Ready to Build Your DeFi Protocol?
Get expert guidance on building your DeFi protocol from economics to mainnet.
Complete Guide
Quick Answer
Building a DeFi protocol requires 8 phases: Economics Modeling (Weeks 1-4 — simulate tokenomics in Python/R), Technical Specification (Weeks 4-6 — document every function), Smart Contract Development (Weeks 6-18 — 95%+ coverage, fuzz testing), Internal Security Review (Weeks 16-20 — Slither, Mythril), External Security Audit (Weeks 20-28 — $15,000–$180,000), Testnet Deployment (Weeks 26-30), Mainnet Launch (Weeks 30-34 — TVL cap, Immunefi), and Post-Launch Operations (ongoing). Timeline: 24-30 weeks for simple DeFi, 34-44 weeks for complex protocols.
Phase 1: Economics Modeling (Weeks 1–4)
Before any code: simulate the tokenomics and protocol economics in Python or R.
For a lending protocol: Model the interest rate curve at all utilization levels. Simulate what happens when utilization hits 95% (high borrow demand) — does the interest rate spike enough to incentivize new lenders? Simulate a March 2020 ETH crash scenario — can the liquidation engine clear all underwater positions before insolvency?
For a DEX: Model impermanent loss at various volatility levels. Calculate the fee income required to compensate LPs at target volatility. Determine the liquidity mining emission that bootstraps the initial TVL.
Deliverable: A quantitative economics model (not a whitepaper). Simulations showing the protocol remains solvent under defined stress scenarios.
Phase 2: Technical Specification (Weeks 4–6)
Document every contract function before writing any Solidity:
State variables (name, type, valid ranges, storage slot)
Functions (inputs, checks, state changes, outputs, events)
Access control (which roles can call what)
Invariants (what must always be true regardless of inputs)
External dependencies (oracles, other protocols, bridges)
Deliverable: Technical Specification Document. Every line of code will be checked against this document during audit.
Phase 3: Smart Contract Development (Weeks 6–18)
Development proceeds from specification, not from copying existing protocols.
Core contract development order (lending protocol example):
1. Interest rate model contract (pure math, easiest to test)
2. Price oracle integration (with staleness checks, circuit breakers)
3. Core pool contract (deposit, borrow, repay, withdraw)
4. Liquidation engine (tiered bonus, partial liquidation)
5. Protocol fee management (reserve factor, treasury)
6. Governance integration (if applicable)
Testing requirements:
Line coverage: 95%+
Branch coverage: 90%+
Fuzz testing on all arithmetic functions
Invariant testing (health factor invariant, supply/borrow balance invariant)
Phase 4: Internal Security Review (Weeks 16–20)
Before engaging external auditors, run internal security analysis:
# Automated analysis
slither . --json slither_output.json
mythril analyze src/LendingPool.sol --execution-timeout 900
# Manual review checklist:
# □ All external calls follow CEI pattern
# □ No spot price oracle usage anywhere
# □ All admin functions behind TimelockController
# □ Storage layout preserved for upgradeable contracts
# □ Flash loan attack modeled for every public functionAll Critical and High findings from automated tools fixed before external audit.
Phase 5: External Security Audit (Weeks 20–28)
Select audit firm appropriate to protocol complexity:
Simple staking contract (<500 LoC): Certik, Halborn ($15,000–$40,000, 2–3 weeks)
AMM DEX (1,000–2,000 LoC): Halborn, Spearbit ($40,000–$80,000, 3–4 weeks)
Full DeFi protocol (2,000+ LoC): Trail of Bits, OpenZeppelin ($80,000–$180,000, 4–8 weeks)
Manage the engagement: technical kickoff call, 4-hour response SLA for auditor questions, fix all Critical and High findings, request re-audit of fixed findings.
Phase 6: Testnet Deployment (Weeks 26–30)
Deploy to public testnet (Sepolia, Arbitrum Goerli, or Polygon Mumbai):
Community bug bounty on testnet (smaller rewards, 2–4 weeks)
Integration testing with all external dependencies
Front-end integration testing
Economic simulation with real users on testnet
Phase 7: Mainnet Launch (Weeks 30–34)
Pre-launch:
Deploy from exact audited commit hash
Deploy contracts in sequence (infrastructure → core → governance)
Verify all contracts on Etherscan
Set TVL cap (e.g., $1M maximum for first 30 days)
Activate Immunefi bug bounty
Set up Tenderly monitoring with circuit breaker alerts
Launch checklist:
Multi-sig configured as admin (no single-key admin)
TimelockController with 48-hour minimum delay
Oracle staleness parameters verified on mainnet oracle addresses
TVL cap enforced in contract or at entry points
☐ Monitoring alerts confirmed firing on test event
Phase 8: Post-Launch Operations (Ongoing)
Weekly: review monitoring dashboards, check oracle health, review bug bounty disclosures
Monthly: governance parameter review, risk assessment update
Quarterly: third-party risk review, insurance assessment
Annually: full security re-audit if significant code changes