Arbitrum

Customer assets are pooled and reused, lent, posted as collateral, or traded, so the same units back more than one obligation at once.

Was zu betrachten ist: Read the custody and yield terms for language granting the venue the right to use, lend, or pledge assets. Ask whether balances are held in named or omnibus wallets and whether any regulator requires segregation for that entity. On-chain, look for regular movement between exchange-labeled addresses and affiliate or lender addresses, and check whether any proof-of-reserves exercise covers liabilities and was performed by an independent party.

One custodian, one signing arrangement, or one operations team stands between holders and their assets, so a single failure can be terminal.

Was zu betrachten ist: Establish who can sign, in what quorum, under what recovery procedure, and whether any independent party has tested the key ceremony and the disaster recovery plan. Check whether the custodian is a regulated trust company or similar, what its financial statements show, and whether it discloses subcustodians. Read the insurance policy's scope rather than the headline figure, since cause and wallet type limitations do most of the work.

A venue holding customer assets fails, and the balance shown in the account becomes a claim in a bankruptcy rather than an asset the customer controls.

Was zu betrachten ist: Read the terms of service on title, segregation, and what happens in insolvency, since the language is usually explicit once found. Check whether the venue publishes proof of reserves, whether that exercise includes liabilities, and who performed it. Withdrawal processing times during past stress, published financial statements if any, and the licensing regime that governs client money are all observable before the fact.

Self-custody puts the holder in charge of a secret that cannot be reset, so losing it or destroying the only backup is permanent.

Was zu betrachten ist: On-chain dormancy metrics show how much supply has not moved in many years, part of which is generally understood to be permanently inaccessible. For an individual arrangement, the testable facts are whether a restore has actually been performed from the backup, whether backups are geographically separated, whether any passphrase is recorded separately, and whether an inheritance procedure exists in writing. Wallet software support for the specific token standard and chain is also checkable in advance.

Attackers take assets by persuading holders to sign a transaction or reveal a secret, without breaking any cryptography or contract.

Was zu betrachten ist: Review outstanding token approvals with an allowance viewer, since standing approvals are the main mechanism and are visible on-chain. Check whether the wallet decodes calldata into a plain-language action and whether the project pins its front end to a content hash or serves it from a decentralized host. Domain hijacks, dependency compromises, and support-impersonation waves are usually documented publicly by the projects affected.

Fee and revenue figures come from code that reads each protocol differently, so a number can change because an adapter changed rather than because activity did.

Was zu betrachten ist: Read the adapter source for the specific protocol on whichever dashboard you are quoting, and note the exact definition of the metric, since fees, revenue, and earnings are used inconsistently across providers. Compare two independent providers for the same protocol and period and investigate the gap rather than choosing the more convenient number. Look for methodology change logs and for step changes in a series that align with a code commit instead of an on-chain event.

Warum es hier aufgeführt ist: Fee and revenue figures for this asset come from a per-protocol adapter whose definitions may differ from those used for a superficially similar asset.

The same value or activity can be counted on more than one chain or assigned to the wrong one, inflating totals when figures from different sources are added.

Was zu betrachten ist: Check whether the provider deduplicates double counting and whether it publishes the rule it applies, and compare a protocol's reported total against the underlying assets it actually custodies. Where wrapped versions exist, check whether chain-level totals exclude them. Reconciling a chain total against the sum of its top protocols usually surfaces the largest attribution differences quickly.

Circulating supply is often a number supplied by the project, computed under rules that differ between data providers and can change without notice.

Was zu betrachten ist: Reconstruct supply from the token contract itself, subtracting balances in vesting contracts, identified treasury addresses, and burn addresses, then compare that with the provider's published figure. Read the provider's methodology document and its revision history, and check whether bridged or wrapped versions are double counted. Where a project publishes its own supply dashboard, compare it with the on-chain reconstruction rather than accepting it.

Large allocations to insiders and early investors become transferable on a published schedule, adding sellable supply the tradable float has never absorbed.

Was zu betrachten ist: Read the vesting contracts directly to obtain cliff dates, release curves, and beneficiary addresses, and compare circulating supply, total supply, and fully diluted valuation, which is total supply valued at the current price rather than any amount ever invested. After an unlock, follow whether released tokens move to exchange deposit addresses, to a custodian, or stay put, since that movement is observable. Open interest and funding rates on perpetual markets around scheduled dates show whether positioning is anticipating the release.

Warum es hier aufgeführt ist: Total supply is 50% larger than the amount circulating today. When that supply becomes transferable is not published by any source we use.

A small set of keys can pause, upgrade, mint, or move assets, so the system's safety depends on those keyholders and their operational security.

