How To Vet New DeFi Yield Positions Within 2 Hours

The Critical Distinction: Newly Tracked Versus Newly Deployed

Three positions appeared in yield aggregators this week. Spark ETH at 1.45% on $58M. Curve OETH-WETH at 1.78% on $50M. Aave WETH at 4.82% on $26M. None of them are new contracts. When a DeFi position vanishes from yield trackers, you have two hours to separate data bugs from exploit signals. The reverse is also true. When a position appears, you have the same window to determine if you're looking at a newly listed mature protocol or a genuinely untested deployment. The distinction matters because it changes your timeline. A six-month-old contract with $50M TVL has survived 180 days of adversarial testing. A contract deployed three days ago has survived zero. The vetting protocol for each is different. One takes 15 minutes. The other takes 72 hours and should probably wait. Most DeFi positions that suddenly appear in tracking dashboards are not new deployments. They are newly indexed by data aggregators. Spark Protocol deployed in 2024. Aave V3 Base launched March 2026. The Curve OETH-WETH pool existed in April 2026 with $56.7M TVL. These are mature positions that aggregators started tracking, not contracts that teams deployed last week. The 15-minute separation check prevents allocating two hours to a question already answered on-chain.

The 15-Minute Separation Check

Open Etherscan. Paste the contract address. Check the creation date. If the contract is older than six months, you are looking at a mature deployment that a data aggregator just added to its index. The vetting protocol shifts from "should I trust a new contract" to "why did this suddenly appear, and does the underlying protocol still meet diligence standards."

Step 1: Query Contract Creation Date

Go to Etherscan. Enter the pool contract address or the lending market address. The contract creation transaction shows the deployment date and block height. Spark Protocol: deployed 2024. Aave V3 on Base: March 2026. Curve OETH-WETH: indexed April 2026 with historical TVL data available on DefiLlama. A contract older than six months is not new. It has been live, adversarially tested, and accessible to anyone running their own indexer. What changed is tracking coverage, not contract state.

Step 2: Check Historical TVL Snapshots

Open DefiLlama. Navigate to the protocol page. Check the TVL history chart for the specific chain or market. Spark Protocol on DefiLlama shows TVL history extending back through 2024. If the chart shows six months of data, the contract is six months old. If the chart shows three days, you have a newly deployed position. Curve OETH-WETH held $56.7M TVL in mid-April 2026. Current tracking shows $53.59M as of late October. The pool did not appear three days ago. The tracking feed updated.

Step 3: Review Governance and Audit History

Navigate to the protocol governance forum or GitHub repository. Check proposal history and audit publication dates. Aave governance discussion from September 2026 covers a WETH interest rate adjustment on Base. That discussion references an already-live market. You cannot adjust rates on a market that does not exist yet. The market predates the proposal. If governance discussions, audit reports, and community activity extend back months, the contract is not new.

What The 15-Minute Check Rules Out

Newly listed does not mean newly risky. A mature protocol that a tracker just indexed carries the same risk profile it had yesterday, before the tracker added it. You do not need to re-audit Aave because DefiLlama added a new data feed. But you do need to verify that the "new" listing corresponds to the known deployed contract, not a malicious clone with a similar name. Check the contract address against the protocol's official documentation. If the address matches, the 15-minute check is complete. If the contract was deployed in the last 30 days, stop. Do not allocate. Wait 60 more days and re-evaluate. Truly new protocols require 48 hours of diligence plus a 90-day observation period before committing size.

The 2-Hour Vetting Protocol For Mature Positions

You have confirmed the contract is six months old. The position is newly tracked, not newly deployed. Now you vet the protocol itself using the standard diligence framework, prioritized by which checks catch 90% of problems.

0 to 15 Minutes: Audit Status and Code Freshness

Find the audit report. It should identify the exact GitHub repository and commit hash reviewed. If the report only names the protocol without specifying the reviewed artifact, the scope is ambiguous. Spark Protocol uses a fork of Aave V3, deployed by the Sky ecosystem (formerly MakerDAO). Aave V3 has been audited extensively. Spark has its own bug bounty program with over $1.2M paid out. That is not speculation. That is published program data. Check the audit report date. Protocols ship quickly. An audit from six months ago may describe a system that no longer exists. Confirm that the reviewed commit hash corresponds to the bytecode currently deployed on-chain. Go to Etherscan. Open the verified contract source. Compare the deployment date to the audit date. If the contract was redeployed after the audit, the audit does not cover the live code. A new version resets the clock, even under an old brand.

15 to 45 Minutes: Code Match and Governance Review

The audit report may be legitimate. The deployed code may still be different. Confirm that the audited commit hash corresponds to the bytecode currently deployed on-chain. Check Etherscan for verified source code. If the source is unverified, stop. Do not allocate to a contract with unverified bytecode, regardless of brand name. Open the protocol governance forum. Filter by proposals from the last 30 days. Look for parameter changes, rate adjustments, or emergency actions. On October 28, 2026, Yield Basis disclosed a deposit-and-withdraw fee-extraction issue in Curve, accompanied by a propAMM announcement for the WETH market. This is a real-time security disclosure on the exact date of this article. Even established pools can surface new risks via governance proposals filed within the last seven days. Check multisig signers. Navigate to the protocol's multisig address on Etherscan. Review the signer list. Are they known contributors with public profiles, or are they anonymous addresses? If anonymous, check whether those addresses have participated in other protocol governance or whether they appeared solely for this deployment. A multisig controlled by five anonymous addresses created two weeks ago is a red flag. A multisig controlled by known ecosystem participants with multi-year on-chain histories is standard.

