DeFi Composability: Why Money Legos Cut Both Ways
Composability is DeFi's real innovation: protocols plug into each other without permission. It is also how one contract's failure reaches positions that never touched it. Here is how stacking works.
The genuinely novel thing about DeFi is not that it removed banks. It is that any protocol can build on any other without asking permission.
No integration agreement, no API key, no partnership call. If a contract is deployed, anyone can call it. That property is called composability, and almost every interesting thing in DeFi is downstream of it.
What stacking looks like
Follow a single deposit through a typical strategy.
- You deposit SUI and receive a liquid staking token — claim one, on staked SUI.
- You supply that token to a lending market and receive a deposit receipt — claim two, on the first claim.
- You borrow a stablecoin against it — a debt position secured by claims one and two.
- You supply that stablecoin to a liquidity pool and receive an LP token — claim three.
- You stake the LP token in a farm and receive a farm position — claim four.
One original asset, five contracts, four derivative claims. Every layer added yield. Every layer also added a way for the whole thing to unwind.
Our yield aggregator guide covers the tools that automate this, and leveraged yield farming shows what it looks like as a product.
Why it works at all
Three properties make it possible.
Shared standards. Because tokens follow common interfaces, any protocol can handle any token without bespoke work.
Atomic transactions. A sequence of calls either all succeed or all revert. You can enter a five-step position without the risk of ending up halfway through.
Open state. Every balance and parameter is readable. A protocol can price collateral by reading another protocol directly, with no data agreement.
Where it bites
The same properties that let value flow between protocols let failure flow too.
Failures propagate upward. If the liquid staking token in step one loses its peg, everything above it reprices instantly. The lending market marks down collateral, positions become liquidatable, and the farm position is worth less — without a single bug in the lending market, the pool, or the farm.
Risk looks smaller than it is. Four protocols each with a small annual failure probability do not give you a small combined probability. They give you roughly the sum, and the failures are correlated because they happen in the same conditions.
Dependencies are invisible from the top. A vault's front end shows an APY. It rarely shows that the yield depends on four other systems, one of which is a bridge. This is the strongest argument for curated vaults with published mandates — someone whose job is to know the dependency graph.
Oracles are the shared seam
Composability's most concentrated risk sits in price feeds. Many protocols read the same oracles, so an oracle failure is not one protocol's problem — it is simultaneous across everything that reads it.
This is how a manipulated price on a thin market can trigger liquidations across venues that have nothing to do with each other. The protocols are independent; their view of reality is not.
How to think about a stacked position
- Count the layers. If you cannot list every contract between you and the underlying asset, the position is bigger than you understand.
- Find the shared dependency. Two strategies that both rely on the same staking token or oracle are one bet, not two.
- Ask what happens at the bottom. Model the base asset depegging 10% and trace it up. If that liquidates you, the leverage is too high.
- Prefer fewer layers for the same yield. Extra hops that add a point or two of APY rarely pay for the added failure surface.
The multi-chain wrinkle
Composability works cleanly within a chain, where atomic transactions hold. Across chains it does not — a bridge is a trust assumption, not an atomic call, and the sequence can fail halfway.
This is why bridges have been the single largest source of DeFi losses. See multi-chain DeFi for how this is being addressed.
Keep reading
