What people mean by DeFAI
DeFAI is shorthand for using artificial intelligence in decentralized finance. The label covers interfaces that explain a position, systems that recommend an action, agents that prepare transactions and policies that execute a narrow mandate. These products do not share one architecture, one level of autonomy or one safety standard.
Some people also use DeFAI to describe decentralized AI infrastructure, including distributed compute or model networks. That is a different topic. Here, DeFAI means AI inside a DeFi workflow: reading onchain state, comparing choices, preparing transactions or executing a limited mandate.
Five products hiding under one label
| System | Typical output | Execution authority | Main risk |
|---|---|---|---|
| Research interface | Explains protocols, positions or transactions | None | Stale, incomplete or invented information |
| Transaction copilot | Builds a proposed swap, deposit or withdrawal | User reviews and signs | A plausible explanation hides a harmful transaction |
| Recommendation agent | Ranks opportunities or proposes an allocation | User or manager approves | Weak assumptions, incentives or risk comparison |
| Policy-bound executor | Calls approved functions within explicit limits | Restricted wallet or smart account | Permissions exceed the intended mandate |
| Onchain allocator | Rebalances a vault or portfolio over time | Contracts plus an operator or agent | Strategy, contract, oracle and liquidity failures combine |
Products can combine these roles. A conversational interface may sit in front of a policy-bound executor, for example. Do not confuse the interface with the control boundary: a reassuring answer says nothing about what the signing account is technically allowed to do.
Follow the action from observation to settlement
The model is best used to form a proposal, not to police every boundary itself. Fixed checks should decide whether a token, contract, function and amount are permitted. Simulation can preview an expected state change; it cannot remove contract, oracle, governance or network risk.
Example: should an agent move a stablecoin position?
Suppose an agent sees a higher displayed supply rate in Protocol B than in Protocol A. A crude system treats the spread as the entire decision and moves immediately. A controlled system first records the exact contracts, rate sources, timestamp, expected holding period and every transaction step.
It then estimates withdrawal and deposit gas, swap costs if the assets differ, liquidity, reward-token assumptions and the probability that the quoted rate changes. Policy checks reject unapproved contracts, excessive token allowances, breached concentration limits or a transaction simulation that does not match the proposal. If approval is required, the user sees the actual calls and maximum loss conditions—not only a conversational summary.
expected net benefit = projected carry difference − execution costs − exit costs − modeled risk charge This formula is a decision frame, not a promise that every risk can be converted into one reliable number. Contract failure, governance intervention and unavailable liquidity can create losses outside a simple rate comparison.
A cautious tone cannot fix broad permissions
A DeFAI agent may sound cautious while holding a dangerously broad credential. Inspect enforceable permissions before judging the quality of its explanations. The mandate should answer these questions:
- Assets: which tokens can enter, leave or be approved?
- Contracts: which exact addresses and protocol versions are permitted?
- Functions: can the account swap, borrow, bridge, withdraw or change permissions?
- Size: what limits apply per action, protocol, asset and day?
- Time: when does authority expire, and how quickly can it be revoked?
- Price: what slippage, oracle freshness and minimum-output rules are enforced?
- Recovery: who can pause the system, unwind exposure or replace a compromised key?
Ethereum's current security guidance emphasizes access control, independent review and disaster recovery because deployed contracts and stolen assets can be difficult to repair. The same discipline should extend to any AI layer that can call those contracts.
Where the workflow tends to break
Bad information becomes a confident action
An agent may rely on a stale API, mislabeled token, manipulated social post or incomplete protocol history. An answer that cites a source can still overreach beyond what that source proves. Important state should be verified against authoritative endpoints and assigned an explicit freshness limit.
Untrusted data behaves like an instruction
Tool-using agents may encounter token metadata, websites, governance text or other untrusted content. If that content can override the user's mandate, the system is vulnerable to agent hijacking or indirect prompt injection. Trusted instructions and untrusted data need a hard separation, and the execution policy must remain outside the language model.
The transaction succeeds but the strategy fails
A valid onchain transaction proves that a state transition occurred. It does not prove that the price was fair, the protocol was safe, the strategy was suitable or the opportunity was described completely. Read the trade-proof scope guide before treating cryptographic evidence as investment evidence.
One component fails and leaves partial exposure
Multi-step actions may cross swaps, lending markets, bridges or derivatives. One completed step and one failed step can leave an unintended asset, debt or directional exposure. Recovery logic must begin from observed onchain state rather than blindly retrying the original plan.
Translate marketing claims into evidence
| Claim | Evidence to request | What remains unproven |
|---|---|---|
| “Finds the best yield” | Protocol universe, timestamps, fee model and rejected options | Future rates, liquidity and contract safety |
| “Non-custodial” | Key owner, allowance scope, upgrade roles and withdrawal path | Absence of every privileged control |
| “Autonomous” | Callable functions, policy limits, pause path and action log | Correct judgment in new conditions |
| “Audited” | Named code version, report, date, scope and unresolved findings | Safety after upgrades or integrations |
| “Verifiable” | Exact statement the proof or record establishes | Strategy quality and offchain completeness |
Related categories, and where each guide helps
Use the AI trading agents guide to inspect planning, tools and execution controls. Use onchain asset management when the question is who owns the assets, how a portfolio mandate is enforced and how performance is accounted for. The automated trading systems guide covers the wider operational loop from data through recovery.
Sources and scope
- CFTC Technology Advisory Committee — Decentralized Finance report
- IOSCO — Policy Recommendations for Decentralized Finance
- NIST — Strengthening AI Agent Hijacking Evaluations
- Ethereum.org — Smart contract security
- Onchain Off Emotion editorial methodology
The stablecoin scenario is illustrative. It does not show that a named product supports these actions or that delegating them is suitable for your wallet.