Composability Risk: When One Protocol Breaks Five

Composability risk is the risk that a position built from several protocols fails because of its weakest layer rather than its average. Each layer is a claim on the one beneath it, so a pause, a bad parameter or a broken price at the bottom freezes everything stacked on top. Composability risk is not the sum of the individual risks; it is their correlation.

The diagram always looks tidy: an asset becomes a receipt token, the receipt is supplied as collateral, the borrowed asset is deposited again. Four boxes, four audits, four dashboards. The exposure underneath is one asset and one price path, viewed four times.

• Layers share more than they look. A stack assembled from different teams usually rests on the same base asset, the same oracle and the same block space.
• Failure propagates upward. A pause at the base layer stops withdrawals at every layer above it, regardless of how healthy those layers are.
• Correlation dominates the maths. Three independent 5% failure chances compound; three correlated ones behave like the single worst layer.
• Depth is invisible on a dashboard. Most interfaces show the top-level position and hide the contracts it depends on.

What composability risk looks like in a position

It looks like a single balance that depends on four contracts, three of which you have never opened.

The stack

A typical stack starts with a base asset held in a wrapper that issues a receipt. The receipt is supplied to a lending market as collateral, and the borrowed asset is deposited into a strategy that reports a single yield figure. Each step is individually reasonable and each step adds a dependency.

The dependencies are not equal. The base asset’s price affects every layer, the wrapper’s redemption affects the receipt’s price, the lending market’s parameters decide whether the position can be liquidated, and the strategy’s code decides whether the reported balance is real.

Where the layers touch

Layers touch at three seams: the exchange rate between a receipt and its underlying, the oracle pricing that receipt, and the liquidity available to exit. Each seam is where one protocol’s assumption becomes another’s input.

The seams are where failures travel. A wrapper that pauses redemptions does not need to lose a single unit of the underlying to break a position three layers up. It only needs to stop converting, so the receipt trades at a discount and the market that prices it at par liquidates borrowers who did nothing wrong.

A stack of four protocols does not give you four risk budgets. It gives you one asset, four exit doors and a queue at each of them.

Three ways a stack shares one failure

The shared failure is usually a single input that several layers read at once.

Wrapped assets

A receipt token concentrates the wrapper’s risk into the token itself. If redemption slows, the token trades below its underlying, and every market that accepts it as collateral inherits the discount. Positions far from the wrapper — holders who never interacted with it directly — can be liquidated because their collateral was priced at par while the market priced it lower.

Shared collateral

Recursive positions reuse the same collateral multiple times. Supply, borrow, re-supply, borrow again. Each loop adds a claim on the same base asset, and the reported total exposure across the stack exceeds the capital actually present. When the base asset moves, every loop moves together and the unwind is a single crowded exit rather than several independent ones.

Shared oracles and shared liquidity

Two protocols that price an asset from the same feed share a failure mode completely. Two protocols that rely on the same pool for exit liquidity share a queue. Diversity of code does not create diversity of inputs, and it is the inputs that fail together.

Why composability risk arrives all at once

Composability turns separate incidents into one event because the layers are evaluated in the same block and by the same participants.

Liquidation bots watch the same signals. When one market becomes liquidatable, the selling arrives at the venue every other layer prices from and pushes the next market toward its threshold. The sequence can complete before a person opens a dashboard, and it is a sequence precisely because the layers are connected.

Atomicity cuts both ways. Within a single transaction, a failure reverts the whole call and nothing is lost — that is genuine protection. Across transactions, a position that spans four protocols cannot be unwound in one step, so an exit takes as many steps as the stack has layers, at whatever prices exist when each step executes.

Suppose three layers each carry a 5% chance of failing in a year. If those failures were independent, survival would be 0.95 cubed, about 86%. They are not independent. A single depeg, feed error or pause reaches all three, so the realistic survival rate sits closer to the weakest layer’s — and the weakest layer is usually the one with the least liquidity.

Mapping a stack before you deposit

Map the position from the asset up, and stop when you reach something you cannot describe in one sentence.

1. Start with the base asset. Name it, and note whether anything above it can change its redemption terms.
2. List the wrapper or receipt token, and check whether redemption is instant, queued or pausable.
3. Note the oracle that prices each token in the stack, and whether two layers read the same feed.
4. Identify the market where the position can be liquidated, and its threshold and penalty.
5. Find the strategy or aggregator on top, and read what it does with the deposited asset rather than what it reports as yield.
6. Check whether any layer can pause transfers, and who holds that authority.
7. Write the exit path in order. If it requires three transactions across three protocols, the position needs three times the buffer you would otherwise hold.

Two questions do most of the work: which single event would hurt every layer at once, and how many transactions does it take to leave.

Single protocol against a stack

The comparison is not about which is safer in general, but about which risks you are paid for and which you absorb without noticing.

A stack is worth it when the extra layer buys something you need — cheaper borrowing, a redemption you will use. It is not worth it when the layer exists only to add a yield figure to a position that already had the exposure.