Was zu betrachten ist: Enumerate the privileged roles in the deployed contracts and resolve each to an address, then check whether that address is an externally owned account, a multisig, or a timelock, and what the multisig threshold and signer count are. Check whether signers are publicly identified, whether they are independent of one another, and whether they use separate hardware and jurisdictions. Read what the pause and mint functions can actually do, since a pause that also blocks withdrawals is a different instrument from one that only stops deposits.

Decisions are made by a foundation, core developers, or private discussion, with token voting confirming outcomes rather than determining them.

Was zu betrachten ist: Read the foundation's own disclosures: treasury addresses and holdings, grant reports, employment of core developers, and whether it holds any protocol keys. Trace where proposals originate and how much changes between first draft and final vote, and check whether votes are binding on-chain or advisory signaling. Note who controls the primary domain, the default front end, and the documentation, since those determine what most users can reach.

Token votes decide protocol parameters, but only a small share of tokens usually votes, so a modest holding can carry a proposal.

Was zu betrachten ist: Read turnout as a share of circulating supply for each historical proposal rather than for a single flagship vote, and read the quorum rule and how it is calculated. Check whether voting power is snapshotted before a proposal is announced, whether tokens in lending markets can vote, and how concentrated delegate power is. Check whether a passed proposal executes immediately or after a timelock that allows users to exit.

Voting power is proportional to tokens held, so a few large holders can determine outcomes regardless of how many other participants disagree.

Was zu betrachten ist: Look at the distribution of voting power across the top delegates and holders, and compute how many addresses are needed to reach a majority of a typical vote, which is a governance analogue of a concentration coefficient. Check whether custodial addresses have ever voted, and whether any vote-incentive market exists for the asset. Reviewing which addresses decided each past proposal is the direct test and is fully public.

Digital asset markets trade without pause, so a move that equities would spread across sessions and halts can complete in minutes with nothing interrupting it.

Was zu betrachten ist: Compare depth and spread during weekend and overnight hours against weekday peaks on the same venue, and look at the largest observed short-interval ranges rather than at daily candles. Cross-venue price divergence during past stress windows is observable and shows where arbitrage stopped functioning. Read each venue's published policy on halts and on cancelling trades, since practice varies and some venues have unwound executions after the fact.

Most trading, price discovery, and often custody for an asset sit at one or two venues, so a venue's problem immediately becomes the asset's problem.

Was zu betrachten ist: Look at volume share by venue after filtering, at which venues feed the relevant index or oracle, and at whether the asset trades meaningfully in more than one regulatory jurisdiction. On-chain balances at exchange-labeled addresses show how much supply is custodied where, though labeling is heuristic and should be treated as approximate. Historical outages, withdrawal pauses, and maintenance windows at the dominant venue are documented in its own announcements.

Leveraged positions are force-closed automatically, and the resulting market orders trigger further force-closures in a self-reinforcing sequence.

Was zu betrachten ist: Compare open interest against spot order-book depth, since the ratio indicates how much forced flow a market may have to absorb. Funding rates at persistent extremes indicate crowded positioning, and aggregate liquidation prints show what actually cleared. Insurance fund balances, their drawdown history, and any past use of auto-deleveraging are published by major derivatives venues, and on-chain lending markets publish liquidation thresholds and the value sitting near them.

A venue can remove an asset for regulatory, compliance, or commercial reasons, cutting its liquidity and its fiat gateway in that market.

Was zu betrachten ist: Track listing status by venue and region over time, and read the venues' own delisting notices, which usually state a reason and a timetable. After a removal, look at the share of remaining filtered volume and at whether depth actually migrated or simply disappeared. Check whether regulated custodians still support the asset, since custody support often precedes and outlasts trading support.

Action against one critical intermediary, such as an issuer, custodian, bridge operator, or staking service, can disable a function the asset depends on.

Was zu betrachten ist: Map the intermediaries standing between the protocol and an ordinary user, including the issuer, the custodian, the fiat rails, the oracle operator, the sequencer, and the front-end host, then note where each is incorporated and what license it holds. For each, check whether a substitute exists and how quickly users could switch. Enforcement filings, consent orders, and company announcements are public and usually state precisely what activity must cease.

How staking rewards, forks, airdrops, wrapping, and lending are taxed varies by jurisdiction and is unsettled in places, creating liabilities that surprise holders.

Was zu betrachten ist: Read the specific published guidance for the relevant jurisdiction and note exactly which events it addresses and which it leaves open. Check whether venues and custodians issue tax statements and what basis method they apply, and whether the protocol produces per-epoch records adequate to reconstruct reward timing. On-chain data will usually support reconstruction, but only if reward accrual and claims are separately observable.

