A Risk Framework for AI Agent DeFi Operations

Introduction

DeFi protocols collectively hold over $80 billion in total value locked. For AI agents deployed in production, a single uninformed DeFi interaction can result in instant, irreversible loss. Unlike traditional finance where errors can sometimes be reversed, on-chain transactions are final the moment they are confirmed.

This framework provides a systematic, quantified approach to assessing and managing risk before every DeFi operation. Whether your agent is supplying liquidity, borrowing against collateral, or executing arbitrage, the five risk categories below give you a repeatable process for decision-making under uncertainty.

The Five Risk Categories

Every DeFi interaction exposes an agent to some combination of the following risks. Understanding each category independently — and how they interact — is the foundation of responsible autonomous DeFi participation.

Risk Score Methodology

Rather than treating risk qualitatively, assign a numeric score of 0–10 to each category, then combine them into a composite score. This gives your agent a single actionable number that drives position-sizing decisions.

• 0–3 (Green): Safe to interact at full target position size
• 4–6 (Yellow): Proceed with reduced position size (50% or less of target)
• 7–10 (Red): Avoid interaction entirely or monitor-only mode

The composite score is a weighted average. Smart contract risk and systemic risk typically receive higher weights (1.5x) because their worst-case outcomes are total loss, whereas liquidity risk (1.0x) results in partial slippage that can be managed.

Smart Contract Risk Assessment

Smart contract risk is the most binary of the five categories: either the protocol is exploited and funds are lost, or it is not. Quantify this risk using the following signals:

• Audit count and recency: Protocols audited by CertiK, Trail of Bits, or OpenZeppelin within the past 12 months score lower risk. Each additional reputable audit reduces the score by approximately 0.5 points.
• Bug bounty size: A bug bounty of $1M+ indicates the protocol takes security seriously and attracts white-hat scrutiny. Absence of a bug bounty adds 1.5 points to the risk score.
• Protocol age and TVL trajectory: A protocol that has held $500M+ TVL for over 24 months without incident is substantially more trustworthy than a new fork. Use DeFiLlama to verify historical TVL.
• Code similarity to audited code: Many exploits target unaudited forks. Verify the protocol's contract diff against its audited ancestor.

import asyncio
import aiohttp

async def get_smart_contract_score(protocol: str) -> float:
    """
    Query DeFiLlama for TVL history and audit data.
    Returns risk score 0-10 (lower is safer).
    """
    async with aiohttp.ClientSession() as session:
        async with session.get(
            f"https://api.llama.fi/protocol/{protocol}"
        ) as resp:
            data = await resp.json()

    tvl_now = data.get("tvl", [{}])[-1].get("totalLiquidityUSD", 0)
    tvl_1y_ago = data.get("tvl", [{}])[-365].get("totalLiquidityUSD", 0) if len(data.get("tvl", [])) >= 365 else 0
    audit_count = len(data.get("audits", []))

    score = 10.0
    if tvl_now > 500_000_000:
        score -= 3.0
    elif tvl_now > 100_000_000:
        score -= 1.5
    if tvl_1y_ago > 100_000_000:
        score -= 1.5  # survived for a year
    score -= min(audit_count * 0.5, 2.0)  # cap audit bonus at -2.0
    return max(0.0, score)

Liquidity Risk Assessment

Liquidity risk determines whether your agent can actually exit a position without substantial price impact. Even a perfectly profitable position becomes a loss if the exit cost exceeds the gain.

The key metrics are slippage at 1%, 5%, and 10% of position size, the volume-to-TVL ratio (a ratio below 0.02 signals illiquidity), and the estimated time to fully exit based on average daily volume.

import requests

PF_BASE = "https://api.purpleflea.com"

def check_exit_slippage(
    symbol: str,
    position_size_usd: float,
    max_acceptable_slippage: float = 0.02,
    headers: dict = None
) -> dict:
    """
    Returns estimated slippage for exiting a position.
    Raises if slippage exceeds acceptable threshold.
    """
    r = requests.get(
        f"{PF_BASE}/v1/markets/{symbol}/depth",
        headers=headers
    ).json()

    bids = r["bids"]  # [[price, size_usd], ...]
    filled = 0.0
    cost = 0.0
    mid_price = r["mid_price"]

    for price, size_usd in bids:
        take = min(size_usd, position_size_usd - filled)
        cost += take * (mid_price - price) / mid_price
        filled += take
        if filled >= position_size_usd:
            break

    slippage = cost / position_size_usd
    return {
        "slippage_pct": slippage,
        "safe_to_exit": slippage <= max_acceptable_slippage,
        "estimated_cost_usd": cost
    }

Oracle Manipulation Risk

Oracle attacks are one of the most common DeFi exploit vectors. An attacker manipulates a price feed — often via a flash loan — causing a protocol to misprice collateral, enabling theft or forced liquidations at artificial prices.

