Composability: why one failure propagates through DeFi

Composability is the property that any contract may call any other without asking permission. It is what allows a deposit receipt to become collateral, that loan to become a trading position, and that position to be wrapped into something else again, all without a business relationship between the parties involved. The corollary is that dependencies are formed without consent, so a fault at the bottom of a stack arrives at the top before anybody has agreed that the two are connected.

A single position, counted honestly

Consider a position built one reasonable step at a time. An asset is staked through a liquid staking pool, producing a receipt. The receipt is deposited into a lending protocol as collateral, and a stablecoin is borrowed against it. The stablecoin is paired into a liquidity pool, whose share token is deposited into a vault that automatically reinvests fees. The vault share is then posted as margin somewhere else.

Each step adds a contract that can contain an error, a price feed that can be wrong, a governance body that can change parameters, and an assumption about redeemability. If each layer independently functioned as intended 99 percent of the time, five layers would function about 95 percent of the time, and that arithmetic is optimistic because the failures are not independent: the layers frequently share the same oracle, the same stablecoin, the same underlying asset and the same exit venue.

The channels that carry a failure upward

• Shared collateral. When one receipt token is accepted as collateral by many markets, a discount on it triggers liquidations everywhere simultaneously, including in markets whose users never touched the protocol that issued it.
• Shared price feeds. A single wrong number is consumed by every protocol reading that feed, in the same block, and none of them can see what the others are doing.
• Shared exits. Positions built through different routes often unwind into the same pool. Depth that appeared sufficient when each position was assessed alone is counted once and claimed several times.
• Atomicity. A flash loan lets a single transaction borrow, traverse the entire stack and repay, so an attacker needs no capital and the intermediate states never exist long enough for anyone to react.
• Governance coupling. One protocol's parameter vote re-prices another protocol's book. Neither set of holders voted on the other's exposure, and in a governance attack the voting token itself becomes the lowest-cost route in.

The same openness works in the other direction, which is why the property is worth having. Anyone can read the entire chain of dependencies without permission, so an exposure that would be a private disclosure question in traditional finance is a public query here. A patched contract, a raised collateral cap or a corrected feed propagates to every consumer at once, and a position that has become unsafe can be closed by a stranger who noticed. Contagion and transparency are produced by the same design, and a description of one that omits the other is not a description of the system.

The 2022 sequence, and the part that is usually told wrong

The collapses of 2022 are the standard illustration and the standard telling omits the interesting detail. The failure of the Terra network's algorithmic stablecoin in May of that year removed an asset that had been widely used as collateral and had drawn deposits with a subsidized rate. The losses spread to leveraged funds, and from there to the centralized lenders that had financed them, with Celsius, Three Arrows Capital and eventually FTX failing over the following months.

The detail worth keeping is the contrast in how the two halves behaved. Open lending contracts liquidated their positions on schedule, in public, at the moment the parameters said to, and the largest of them came through the period without a shortfall to their suppliers. The centralized lenders failed because they had lent against collateral nobody could see, in sizes nobody could verify, and could delay recognizing losses until they were fatal. The difference was not the absence of leverage in DeFi; leverage was abundant. It was that the leverage was legible and the liquidations were automatic. This is a real advantage and it comes with the cost described above: automatic liquidation at scale is exactly the mechanism that transmits a shock instantly instead of absorbing it.

Measurement, and where double counting creeps in

Total value locked is the sector's headline figure and it counts claims, not assets. One unit of an asset staked, wrapped, lent, re-deposited and used as margin can be counted at every stage, so a chain of protocols can report a large aggregate that rests on a small base. Recursive lending, where the same asset is deposited and re-borrowed in a loop, inflates the figure in direct proportion to the leverage employed, which means the number rises fastest when the system is most fragile.

Ratios inherit the problem. Market capitalization to value locked and fully diluted valuation to value locked are comparisons against a denominator that is not an independent quantity. Monthly change in value locked conflates deposits arriving with prices rising, since the figure is denominated in currency rather than units. And a fall in volume relative to value locked can mean capital arrived or that trading left, which are different situations with the same reading.

The useful frame is to describe a position by its dependencies rather than by the protocol it was opened in: which asset ultimately backs it, which feed prices it, which contracts can move it, who can change those contracts, and where it would have to be sold. The methodology notes set out exactly how value locked is counted here and where double counting is removed, the risk section maps dependencies across protocols, and the incident record traces how past failures traveled. That completes this track; the sections on stablecoins and value locked are where the same ideas meet current data.