A trading venue may operate without licenses that would apply to a comparable regulated market, so customer protections differ from what the interface implies.

Was zu betrachten ist: Read which licenses the venue actually names, in which jurisdiction, and for which activity, then check whether client assets are segregated by rule or only by promise in the terms. Look for an independent auditor, a published market-surveillance policy, and whether the terms permit the venue or its affiliates to trade against customers. Enforcement actions and regulator warning lists are public and specific.

Assets locked on one chain to mint a representation on another are stolen, or the minting authority is subverted, leaving the wrapped tokens unbacked.

Was zu betrachten ist: Determine whether the bridge verifies the source chain with a light client and proofs or trusts an attestation committee, and if it is a committee, how many signers exist, what the threshold is, whether the signers are independent, and whether their keys are in separate custody. Compare the value held against that security model, and check for a timelock or a pause on withdrawal parameter changes. Every major bridge failure has a public post-mortem, and the incident history of the specific design is observable.

Most of the network runs a single software implementation, so one bug in that program becomes the network's bug rather than a contained failure.

Was zu betrachten ist: Client distribution dashboards report the share of nodes or stake by execution and consensus client, and the protocol's own thresholds give the reference points that matter, such as the one-third of stake that can delay finality and the two-thirds that can finalize. Check whether large staking operators disclose their client mix, and whether the chain has any incentive or policy encouraging minority clients. The number of independently funded client teams, and how recently each shipped a release, is public.

A hash function, signature scheme, or proving system that a network depends on proves weaker than assumed, undermining ownership, history, or validity.

Was zu betrachten ist: Identify which primitives and curves the chain uses, whether any proving system involved required a trusted setup and how many independent participants took part in the ceremony, and whether the circuits have been independently audited or formally verified. Check whether the protocol has any path to rotate signature schemes without a hard fork, such as account abstraction or a versioned address format. Public incident histories for wallet software show whether randomness or nonce handling has failed in that ecosystem before.

The transaction data needed to reconstruct or challenge a chain's state is not published, so users cannot prove what they own or exit on their own.

Was zu betrachten ist: Establish where data is posted, what the retention window is, and who is expected to archive it after that window closes. For committee-based designs, look at the number of members, the signing threshold, and whether members are independent entities. Where sampling is used, check whether light clients actually perform it in production or only in specification, and look for any documented drill in which a third party reconstructed state from published data alone.

A sufficiently large error-corrected quantum computer would break the elliptic-curve signatures that authorize transactions, though no machine near that scale is known to exist.

Was zu betrachten ist: On-chain data shows how much supply sits at addresses whose public keys are already exposed through reuse or early output types, which is the directly measurable part of this exposure. Check whether the protocol has an upgrade path that allows new signature schemes without moving every coin, such as address versioning or account abstraction, and whether any core research or roadmap document addresses migration. Treat vendor claims of quantum readiness as a document to read rather than a fact, and check which specific scheme is proposed.

A rollup relies on one operator to order transactions, so if that operator stops or censors, users need a working escape hatch to the settlement layer.

Was zu betrachten ist: Check whether the sequencer is permissioned and who runs it, whether a forced-inclusion mechanism exists in the deployed contracts, what its delay window is, and whether anyone has demonstrably used it. Read who can upgrade the bridge and the proof system, whether those upgrades pass a timelock, and whether a security council can bypass the timelock. Published uptime records and incident post-mortems show how often the sequencer has stopped and for how long.

A flaw in deployed contract code lets funds be moved, locked, or destroyed in ways the designers never intended.

Was zu betrachten ist: Check whether the deployed bytecode matches published verified source, when the implementation last changed, and how much value the contract has held without incident, since value held multiplied by time live is a cruder but harder-to-fake signal than an audit badge. Look at how many independent audits exist, whether findings were fixed or formally accepted, and whether a funded bug bounty with a published scope and payout history is in place. An immutable contract and an upgradeable one carry different failure modes, so establish which you are looking at before reading anything else.

A protocol upgrade or token migration goes wrong, splitting the network, stranding holders on an old contract, or breaking dependent applications.

Was zu betrachten ist: Read the activation mechanism and the share of nodes or stake signaling readiness before the fork block, and read client release notes, public testnet runs, and shadow-fork results to see how much rehearsal happened. For a token migration, check whether the old contract still has supply outstanding, whether the swap has a hard deadline, and which venues and custodians have confirmed support. After the event, a persistent minority chain or a lingering old-contract balance is an observable fact rather than a forecast.