::
When providing LP (or staking on defi, for that matter), you are at the mercy of the smart contract which has been exploited many many times.
Take for example the infamous squid token, the smart contract dictates that no coins could be withdrawn and you’ve seen what happened.
Sometimes, unintentional functions by inexperienced devs can expose funds to attack vectors too. Even benevolent functions can be exploited like flash loans.
Your ledger is just there to sign any transactions but the actual tokens are probably in another wallet governed by a few smart contracts.