DeFi app development usually means building an interface, a strategy or a service on top of existing protocols, not a new protocol. This guide helps you decide whether you are building an app or a new protocol, plan the architecture, estimate the cost and judge a development team.
A new protocol can need about ten times the budget of an app built on existing protocols, with a longer timeline and more risk. It is written for founders and product owners. For the protocol layer, read the DeFi development overview.
Application or protocol
| Application on top of DeFi | New protocol | |
|---|---|---|
| Examples | Swap front end, portfolio dashboard, savings app that deposits into lending markets, vault strategy, stablecoin payments | New automated market maker (AMM), lending market, stablecoin or derivatives exchange |
| Liquidity | Uses liquidity in existing protocols from the first day | Must attract liquidity from zero |
| Contracts you write | None, or small adapter and router contracts | The core financial logic |
| Audit scope | Small, or none without contracts | Large, often more than one audit |
| Main risks | Failures in the protocols you use, front-end attacks and confusing design | Exploits, insolvency and flawed economic design |
| Estimated time to first release | A few weeks to a few months | Many months |
An app can still earn steady revenue: wallets and aggregators earn integrator fees on swaps, savings apps earn a spread or a subscription, and strategy vaults earn performance fees. The white-label swap guide shows how much of a swap product you can assemble from existing services.
Existing protocols already hold large amounts of liquidity. DefiLlama counted about $90 billion locked in DeFi across all chains on 19 October 2026, with about $50 billion of it on Ethereum.
Types of DeFi apps
People often call DeFi "money legos", because one app can combine several protocols like building blocks. The common types of DeFi apps, and the work each type needs, are these:
- Savings and earn apps. These apps deposit stablecoins into lending markets or vaults and show the user one balance. The work covers integration, risk monitoring and a clear notice that the yield is variable and not insured.
- Swap and bridge interfaces. These interfaces route trades through an aggregator, often inside a wallet or a larger app.
- Position managers and dashboards. These tools track liquidity ranges, health factors and staking across protocols, and some also act automatically, for example to rebalance or reduce leverage. Position managers must collect and store data from every protocol they track, which is a large indexing job.
- Leverage and strategy tools. These tools build looped or delta-neutral positions from flash loans and lending markets in one click. Users of these tools can lose money very fast, especially when the app hides the risks, and the contracts behind these tools need audits.
- Payments and treasury tools. These tools handle stablecoin invoices, payroll or DAO treasuries. Accounting exports and permissions matter more here than yield.
- Prediction markets and betting. These apps usually need their own contracts and an oracle that reports outcomes, and many countries apply gambling or derivatives rules to them. See the sports betting dApp guide.
- Wrapped and tokenized assets. Bringing bitcoin or real-world assets into DeFi needs custody and a legal structure, which go far beyond app development.
DeFi application development: the architecture
Wallet layer
Users connect self-custody wallets through two browser standards. EIP-1193 defines how a website talks to a wallet, and EIP-6963 lets a site find every wallet the user has installed. Mobile wallets connect through WalletConnect. In TypeScript, the wagmi and viem libraries handle most of this work.
Some users have never held crypto, and for them embedded wallets and smart accounts allow sign-in with email or a passkey, and the app can pay their gas fees. Smart accounts use ERC-4337, and since the Pectra upgrade in May 2025, EIP-7702 also lets an existing account delegate to smart account code. The DeFi wallet development guide compares these options.
Data and indexing
Reading every balance and position from contracts on each page load is slow, and RPC providers limit the number of requests, so most apps run an indexer. That can be a subgraph, a hosted indexing service or a custom pipeline that reads contract events and writes them to a database.
The indexer powers transaction histories, profit and loss, yield charts and notifications. Plan for chain reorganizations, which can undo recent blocks, and for contract changes, after which the indexer may need to process all past events again.
Transaction building and safety
- Simulation. Simulate every transaction before the user signs it, and show the expected balance changes in plain language.
- Approvals. Ask for the exact amount, or use a permit signature that expires, instead of an unlimited approval. Show the user which contract will receive the approval.
- Slippage and MEV. Set a slippage limit that fits each asset type. Offer private transaction submission where the chain supports it, so that bots cannot front-run the trade. MEV means maximal extractable value, the profit that bots take by reordering transactions.
- Typed signatures. Use EIP-712 so the wallet shows the user readable, structured data. Never ask users to sign a message they cannot read.
Back end
Many DeFi apps still need servers, typically for RPC providers with fallbacks, quote APIs, keeper bots that harvest rewards or rebalance, notifications and analytics. Store keeper keys in a hardware-backed or managed key service with the fewest permissions possible, and no back-end key should ever control user funds.
