Breakage analysis per dependency

Methodology how we score #

**What this measures** This factor contains short curator-written analyses — one per dependency identified in RD-F-050 — describing which protocol functions halt or degrade if that dependency fails, and at what severity (core function impaired vs. peripheral feature reduced). This is a qualitative, curator-maintained field with no automated source.

**Why it matters** A dependency graph (RD-F-050) names the connections; breakage analysis explains what those connections mean for depositors. A protocol may depend on a bridge only for a non-critical claim function, or may depend on a stablecoin oracle for its entire borrow-collateral calculation. These are materially different risk profiles that the dependency list alone does not distinguish. The synthesis dataset shows that composability failures (Cluster F) account for $350M+ in losses precisely because downstream protocols did not understand how deeply they depended on upstream price validity. Breakage analysis makes that impact explicit for the dashboard user.

**Green / Yellow / Red** Green is scored when a curator has completed breakage analysis for each critical dependency and assessed impact as peripheral or gracefully degraded (no core function loss). Yellow is scored when one or more critical dependencies have incomplete breakage analysis or where failure of a dependency would partially impair core protocol function. Red is scored when failure of any single dependency would fully impair the protocol's core function (borrowing, liquidation, or settlement).

**Common gray cases** Gray is applied when the breakage analysis cannot be completed within the assessment time budget due to insufficient documentation or source complexity.

**Notable historical examples** - **Alpha Finance** ($37.5M, 2021): Breakage from Cream Finance dependency — causal path for the exploit. - **Conic Finance** ($4.2M, 2023): Curve LP oracle dependency; Curve pool manipulation propagated directly to Conic collateral values. - **Sturdy Finance** ($0.8M, 2023): Balancer LP oracle dependency; B-stETH-STABLE pool had been publicly flagged as manipulable four months before the exploit. - **Midas Capital** ($0.66M, 2023): Curve LP collateral dependency exploited via oracle manipulation of underlying pool.

Measurement what to look for #

Produce a short per-dependency text describing which protocol functions halt or degrade and impact severity if each declared dependency fails.

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 9 historical incidents #