is only the unrealized pnl that's on on that specific exchange so you mitigate a lot of the ins insolvency risk that are uh coming stemming from using that that centralized exchange then we look at governance structure decentralization of operational control and legal and Regulatory framework such as Mica in Europe for example so that being said uh these things may sound very simple to you but on a weekly basis uh during our assessment we see some flaws with uh a lot of capital being at stake so I think we can do better and uh the uh industry leading protocol I think should uh help raise those standards so we're we're launching what we call operation spring cleaning so we will review and provide a low anging low hanging uh actionable uh Improvement that we can give on some of the give to some of these protocol that are onboarded within the or partner protocol for example on documentation access control and Bounty and we will follow up with them to make sure they they can be implemented so thank you very much and I'll hope you you'll join me in this fight to get uh to make defi safer thank you very much guys