Front-end security
Attackers often target the front end instead of the contracts. In August 2022 a DNS hijack of Curve's website sent users to a malicious contract. In December 2023 a compromised release of Ledger's Connect Kit library put a wallet drainer into many DeFi sites. In February 2025 attackers changed the Safe wallet interface used by the Bybit exchange and stole about $1.5 billion.
Protect the domain registrar account with strong authentication and a registrar lock, pin and review every dependency, and set a content security policy. A verifiable build hosted on IPFS gives users a backup copy of the interface.
Integration risk
When your app deposits user funds into another protocol, your users carry that protocol's risk. Write an integration policy that covers four points:
- Integrate only audited protocols with a track record. Record the version and the contract addresses you use.
- Read each protocol's admin powers, because a protocol that one key can upgrade is a risk to your users.
- Monitor each protocol for pauses, oracle errors and large outflows, and build a pause control that stops new deposits into that protocol quickly.
- Show users which protocols hold their funds.
Maintenance
A DeFi app needs work after launch. Integrated protocols release new versions and retire old ones, and tokens migrate, as Polygon's MATIC did to POL in September 2024. Chains upgrade, RPC providers change their limits, and wallet libraries ship breaking changes.
Plan an ongoing engineering budget for upgrades, dependency patches and monitoring. An app without maintenance becomes dangerous to its users: its old integrations can send them to retired or paused contracts, and its unpatched dependencies give attackers a way in.
The build process
- Discovery. Define the user, the problem the app solves and the revenue model, and choose the protocols and the chains.
- Technical design. Choose the wallet approach and the indexing approach, and list any contracts you need. Write a threat model for the front end, the back end and each integration.
- Prototype. Build against testnets or mainnet forks with real protocol state, so that you see real gas costs and edge cases.
- Build and test. Write end-to-end tests that send real transactions on a fork, and unit tests for any contracts.
- Review. Audit any contracts, and have the front end and servers reviewed for supply-chain and key-management risks.
- Launch and operate. Set up monitoring, incident runbooks, user support and regular dependency updates.
DeFi app development cost
The figures below are estimates, not quotes. An app that uses existing protocols, with a polished web front end, an indexer and no custom contracts, might need a product designer, two front-end or full-stack engineers and a part-time blockchain engineer for about 10 to 16 weeks.
Over 10 to 16 weeks, this team works about 1,400 to 2,250 hours, counting three and a half people at 40 hours a week. At blended rates of $80 to $160 an hour, the cost is about $110,000 to $360,000, and custom contracts, mobile apps or more chains raise it.
| Cost driver | Effect |
|---|---|
| Custom smart contracts | Adds contract engineering, audit fees and time |
| Number of chains | Each chain adds RPC, indexing, testing and work on the list of supported tokens |
| Embedded wallets and gas sponsorship | Makes sign-up easier, but adds provider fees and gas funding |
| Native mobile apps | Needs separate builds, and app stores review crypto features |
| Compliance features | Adds address screening, geographic blocks and identity checks for fiat on-ramps |
| Analytics depth | Accurate profit, loss and yield across protocols needs a large indexing effort |
How to evaluate a development team
- Try products the team has shipped. Connect a wallet, use them and check whether the apps simulate transactions and ask for limited approvals.
- Ask about the integration process. Ask how the team assesses a protocol's risk and how it monitors the protocol after launch.
- Ask who owns what. You should own the code repositories, domains, deployer keys and cloud accounts from the first day.
- Check security habits. Ask about dependency pinning, continuous integration, secrets management and the storage of keeper keys.
- Require independent audits for any contract, by a firm with no ties to the developers. The DeFi smart contract development guide explains what to expect.
- Reject guarantees. No development team can promise a level of deposits, users or token price.
Frequently asked questions
Do DeFi apps need their own smart contracts?
Often they do not, because many apps only build transactions for existing protocols. An app needs its own contracts to run several steps in one transaction, to charge fees on-chain, or to hold pooled positions such as a vault.
Which chains should a DeFi app support first?
Start on the chains where your target protocols and users already are. For many consumer apps, that means Ethereum mainnet and one or two Ethereum rollups. Add chains after the first deployment runs well.
How do DeFi apps make money?
DeFi apps earn integrator fees on swaps, performance or management fees on vaults, spreads on fiat on-ramps, analytics subscriptions, or referral payments from protocols. Every fee should be shown to users.
Can a non-custodial DeFi app offer email login?
Yes. Embedded wallet providers and smart accounts can link a self-custody key to an email address or a passkey, using multi-party computation (MPC) or secure hardware enclaves. Check each provider's recovery process and what happens to keys if the provider shuts down.
How is a DeFi app different from a general dApp?
A DeFi app moves money, so simulation, approvals and integration risk matter much more. The Web3 dApp development guide covers general dApp architecture.