Composability Spreads Failures

Composability is a key element of the DeFi ecosystem. Various protocols are designed to integrate with one another like building blocks, making it possible to build complex protocols without the need to write them from scratch.

However, while composability has its benefits, it also introduces significant risks. In a composable ecosystem, one project's security failures and shortcomings can infect everything built on and tied into it.

The Security Risks of Composability in DeFi

DeFi is intentionally designed to be composable, encouraging many links and dependencies between protocols. As a result, a DeFi project has security risks at multiple layers of its supply chain.

Toolchain Vulnerabilities

Smart contracts are built using a variety of different tools. For example, smart contract source code needs to be compiled into bytecode to be deployed to the Ethereum blockchain.

These toolchains can introduce risk if they contain vulnerabilities or logic errors. In 2021 Vyper, a Pythonic language for writing Ethereum smart contracts, fixed a bug related to its reentrancy protections in a compiler release. In 2023, multiple smart contracts that weren't recompiled and redeployed using the patched compiler were exploited by attackers who took advantage of the fact that the patched bug broke reentrancy protections.

Integrations and Funds

Smart contracts also integrate with other smart contracts, and many DeFi projects are interrelated. For example, many DeFi projects will deploy liquidity pools or vaults that are based on Curve or Yearn's source code.

Dependencies between DeFi projects introduce problems when the shared resource contains a vulnerability. For example, in March 2023, Euler Finance was the victim of a hack that resulted in about $197 million in losses, most of which was later returned. This incident impacted multiple DeFi projects that had deposited funds in the protocol. Yearn was impacted as well, despite being only indirectly linked via Idle and Angle.

The Challenge of Managing Composability Risks

The security risks associated with composability are difficult to manage for a few different reasons, including:

• Correlated Failures: In DeFi, if a shared dependency fails anywhere, it can fail everywhere it's used at once. This makes it more difficult to contain the scope and allocate resources to incident response.
• Limited Audit Scope: Security audits in DeFi commonly focus on the source code of the project itself, not its dependencies. When code looks secure but isn't (as in the case of the Vyper bug), audits often won't catch this.
• Immutability Limits the Fix: Smart contract bytecode is immutable once deployed, so patches aren't automatically applied, requiring redeployment. In the Vyper case, this meant that code compiled with the old version of Vyper remained vulnerable until it was replaced.
• Opaque Dependency Graphs: It can be difficult to track dependencies in DeFi, especially if one project is a fork of another and inherits its vulnerabilities. This can make it difficult to assess how risk can ripple between projects or if a newly discovered vulnerability poses a risk to a protocol.

Managing Composability Risk in DeFi

Composability introduces significant risk to DeFi projects because of the numerous relationships between various projects. Ways to limit the risk include:

• Map Dependencies: DeFi projects should map their dependencies, including toolchains and relationships. For example, compiler versions, libraries, collateral tokens, oracles, and protocols holding funds should all be tracked.
• Implement Defense in Depth: In the case of the Vyper bug, protocols were only vulnerable if they relied solely on Vyper's broken reentrancy protections. Implement defense in depth to limit vulnerabilities, as well as pause switches and spending caps to manage the impact of a hack.
• Limit Exposure Per Integration: Many DeFi projects have suffered losses due to a compromised pool provider, oracle, etc. Projects should limit their risk exposure to a particular integration, imposing caps and spreading risk across multiple providers.

Composability has the potential to dramatically increase what can be built in DeFi. However, projects need to manage the associated supply chain and integration risks.

Educational content, not legal, financial, investment, or professional security advice. Terms