Revision — The Ecosystem: DeFi, NFTs & DAOs

Every earlier Part in this book built the machine: accounts and a global state map, gas-metered execution in the EVM, a state root that fingerprints the result, and a consensus layer that lets untrusting strangers agree on which state comes next. The Smart Contracts part then handed us a way to put arbitrary programs into that state. This Part spent all of that machinery on one thing: building an economy on top of it.

This page is a prose recap. It does not re-derive any single protocol — the seven pages before it did that. It re-connects them into one picture, so that by the end you can look at the whole DeFi stack and, for each layer, name two things: where it hides its trust, and where it hides its cost. That pairing is the entire throughline of this book — how do untrusting strangers agree on the state of a shared world computer, and what does it cost to run one? — and DeFi is that question asked about money, ownership, credit, and votes instead of just blocks.

The one idea, stated once

Hold a single frame and every page in this Part becomes an instance of it rather than a separate thing to memorise:

Each DeFi primitive is untrusting strangers agreeing on a richer shared state — not just balances, but markets, debts, pegs, prices, and votes — and the cost of that richer agreement is always a new place where trust or risk hides.

The base machine already lets strangers agree on “who owns how much ETH.” Every layer in this Part widens what they agree on. A token contract lets them agree on who owns how much of anything. An AMM lets them agree on a price, continuously. A lending pool lets them agree on who owes what to whom. A stablecoin lets them agree that one unit equals one dollar. And each widening buys its convenience by introducing a seam — a formula that can be gamed, a collateral ratio that can be under-water, an oracle that must be trusted, a multisig that must be honest. The rest of this recap walks the stack from the composable base up to the trust seams at the top.

   LAYER                    what strangers now agree on          where trust / cost hides
   ───────────────────────────────────────────────────────────────────────────────────────
   tokens (ERC-20/721/1155) who owns how much of anything         a shared interface everyone trusts
   AMMs (x·y=k)             a live price for a pair               slippage + impermanent loss
   lending (Aave/Compound)  who owes what, over-collateralized    liquidation risk + a price feed
   stablecoins              1 unit ≈ 1 dollar                     collateral quality OR a broken loop
   oracles (Chainlink)      an off-chain fact, on-chain           re-imported real-world trust
   DAOs / governance        who controls the protocol             token-weighted plutocracy
   bridges                  value moving between chains           a pooled honeypot behind a multisig

The composable base: tokens are just maps behind an interface

Start at the bottom, with Token Standards: ERC-20, ERC-721 & ERC-1155. The single most demystifying idea in this whole Part is that a token is not a coin. There is no object moving around. A token is a contract that keeps a map in its own storage — and the “standard” is nothing but an agreed-upon set of function signatures that every wallet, exchange, and protocol knows how to call.

   ERC-20  (fungible)     balances : address → uint256          "how much do you hold?"
   ERC-721 (unique/NFT)   owners   : uint256(tokenId) → address "who owns THIS one?"
   ERC-1155 (multi-token) balances : (id, address) → uint256    "how much of id N do you hold?"

That is the entire secret. An ERC-20 balance is a number in slot-derived storage inside the token contract; a transfer is a contract debiting one key and crediting another, exactly the way the counter contract in the EVM part incremented a number in slot 0. Ownership of a rare NFT is one row in a mapping(uint256 => address). Nothing physical changes hands; the network simply agrees, by re-executing the transfer against consensus, that the map now reads differently.

Why this is the base layer and not just another example: the shared interface is what makes composition possible. Because every ERC-20 exposes the same balanceOf, transfer, and approve, an AMM can hold any ERC-20 without knowing which one; a lending pool can accept any ERC-20 as collateral; a DAO can count votes in any ERC-20. Standardisation is the API of the money layer, and the “money Lego” reputation of DeFi is a direct consequence of it. The hidden cost here is subtle and social rather than economic: everyone in the stack now trusts the interface — trusts that a contract calling itself an ERC-20 will not lie in transfer or re-enter on a hook. Malicious or non-standard tokens are the first crack, and every layer above assumes this crack is not being exploited.

The market layer: AMMs price assets with a formula, not an order book

On top of tradeable tokens comes the need to swap them, covered in AMMs & Uniswap’s x·y = k. A traditional exchange matches buyers to sellers in an order book — but an order book needs constant off-chain market-making and is expensive to run on-chain. The Automated Market Maker replaces the matchmaker with a formula. A pool holds a reserve of two tokens, x and y, and enforces one invariant on every trade:

   x · y = k     (k held constant across a swap, before fees)

   pool has:  100 TOKEN_X  and  100 TOKEN_Y     →   k = 10,000
   you add:    10 TOKEN_X
   new x = 110  →  new y = k / x = 10,000 / 110 ≈ 90.909
   you receive: 100 − 90.909 ≈ 9.09 TOKEN_Y   (not 10 — the curve charges you)

The price is simply the ratio of the reserves, and the constant-product curve makes it move against you as you trade: the bigger your swap relative to the pool, the worse your effective rate. That gap is slippage, and it is not a bug — it is how a pure function stands in for a market. The pool never needs a counterparty or a price oracle to quote a swap; the curve is the price discovery.