Defenses your agent should implement:

• TWAP vs spot deviation monitoring: If the 30-minute TWAP deviates from spot by more than 5%, abort the transaction and flag for human review.
• Oracle source diversification: Prioritize protocols that use Chainlink with a Band Protocol fallback. Single-source oracles add 2 points to the oracle risk score.
• Historical manipulation incidents: Check Rekt.news for known exploits against the protocol's oracle. Any confirmed oracle manipulation in the protocol's history is an automatic yellow-flag.

Purple Flea's /price-oracle-api aggregates feeds from Chainlink, Band, and Pyth, providing a manipulation-resistant price with a confidence interval your agent can use for sanity checking before any trade.

Liquidation Risk Management

For any collateralized position, liquidation risk is the probability that market movement drops your health factor below the protocol's liquidation threshold. On Aave, this threshold is 1.0; a health factor of 1.5 or above is considered safe for most agents.

Implement an auto-deleverage trigger at health factor 1.3: when reached, your agent should repay enough debt to restore the health factor above 1.6 before the next block. This creates a buffer against rapid price moves.

async def monitor_health_factor(
    position_id: str,
    auto_repay_threshold: float = 1.3,
    target_hf: float = 1.6,
    headers: dict = None
):
    """
    Continuously monitors health factor.
    Auto-repays debt if HF drops below threshold.
    """
    while True:
        r = requests.get(
            f"{PF_BASE}/v1/lending/positions/{position_id}",
            headers=headers
        ).json()
        hf = r["health_factor"]

        if hf < auto_repay_threshold:
            debt_to_repay = calculate_repay_amount(r, target_hf)
            repay_response = requests.post(
                f"{PF_BASE}/v1/lending/repay",
                json={"position_id": position_id, "amount": debt_to_repay},
                headers=headers
            ).json()
            print(f"Auto-repaid {debt_to_repay} to restore HF to {target_hf}")

        await asyncio.sleep(30)  # Check every 30 seconds

Building the Risk Agent

Assemble the individual risk assessors into a unified DeFiRiskAgent class that your agent queries before every protocol interaction:

class DeFiRiskAgent:
    def __init__(self, api_key: str):
        self.headers = {"Authorization": f"Bearer {api_key}"}

    def assess_protocol(self, protocol: str) -> dict:
        """Return composite risk score 0-10"""
        scores = {
            "smart_contract": self.get_smart_contract_score(protocol),
            "liquidity": self.get_liquidity_score(protocol),
            "oracle": self.get_oracle_score(protocol),
            "liquidation": self.get_liquidation_score(protocol),
            "systemic": self.get_systemic_score(protocol),
        }
        # Weight: smart_contract and systemic are 1.5x
        weights = {
            "smart_contract": 1.5,
            "liquidity": 1.0,
            "oracle": 1.0,
            "liquidation": 1.0,
            "systemic": 1.5,
        }
        weighted_sum = sum(scores[k] * weights[k] for k in scores)
        total_weight = sum(weights.values())
        composite = weighted_sum / total_weight

        if composite < 4:
            action = "proceed"
        elif composite < 7:
            action = "reduce_position"
        else:
            action = "avoid"

        return {
            "protocol": protocol,
            "scores": scores,
            "composite": round(composite, 2),
            "action": action
        }

# Usage
risk_agent = DeFiRiskAgent(api_key="pf_live_your_key_here")
assessment = risk_agent.assess_protocol("aave-v3")
print(assessment)
# {"protocol": "aave-v3", "composite": 2.1, "action": "proceed"}

DeFi Risk Checklist

Before deploying to any new protocol, your agent should verify the following ten items. Treat each as a blocking requirement, not a suggestion:

1. Protocol has at least two independent security audits from reputable firms
2. Protocol has been live for at least 6 months without a major incident
3. Current TVL is above $50M (sufficient skin in the game)
4. Bug bounty program exists with rewards exceeding $100K
5. TWAP deviation from spot is less than 3% at time of entry
6. Exit slippage at full position size is below 2%
7. Oracle uses at least two independent price feeds
8. Health factor post-entry will be above 1.5 for any leveraged position
9. Protocol exposure is less than 25% of total portfolio value
10. No active exploit reports on Rekt.news or DeFiHackLabs in past 90 days

Conclusion

DeFi offers AI agents access to yield, leverage, and liquidity that is unavailable in traditional finance. But without a systematic risk framework, the same features that make DeFi powerful make it dangerous. By quantifying each of the five risk categories and combining them into a composite score, your agent can make consistent, auditable decisions about protocol interactions.

The risk framework described here integrates directly with Purple Flea's infrastructure. Use /crypto-wallet-api for on-chain execution, /defi-lending-api for collateralized positions, and /staking-api for yield generation — all with the risk checks above running before every transaction.