Threat Model Example for a DeFi Lending Protocol

Video transcript

A good DeFi threat model names the assets, actors and trust boundaries, then walks every path to the funds. Here is a worked example for a fictional lender.

The Threat Modeling Manifesto asks four questions. What are we working on, what can go wrong, what are we going to do about it, and did we do a good enough job?

For ExampleLend, assets run from pooled deposits and collateral prices to admin authority, the liquidation flow, user approvals and the release pipeline.

Then mark trust boundaries. An outside price decides solvency, and a signer's laptop holds upgrade power.

STRIDE sorts threats into six types, from a spoofed frontend to elevation of privilege. Each threat gets a control, like price bounds for a tampered oracle.

Attack paths show how threats chain into a loss. Radiant Capital lost 50 million dollars in October 2024 after malware gave attackers several private keys, CoinDesk reported.

The model ends with residual risk, each with an owner. A signer compromise still needs four of seven keys, with 48 hours to react.

Threat models go stale with the next upgrade. In Managed Security, Guardian maintains yours in real time, reviewing every multisig transaction and every deployment and configuration change.

Read the full example to copy the structure, or talk to Guardian about mapping every path to your funds.

The Threat Modeling Manifesto frames the work as four key questions:

1. What are we working on?
2. What can go wrong?
3. What are we going to do about it?
4. Did we do a good enough job?

Below is a worked answer for ExampleLend, a fictional lending protocol. Its design is typical; its name, settings and team are invented.

We sort threats with STRIDE, the model Microsoft uses to categorize them, then trace attack paths through each layer. Copy the structure, not the contents.

Scope and Assets

ExampleLend (fictional) is an overcollateralized lender on one EVM chain. Users deposit collateral, borrow against it, and are liquidated below a health threshold.

In scope: the contracts, the oracle setup, admin keys, the frontend and the offchain services that run it.

Actors and Trust Boundaries

Each actor, and what it can do:

• Users: deposit, borrow and repay. Untrusted.
• Liquidators: anyone can liquidate an unhealthy position. Untrusted, but relied on.
• Admin multisig (4 of 7): upgrades and risk settings, behind a 48-hour timelock.
• Pause multisig (2 of 3): can pause markets; cannot unpause or upgrade.
• Oracle providers: supply prices. Trusted within bounds.
• Core team and vendors: run the frontend, DNS, cloud and keepers.
• Attackers: outside, or inside any of the above.

Trust boundaries are where data or authority crosses between actors:

1. User wallet to contracts: every input is hostile.
2. Oracle to contracts: an outside price decides solvency.
3. Signer device to multisig: a laptop holds upgrade power.
4. DNS and CDN to the browser: the site decides what users sign.
5. CI to production: whoever controls the pipeline controls what ships.

Threats by STRIDE

STRIDE names six threat types. Applied to ExampleLend:

STRIDE finds threats per component. Attack paths show how they chain into a loss.

Attack Paths

One path per layer, with ExampleLend's control and a real incident where one fits. For the wider map, see blockchain security risks by layer.

Contracts

Path: an accounting bug lets a borrower take more than their collateral covers.

Seen before: Euler Finance lost about $197 million on March 13, 2023, through a flaw in its donation-to-reserves logic, Chainalysis reported. The funds were later returned.

Control: invariant fuzzing on solvency, an audit of every market type, and a tested pause.

Oracles

Path: a wrong collateral price lets borrowers drain markets, or triggers false liquidations.

Seen before: on February 15, 2026, a Moonwell governance proposal switched on a misconfigured oracle. It valued cbETH at about $1.12, not roughly $2,200.

Moonwell was left with about $1.78 million in bad debt, Decrypt reported.

Control: price bounds, a fallback source, and a simulation of every oracle change before it executes.

Admin keys and upgrades

Path: an attacker compromises enough signer devices to pass an upgrade.

Seen before: Radiant Capital lost $50 million on October 16, 2024. Malware delivered as a zipped PDF gave attackers control of several private keys, CoinDesk reported.

Control: a timelock users can exit through, dedicated signing devices, and independent decoding of every transaction before signing.

Frontend

Path: a hijacked domain serves a drainer that asks users to sign malicious approvals.

Seen before: on April 14, 2026, a social engineering attack on a registrar gave attackers CoW Swap's cow.fi domain for several hours.

About 1.2 million USDC of user funds was taken, the CoW core team estimates.

Control: registrar lock, alerts on DNS changes, and monitoring of the served bundle.

Infrastructure

Path: a stolen CI token ships a malicious frontend build, or swaps a keeper key.

Control: least-privilege cloud roles, protected branches, reviewed deploys and keeper keys that can only liquidate.

Controls and Residual Risk

The model ends with what is left after the controls. Write it down, with an owner.

ExampleLend accepts these, and reviews them at every upgrade, new market and signer change.

Then plan the response: who can pause, how signers are reached, and what users are told. See our DeFi incident response plan.

How Guardian Keeps It Live

A threat model goes stale with the next upgrade. The manifesto values "continuous refinement" over a single delivery.

Guardian's OpSec audit starts with this map: the contracts that hold funds, the roles that can move them, and the keys, signers and multisigs behind each one.

In Managed Security, Guardian maps every path to a protocol's funds and maintains that threat model in real time.

Its security operations team reviews every multisig transaction before it is signed, and every deployment and configuration change as it lands.

Frequently Asked Questions

What should a DeFi threat model include?

Scope and assets, actors and trust boundaries, threats per component, attack paths to the funds, a control for each path, and the residual risk you accept, with an owner. Cover keys, oracles, frontends and infrastructure, not just contracts.

What is STRIDE?

STRIDE, the model Microsoft uses to categorize threats, has six types: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. Apply each type to each component of the protocol, onchain and off.

How often should a DeFi threat model be updated?

Whenever the system changes: an upgrade, a new market, a new oracle, a signer change or new infrastructure. The Threat Modeling Manifesto values continuous refinement over a single delivery.

Is a threat model the same as an audit?

No. An audit tests code for vulnerabilities. A threat model maps how funds could be lost across code, keys, oracles, frontends and infrastructure, and which control covers each path. An audit is one of those controls.

Sources

• Threat Modeling Manifesto: the four key questions and values (read November 6, 2026)
• Microsoft Learn: Threats, Microsoft Threat Modeling Tool, STRIDE model (updated March 4, 2026)
• Chainalysis: $197 Million Stolen, Euler Finance Flash Loan Attack Explained (March 15, 2023, updated April 6, 2023)
• Decrypt: Oracle Error Leaves DeFi Lender Moonwell With $1.8 Million in Bad Debt (February 18, 2026)
• CoinDesk: Radiant Capital Says North Korean Hackers Behind $50 Million Attack in October (December 9, 2024)
• CoW DAO Forum: CIP-86, Discretionary Grants Program for Victims of the cow.fi Domain Hijacking (April 23, 2026)
• Guardian: OpSec Audit
• Guardian: Managed Security