The trust seam and cost live in who supplies the reserves. Liquidity providers deposit both tokens and earn a cut of every swap fee, but they carry impermanent loss: when the external price of the pair moves, arbitrageurs trade against the pool until its ratio matches the market, and the LP is left holding relatively more of the token that fell. Compared to simply holding the two tokens, the LP can come out behind — the “loss” is the price the pool pays to always offer a quote. So the market layer’s convenience (a swap that always executes, with no counterparty) is bought with two costs pushed onto users and LPs: slippage on the trader, impermanent loss on the provider.

The credit layer: lending pools turn deposits into over-collateralized loans

With prices available, you can build credit, covered in Lending Protocols: Aave & Compound. The hard problem of lending to a stranger is default: on a pseudonymous network you cannot repossess a house or sue a borrower. DeFi’s answer is blunt and effective — over-collateralization. You never lend to a promise; you lend against a deposit that is worth more than the loan.

   deposit  150 USD of ETH  as collateral        (collateral ratio must stay > 100%)
   borrow    100 USD of DAI                        →  loan-to-value = 66%

   ETH price drops → collateral now worth 120 USD → LTV rises toward the limit
   crosses the liquidation threshold → anyone may repay your debt, seize your
   collateral at a discount, and pocket the bonus. The pool stays solvent.

Depositors earn interest; borrowers pay it; the rate floats algorithmically with pool utilization (how much of the supplied capital is currently borrowed). The whole system is kept solvent not by trust in borrowers but by liquidation: a permissionless bounty that lets anyone close an under-collateralized position for a reward, so the pool is made whole before a loan ever goes under water. This is a beautiful reframing of credit as pure collateral math — no identity, no credit score, no court.

But notice the seam it depends on: liquidation needs to know the collateral’s price. The entire solvency guarantee rests on the pool reading an accurate, current price for every asset it holds — which is exactly the assumption the next layer both provides and endangers. Lending is where the market layer’s price and the oracle layer’s trust meet, and where a wrong price does not cost slippage but drains the pool.

The peg layer: stablecoins hold a price by collateral or by faith

Traders and borrowers both want a unit that does not swing, which is the job of a stablecoin, covered in Stablecoins: Collateralized vs Algorithmic. A stablecoin is an ERC-20 that promises one token equals one dollar. There are two families, and the difference between them is the difference between backing a promise with an asset and backing it with a mechanism.

   COLLATERALIZED                              ALGORITHMIC
   ────────────────────────────────────        ────────────────────────────────────
   each unit is redeemable for real value       peg held by a supply-adjusting loop,
   fiat-backed  : dollars in a bank (USDC)       often with a paired "absorber" token
   crypto-backed: over-collateralized ETH/etc.   no hard collateral floor underneath
   (DAI, via a lending-style vault)              trust = faith the loop holds under stress
   trust = the custodian / the collateral        cost  = a reflexive death-spiral risk

A collateralized stablecoin holds the peg because you could, in principle, redeem it for the thing backing it — dollars in a bank for a fiat-backed coin like USDC, or an over-collateralized basket of crypto for a coin like DAI (which is essentially the lending layer pointed at a single goal: mint a stable unit against a surplus of volatile collateral). The trust seam is honest and visible: you are trusting the custodian to actually hold the reserves, or trusting the collateral to stay above water.

An algorithmic stablecoin tries to hold the peg with no hard collateral floor, using a supply-adjusting loop — typically a second “absorber” token that is minted and burned to soak up demand shocks. When confidence is high the loop is elegant. When confidence breaks, it is reflexive: the mechanism that defends the peg on the way up accelerates the collapse on the way down.

The algorithmic stablecoin UST was defended by minting and burning its paired token LUNA. In May 2022, once UST slipped below its dollar peg under heavy redemptions, the “defense” minted ever more LUNA to absorb the exits — collapsing LUNA’s price, which destroyed the very backstop the peg relied on, which pushed UST further from the peg. Roughly $40+ billion of market value evaporated in days. The lesson is exact: a peg held by faith in a loop rather than by redeemable collateral has no floor, and reflexivity turns its own stabilising mechanism into an accelerant. It is the clearest demonstration in this Part that “where the trust hides” and “where the cost lands” are the same place — the seam that was supposed to hold the system together is the seam that broke it.

