External keeper/relayer not redundant

A oracle & external dependencies factor in the v1.7.0 rubric. Measured per protocol on a s cadence.

Methodology how we score#

What this measures
This factor checks whether the protocol depends on a single external keeper or relayer (e.g., Gelato, Chainlink Automation, a bespoke keeper bot) for a critical protocol function — such as liquidations, oracle updates, or reward distribution — without redundancy or a documented failover path. Source inspection and protocol documentation are the primary data sources.

Why it matters
A single keeper with no redundancy is a centralisation risk and a potential availability failure: if the keeper goes offline, goes rogue, or is compromised, protocol functions that depend on it halt. The Badger DAO hack ($120M, 2021) involved a Cloudflare front-end dependency that was compromised via an off-chain infrastructure attack. SwissBorg ($41.5M, 2025) lost funds when a Kiln staking partner API compromise allowed malicious authorisations to be embedded in routine keeper transactions. MonoX's novel AMM design reduced effective audit coverage due to infrastructure complexity. Keeper redundancy is a maturity indicator for protocols: single-keeper designs are common in early-stage deployments but represent an operational risk that scales with TVL.

Green / Yellow / Red
Green is scored when critical protocol functions use multiple independent keepers or a permissionless execution path (any address can trigger liquidations). Yellow is scored when a single keeper is in use but the function is also triggerable by a backup path or by governance in an emergency. Red is scored when a single keeper is the sole triggering mechanism for a critical function and no failover path is documented.

Common gray cases
Gray is applied when keeper infrastructure is partially off-chain and the redundancy configuration cannot be verified from public sources.

Notable historical examples
- SwissBorg ($41.5M, 2025): Kiln staking partner API compromise; malicious authorisations embedded in keeper transactions over 8 days.
- Badger DAO ($120M, 2021): Off-chain Cloudflare infrastructure dependency compromised; front-end served malicious approval scripts.

Measurement what to look for#

Determine whether the protocol depends on a single keeper or relayer (Gelato, Chainlink Automation, custom) with no redundancy or failover.

Data & output #

Data source

Source inspection for keeper/relayer interface calls + protocol docs on keeper redundancy

Output format

Green / Yellow / Red

Evidence artifact

Keeper contract address or interface + redundancy evidence (or absence)

Confidence signal

green = multiple independent keeper providers or permissionless keeper; yellow = single keeper provider but protocol can function (degraded) without it; red = single keeper with no fallback and protocol halts on keeper failure; gray = protocol does not use keepers (N/A)

Scored protocols 0 carry this factor#

No protocols have been scored for this factor yet.

Linked hacks 4 historical incidents#

causalSwissBorg (via Kiln staking partner): Partner API compromise — withdrawal authority transfer via hidden staking instructions2025-09-08 · $42M · Partner API compromise — withdrawal authority transfer via hidden staking instructions · External keeper/relayer dependency not redundant [via cross-hack: Factor 32: Third-Party API / Infrastructure Dependency] || External keeper/relayer dependency not redundant [via cross-hack: Factor 8: Off-Chain Infrastructure Dependency]

Badger DAO (Bitcoin-yield vaults on Ethereum): Front-end injection (Cloudflare account compromise) → malicious `increaseAllowance()` approvals → vault token drain2021-12-02 · $120M · Front-end injection (Cloudflare account compromise) → malicious `increaseAllowance()` approvals → vault token drain · External keeper/relayer dependency not redundant [via cross-hack: Factor 8: Off-Chain Infrastructure Dependency]

MonoX: Native token self-swap price inflation — tokenIn/tokenOut identity bypass2021-11-30 · $31M · Native token self-swap price inflation — tokenIn/tokenOut identity bypass · External keeper/relayer dependency not redundant [via cross-hack: Factor 8: Off-Chain Infrastructure Dependency]

AnySwap (Multichain) V3: ECDSA repeated k-value (same R signature) → MPC private key back-calculation2021-07-10 · $8M · ECDSA repeated k-value (same R signature) → MPC private key back-calculation · External keeper/relayer dependency not redundant [via cross-hack: Factor 8: Off-Chain Infrastructure Dependency]

rubric_version v1.7.0factor RD-F-062category 3carried 0critical no