For one, I believe that audits (for code bugs) are one of the things that DeFi does get right. And better audits or formal verification wouldn't have prevented most of the recent exploits: Resolv, Drift > private key compromise + lack to timelock and other circuit breakers Venus Protocol > economic attack, flagged by audits but ignored Aperture Finance, Solv > bugs in unaudited contracts Makina Finance > vault logic compromise, OOS for audits In TradFi, companies are mandated to do thorough risk management by law. In DeFi, we're not. Solution? More social consensus that DeFi needs to learn to take better care of its risks. This already works with code audits - everyone believes that a protocol that doesn't have code reviewed by security experts can't be taken seriously. It also works for L2s because we have @l2beat. Comparably, we don't have nearly as good insight into the admin control levels of major DeFi protocol deployments. Similarly, we know far more about how to exit L2s in times of crisis than how to exit major DeFi protocols if/when their admin decides to do something funky. EF doesn't need to pick and choose some favorite protocols. But it would be nice to recognize that there's a crisis in "low-risk" DeFi and push for a more principled approach, where risk management goes beyond looking for bugs in the code.