45 to 120 Minutes: Economic Viability and Exit Risk

Check TVL trend over the last 30 days. Open DefiLlama. Navigate to the protocol page. Review the TVL chart. Is it growing, flat, or shrinking? Spark Protocol holds $6.857 billion in total value locked. SparkLend on Ethereum shows $5.762 billion TVL. That is not a new protocol struggling for traction. That is a mature lending market with demonstrated product-market fit. Curve OETH-WETH held $56.7M in April 2026 and $53.59M in late October. Slight decline, but within normal range for a mature pool. Check utilization rate. High utilization above 90% blocks exit at announced rates. Lending protocols calculate borrow rates based on utilization curves. When utilization approaches the kink point, borrow rates spike and lenders cannot withdraw without waiting for borrowers to repay or liquidate. Navigate to the protocol interface. Check current utilization. If utilization is above 85%, confirm that the yield advantage justifies the exit risk. A position earning 0.2% more than the next-best alternative is not worth the risk of being unable to withdraw for three days during a market move. Separate the yield sources. Identify how much comes from fees, lending demand, token emissions, leverage, or a fixed-term instrument. Treat projected incentives as less durable than revenue supported by real usage. Spark routes idle USDS into the SSR and passes the return to USDC and USDS depositors. That puts Spark's USDC supply APY close to the Sky base rate. The yield source is protocol revenue from the Sky ecosystem, not inflationary token emissions. That is more durable. Curve OETH-WETH shows 1.65% net APR with fee structure including a donation APY of 2.60% and a releverage fee of 150 basis points. The fee structure changed recently via governance proposal. Previous configuration used a native Twocrypto fee curve ranging from 1.36% to 2.82%. Rebalancing risk is material for LPs when fee structures shift.

Test The Exit

Before committing size, make a small deposit and withdraw it. Look for withdrawal queues, cooldowns, and the utilization level at which lenders can no longer withdraw. Some protocols impose withdrawal delays during high utilization. Others require advance notice for large withdrawals. If you cannot withdraw a test deposit within 10 minutes during normal market conditions, do not allocate significant capital.

What Catches 90% of Problems, Ranked By Speed

The vetting framework above is exhaustive. Most allocators do not have two hours per position. Here is the prioritized checklist, ranked by which checks catch the most problems in the least time. Deployment date (5 minutes): Rules out true newness. If the contract is six months old, you are not the first person to allocate. Adversarial testing has already occurred. Audit freshness and code match (15 minutes): Catches unreviewed changes. A six-month-old audit on a contract redeployed three weeks ago provides zero safety. TVL trend and utilization (10 minutes): Signals imminent rate collapse or exit lock. Shrinking TVL indicates users withdrawing. Rising utilization indicates you may not be able to withdraw when you want. Yield composition (20 minutes): Separates sustainable from inflationary yields. Fees and lending demand are durable. Token emissions are temporary. A 4.82% yield composed entirely of token rewards will not be 4.82% in 90 days. Team identity and multisig (20 minutes): Identifies anonymous or compromised governance. A known team with a multi-year track record is not a guarantee, but it is a filter. Anonymous founders with newly created multisig addresses are a red flag. Read the incident history. Check how many audits exist and how recent, whether a live bug bounty exists, and how long the current contract version has been deployed. A new version resets the clock, even under an old brand.

The Looping Strategy Conflation Problem

The "4.82% Aave WETH" figure in the original premise conflates base lending rates with looping strategies. This is a common error in yield aggregator listings and requires specific attention. Aave V3 Base shows WETH supply APR at 1.31%. That is the base lending rate. WETH looping shows 24-hour APY of 7.38% with a 30-day average of 7.09%, currently indexed at $27k TVL on Base, live since April 2026. Looping strategies borrow against deposited collateral and redeposit the borrowed amount to multiply exposure. The yield is higher because the position is leveraged. The risk is also higher because the position is leveraged. A 4.82% figure does not appear in base Aave WETH supply rates or in the documented looping strategy rates. It may be a historical snapshot, a mid-point calculation, or an aggregator error. When a listed yield does not match the protocol's own interface, verify the source. Open the protocol interface directly. Do not rely solely on aggregator data. If the aggregator shows 4.82% and the protocol interface shows 1.31%, the aggregator is either outdated, displaying a looped yield without labeling it, or pulling data from a wrapped vault rather than the base position. Distinguish position type: pure lending versus automated leverage versus vault-wrapped yield. Each carries different risk. Pure lending exposes you to protocol risk and utilization risk. Looping exposes you to liquidation risk. Vault-wrapped positions expose you to vault contract risk and strategy execution risk.

