Code complexity vs audit coverage
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor assesses whether the protocol's code complexity -- measured by cyclomatic complexity of critical functions or by lines-of-code per audit-day ratio -- exceeds a curator-declared threshold that indicates the audit coverage was likely insufficient. The threshold is calibrated per audit type: a three-week, two-person audit of 5,000 LOC is flagged differently than the same audit applied to 50,000 LOC. The data source is static analyzer output (cyclomatic complexity) combined with audit PDF metadata (duration, auditor count, LOC covered).
Why it matters
Code complexity is a proxy for the probability that an audit missed a bug. KyberSwap Elastic ($48M, 2023) was a highly complex concentrated-liquidity AMM where the exploited precision failure in tick-crossing boundary arithmetic was a corner case invisible to conventional audit review and only detectable through exhaustive boundary testing or formal verification. MonoX ($31.4M, 2021) implemented a novel single-token AMM with complex pricing invariants that two independent auditors missed. In both cases, the code was too complex for the audit coverage applied. When LOC per audit-day is very high, the statistical probability of a missed bug increases substantially.
Green / Yellow / Red
Green: the audit LOC-per-auditor-day ratio is below the curator threshold (approximately 300 LOC/day for novel math-heavy code, 500 LOC/day for standard DeFi patterns), and no individual function exceeds cyclomatic complexity of 20. Yellow: the ratio is 1.5x to 2x the threshold, or complexity is elevated in peripheral functions only. Red: the LOC-per-auditor-day ratio exceeds 2x the threshold for the protocol type, or any critical function has cyclomatic complexity above 30 with no dedicated review or formal verification.
Common gray cases
This factor is gray when the audit does not disclose duration or auditor count, making the LOC-per-day calculation impossible.
Notable historical examples
- KyberSwap Elastic ($48M, 2023): Complex concentrated-liquidity tick arithmetic exceeded what conventional audit methods could reliably verify.
- MonoX ($31.4M, 2021): Novel single-token AMM pricing model too complex for two independent auditors to fully verify.
- Value DeFi ($10M, 2021): Complex multi-token pool math produced an exploitable edge case.
- Bunni ($8.4M, 2025): Concentrated liquidity math without formal verification or sufficient complexity-adjusted audit depth.
Measurement what to look for#
Determine whether the cyclomatic complexity or LOC-per-audit-day ratio exceeds the curator-declared credibility threshold for the audit to be meaningful.