The trust seams at the top: oracles, DAOs, and bridges

Everything so far lived inside the machine — maps, curves, collateral ratios, all enforced by re-execution against consensus. The last page, DAOs, Governance & Cross-Chain Bridges, together with the oracle page, Oracles: Chainlink & Bringing the World On-Chain, is where the stack reaches outside itself — and every reach outside is a trust seam. These are, not by coincidence, the industry’s three largest exploit surfaces.

Oracles — re-importing off-chain trust

A contract is deterministic and sandboxed by design; it cannot call an API or read a stock price, because every validator must be able to re-run it and get the identical answer. So the moment DeFi needs a real-world fact — the USD price of ETH for a liquidation — it has to import that fact through an oracle: an off-chain reporter (or a decentralized network of them, as with Chainlink) that pushes data on-chain.

   inside the machine          the seam            outside the machine
   ───────────────────         ──────────          ───────────────────
   deterministic, sandboxed    ORACLE  ◄──────────  the real world (prices, events)
   "everyone re-runs and       (trusted            non-deterministic, un-verifiable
    agrees on the SAME state"   reporter)           by consensus

This is the sharpest re-introduction of trust in the whole book: the network can agree perfectly on what the oracle reported, but it cannot verify whether the report was true. The consensus guarantee stops at the seam. Chainlink’s answer is to decentralize the reporter — aggregate many independent nodes so no single one can lie — but the category of risk never goes to zero. And because lending and stablecoins depend on the price the oracle feeds, a manipulated feed is not a display glitch; it is a drain. (This is exactly the flash-loan oracle attack studied in the Security part: shove a manipulable spot price for one block, then borrow or liquidate against a protocol that read it as truth.)

DAOs — distributing control by token weight

If a protocol upgrades itself, who decides? A DAO answers by distributing control through token-weighted voting: proposals are executed on-chain only if enough governance-token votes back them. This turns “who controls the protocol” into another richer shared state that untrusting strangers agree on — no CEO, no board, just a tally the chain enforces.

The trust seam is that one token equals one vote is plutocracy, not democracy. Voting power tracks capital, so whoever accumulates (or borrows, via a flash loan) enough tokens for the length of a vote can seize control. Governance is a genuine attack surface: a hostile proposal that drains the treasury is perfectly valid by the rules, exactly as the Security part’s thesis warned — the machine will faithfully execute the theft it was told to. The cost of decentralizing control is a permanent governance attack surface priced in tokens.

Bridges — pooling value behind a multisig

Finally, moving value between chains. A chain cannot see another chain’s state, so a bridge typically locks your asset in a contract on chain A and mints a representation on chain B, with a set of off-chain signers (often a multisig) attesting that the lock really happened. That design pools enormous value in one contract, guarded by a handful of keys — a honeypot with the guards named on the door.

Cross-chain bridges have been the single most catastrophic exploit surface in DeFi. The Ronin bridge lost roughly $600M in March 2022 when an attacker obtained enough of its validator keys to forge withdrawal approvals; the Wormhole bridge lost about $320M in February 2022 to a signature-verification flaw; the Poly Network bridge lost around $600M in August 2021. The pattern is identical to Terra’s, one layer over: the bridge’s security reduces to “trust these N signers,” and that seam — not the contract math, not the consensus — is where hundreds of millions drained. A bridge concentrates value behind an off-chain trust assumption, and off-chain trust assumptions are exactly what the rest of the machine was built to eliminate.

The whole stack, in one breath

Put end to end, this Part builds an economy in layers, each widening what strangers agree on and each paying for that widening with a seam. Tokens are maps behind a shared interface — the composable base where everyone trusts the standard. AMMs price any pair with x·y=k, charging slippage to traders and impermanent loss to liquidity providers. Lending pools turn deposits into over-collateralized loans kept solvent by permissionless liquidation — as long as the price is right. Stablecoins hold a peg by real collateral (honest, visible trust) or by an algorithmic loop (which, as Terra proved in 2022, can have no floor). And at the top, three seams reach outside the machine: oracles re-import off-chain facts the consensus cannot verify, DAOs distribute control by token weight into a plutocracy any large-enough holder can capture, and bridges pool value behind a multisig that has, again and again, been the place the money left.

That is how untrusting strangers agree on a richer shared world — not merely balances, but markets, debts, pegs, prices, and votes. And the cost is now legible in a single sentence: every layer you add to the shared world computer adds a place for trust or risk to hide, and the exploits of the last few years are simply the network discovering, at scale, exactly where those places were. The base machine could make theft impossible-to-forge; it could never make it impossible-to-author. From here, the book turns from what gets built on the world computer to how you keep it honest and how far it can scale.