Recently, someone asked me again how the APY for yield aggregators is calculated. To put it simply, when you click "auto-compound," there might be several layers of contracts working behind the scenes: swapping pools, lending, restaking, reauthorizing... Each additional layer adds a point of failure and an "opponent" waiting there to take the blame if something goes wrong. In fact, many people only focus on the numbers and forget who they are actually handing their money to, who they are authorizing, and whether they can exit at any time. Especially those infinite authorizations that make my scalp crawl when I see them.

Modular chains and DeFi layers have been quite the hot topic lately. Developers are excited, while users are confused. I think the same: no matter how beautiful the narrative, your money still has to go into a contract. Anyway, before I use an aggregator, I first check if the contract is upgradeable, if it has an admin key, and whether the exit paths are clear. I also regularly clear authorizations just in case, so that if a phishing attack happens one day, I won’t be caught unprepared.