Real-Time Risk: The October 28 Curve Disclosure

On October 28, 2026, Yield Basis disclosed a deposit-and-withdraw fee-extraction issue in Curve, accompanied by a propAMM announcement for the WETH market. This disclosure occurred on the same day as this article. The Curve OETH-WETH pool referenced in the opening is a Curve pool. The disclosure affects fee structure and rebalancing mechanics for Curve liquidity providers. This illustrates why the vetting framework must include checking governance proposals dated within the last seven days. A pool that was safe two weeks ago may have a newly disclosed issue today. The contract did not change. The knowledge about the contract changed. Governance forums and protocol announcement channels are on-chain or near-on-chain information sources. Treat them as part of the diligence process, not as optional reading. Curve pool vetting requires reviewing recent governance activity to catch fee structure changes, parameter adjustments, or disclosed vulnerabilities.

What To Do After Vetting

You have completed the 2-hour vetting protocol. The position passed. The contract is mature, the audit is recent, the code matches, the TVL is stable, utilization is reasonable, the yield is fee-based, and the team is known. Now you size the position. Allocate no more than 10% of your DeFi portfolio to any single protocol on first entry, regardless of how well it passes diligence. If the protocol has been live for 12 months with no incidents, you can increase to 20% over time. Monitor utilization weekly. Set alerts for utilization crossing 80%. When utilization rises above 85%, prepare to exit if the yield premium does not justify the illiquidity risk. Monitor governance proposals. Check the forum weekly for parameter changes, rate adjustments, or emergency actions. Most DeFi incidents are preceded by governance activity or community discussion. If you see a proposal to change collateral factors, adjust interest rate curves, or pause deposits, treat it as a signal to review your position. Monitor TVL. If TVL drops 20% in seven days, investigate. Check on-chain outflows to determine whether users are rotating to higher yields elsewhere or exiting due to undisclosed risk. Test exit every 30 days. Make a small withdrawal to confirm the position remains liquid. If you cannot withdraw during normal conditions, reduce position size immediately.

The Takeaway: Speed Versus Safety In Yield Capture

Being first into a legitimate new 4.82% position on $100k earns $4,820 annually. Deploying into an unvetted contract risks total loss. Two hours of checking prevents $100k mistakes. But most "new" positions are not new. They are newly tracked. The 15-minute separation check prevents wasting two hours on a question the blockchain already answered. Spark launched in 2024. Aave V3 Base launched March 2026. Curve OETH-WETH held $56.7M in April. These are not new deployments. The vetting framework prioritizes speed by ranking checks based on problem detection rate. Deployment date rules out newness in five minutes. Audit freshness catches unreviewed changes in 15 minutes. TVL and utilization signal rate collapse or exit lock in 10 minutes. The remaining 90 minutes cover yield composition and team diligence. Every claim in this framework is verifiable on-chain. Contract creation dates are on Etherscan. TVL history is on DefiLlama. Governance proposals are in protocol forums. Utilization rates are in protocol interfaces. You do not need to trust an aggregator. You can verify each step yourself. The protocol works because it separates signal from noise in 15 minutes, then allocates the remaining time to checks that actually predict loss. Deployment age, audit freshness, and exit liquidity catch 90% of problems. The rest is detail.

Frequently Asked Questions

How do I tell if a yield position is newly deployed or just newly tracked?

Check the contract creation date on Etherscan and review historical TVL data on DefiLlama. If the contract is older than six months or TVL history extends back several months, the position is mature and was recently added to tracking feeds, not recently deployed. A truly new deployment will show a creation date within the last 30 days and no historical TVL data prior to that date.

What is the most important check I can do in under 10 minutes?

Verify the contract deployment date on Etherscan and check current utilization rate in the protocol interface. Deployment age tells you whether adversarial testing has occurred. Utilization above 85% signals exit liquidity risk. Together, these two checks catch the majority of high-severity problems and take less than 10 minutes combined.

How do I verify that an audit report covers the deployed code?

Find the commit hash in the audit report, then check the contract deployment date on Etherscan. If the contract was deployed after the audit date, the audit does not cover the live code. For verified contracts, compare the audit scope to the deployed source code visible on Etherscan to confirm the reviewed version matches the live bytecode.

Why does a yield aggregator sometimes show rates that don't match the protocol interface?

Aggregators may display looped or vault-wrapped yields without clearly labeling them, use outdated data feeds, or pull rates from derivative positions rather than base lending markets. Always verify rates directly in the protocol interface. If the aggregator shows 4.82% and the protocol shows 1.31%, determine whether the higher rate reflects leverage, staking rewards, or an aggregator error.

Should I allocate capital immediately after a position passes the 2-hour vetting protocol?

No. Start with no more than 10% of your DeFi portfolio on first entry. Make a small test deposit and withdraw it to confirm exit liquidity. Monitor utilization, governance proposals, and TVL weekly for the first 30 days. If the protocol remains stable with no incidents, you can gradually increase allocation to 20% over time based on continued monitoring.