What matters now.
Smart-contract risk is not only code risk. Many failures emerge from oracle assumptions, governance timing, bridge trust, liquidity availability and cross-protocol composability.
Modern defensive practice combines review, static analysis, invariant testing, fuzzing, formal methods where justified and incident-response preparation.
The next frontier is economic simulation: proving behaviour under adversarial liquidity, governance manipulation, oracle stress and cross-chain dependency failure.