Dependency graph (protocols depended upon)

Methodology how we score #

**What this measures** This factor produces a list of external protocols whose failure would directly impair this protocol's operation — including LST providers, bridge dependencies, stablecoin issuers, and AMM pools used as oracle sources. The dependency graph is maintained by curators with on-chain inference and serves as a differentiating data layer not produced by any current competitor.

**Why it matters** DeFi composability means that a protocol's security is bounded by its weakest dependency. The synthesis dataset shows that composability failures (Cluster F: AMM/DEX as systemic oracle) account for over $350M in losses. Alpha Finance lost $37.5M because its leveraged yield farming strategy depended on Cream Finance's lending pool in a way that neither team had fully modelled. Sturdy Finance's oracle depended on a Balancer pool type that had been publicly flagged as manipulable four months before the exploit. Without a dependency map, depositors and risk analysts cannot trace the true failure surface of a protocol.

**Green / Yellow / Red** Green is scored when the protocol's dependency graph is fully documented, each dependency has a failure-impact assessment, and no dependency is a single-point-of-failure for the protocol's core function. Yellow is scored when the dependency list is documented but failure-impact analysis is missing or when one or more undocumented dependencies are identified by curators. Red is scored when the protocol has undocumented critical dependencies that, if they failed, would directly impair core protocol function.

**Common gray cases** Gray is applied when the protocol interacts with generic token standards where external dependencies cannot be enumerated without dynamic tracing.

**Notable historical examples** - **Alpha Finance** ($37.5M, 2021): Leveraged yield farming strategy's composability with Cream Finance lending was the causal path for the exploit. - **bEarnFi** ($18M, 2021): Multi-layer vault cross-protocol accounting failure between strategy and underlying protocol. - **Abracadabra Money** ($13M, 2025): gmCauldron upgrade introduced a dependency on GMX V2's GM token that created phantom collateral. - **Rari Capital** ($10M, 2021): Fuse pool dependency on Alpha Homora V2 allowed token injection into the lending pool.

Measurement what to look for #

List all external protocols whose failure would directly impair this protocol (LST providers, bridges, stablecoin issuers, keepers).

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 9 historical incidents #