DeFi Composability: 7 Powerful Truths on Why It Matters and Its Hidden Risks

DeFi composability is the reason a teenager with a laptop can build a working lending product in a weekend, and it is also the reason a single bad price feed can drain $100 million from a protocol before anyone wakes up. Both of those things are true at the same time, and if you want to understand decentralized finance, you have to hold them together.

The idea is simple. In DeFi, applications are built from open smart contracts that anyone can call. A lending pool, a trading venue and a stablecoin can be plugged into each other without asking permission, the way you might snap Lego bricks together. People call these pieces money legos, and the property that lets them connect is composability.

That openness has produced some genuinely useful tools. It has also produced some of the largest thefts in financial history, plus a string of court cases that are still shaping what counts as a crime on a blockchain.

This article covers what DeFi composability actually means, the different types you will hear about, and real examples of protocols that depend on it. Then it gets into the part most explainers skip: the exploits, the laundering cases, the convictions and the reversals. The goal is a clear, honest picture, not hype. By the end, you should know why composability matters, where it breaks, and what both users and builders can do to stay on the right side of the risk.

What Is DeFi Composability?

DeFi composability is the ability of decentralized finance protocols to connect, call each other and be combined into new products without anyone’s permission. If a smart contract is deployed on a public blockchain, its public functions can be used by any other contract or person. Nobody has to sign a partnership deal or request API keys.

Compare that to traditional finance. If a startup wants to plug into a bank’s lending system, it needs contracts, compliance reviews and probably a few months of meetings. In DeFi, a developer can read the code of a lending protocol like Aave, write a contract that calls it, and ship the result the same day.

Why it is called “money legos”

The Lego comparison works because each protocol does one job well and exposes standard “studs” that other pieces can attach to. A decentralized exchange swaps tokens. A lending market lends them. A stablecoin holds a steady value. Stack them together and you get something none of them could do alone, like an automated savings product or a leveraged trading strategy.

What makes DeFi composability possible

A few technical conditions have to be in place for smart contract composability to work:

• Shared state. Protocols on the same chain read and write to one ledger, so they always agree on who owns what.
• Open source code. Most DeFi contracts are public, so builders can inspect exactly how they behave.
• Common token standards. Standards like ERC-20 mean a token issued by one project works in every other compatible app.
• Permissionless access. Anyone can call a public function. There is no gatekeeper.

Take any one of these away and DeFi composability gets weaker. A closed-source contract is hard to trust. A token that does not follow the standard breaks integrations. A permissioned app can lock others out.

The Three Types of DeFi Composability

Most guides break composability in DeFi into three types. They overlap, but it helps to see them separately because each one carries different benefits and different risks.

Morphological composability

This is about shared standards. When every token follows the same interface, a wallet, an exchange and a lending pool can all handle it without custom code. ERC-20 for fungible tokens and ERC-721 for NFTs are the classic examples. The catch is that standards need broad agreement, and a single project that tweaks a standard (for example, a token that charges a fee on every transfer) can quietly break apps that assume normal behavior.

Syntactic composability

This means one contract can call another directly. On Ethereum and similar chains, any contract can talk to any other contract on the same network. That is what lets a yield aggregator send deposits into Curve, then into a lending market, then back again, all through code.

Atomic composability

Atomic composability means several actions across different protocols happen inside one transaction, and either all of them succeed or none of them do. If step four fails, steps one through three are rolled back as if they never happened.

This is the most powerful form of DeFi composability, and the most dangerous. It makes flash loans possible: you can borrow millions with no collateral, use the money across several protocols, and repay it before the transaction ends. Legitimate users use that for arbitrage and debt refinancing. Attackers use it to get huge temporary buying power for price manipulation, as you will see later. One industry analysis from 2022 estimated that about 69% of all Ethereum gas used on a sample day went to transactions that relied on atomic composability, which shows how central it has become.

Real Examples of DeFi Composability in Action

Abstract definitions only go so far. Here is what DeFi composability looks like in products people actually use.

Yield aggregators like Yearn

Yearn takes a user’s deposit and moves it between other protocols, such as Curve and lending markets, to chase the best return. Yearn does not run its own exchange or lending book. It is almost entirely built on top of other people’s code. Without composability, it could not exist.

Stablecoins as collateral everywhere

DAI, minted by MakerDAO (now part of the Sky ecosystem), is used as collateral, as a trading pair and as a savings asset across hundreds of apps. None of those apps needed MakerDAO’s approval to support it. That is morphological and syntactic composability working together.

Flash loans on Aave

Aave offers flash loans that must be borrowed and repaid within one transaction. A trader might borrow a stablecoin, buy a token cheaply on one exchange, sell it higher on another, repay the loan plus a small fee, and keep the difference. All of it is one atomic transaction.

Stacked receipt tokens

When you deposit into many protocols, you get a receipt token back. That receipt can often be deposited somewhere else, which gives you another receipt, which can go somewhere else again. Curve’s CRV and Convex’s cvxCRV are a well-known example of this layering. It boosts capital efficiency, but every layer adds another set of contracts you are trusting.

Researchers have studied these patterns in detail. A widely cited paper, Disentangling Decentralized Finance (DeFi) Compositions, maps how Ethereum protocols depend on each other and is a good read if you want the academic view.

7 Truths About Why DeFi Composability Matters

Here is the honest case for why DeFi composability matters, including the parts that cut the other way.

1. It speeds up innovation

Builders do not have to rebuild an exchange or a lending engine from scratch. They reuse what exists and focus on the new idea. That is why DeFi went from a handful of apps in 2018 to thousands within a few years.

2. It makes capital work harder

The same dollar can be collateral in one place, earn trading fees in another, and back a loan in a third. For users, that can mean better yields. For the system, it means less idle money.

3. It opens finance to more people

Anyone with a wallet can use these tools. There is no account minimum and no approval process. For people underserved by banks, that matters, even if the risks are real.

4. It shares liquidity instead of splitting it

When apps plug into the same pools, they avoid fragmenting trading volume across a hundred isolated venues. Deeper pools mean lower slippage for everyone.

5. It reuses battle-tested code

Building on a protocol that has survived years of real use and multiple audits is usually safer than writing new code. Composability lets newer projects inherit that track record.

6. It spreads risk across every connection

This is the flip side. If one protocol breaks, every app built on it can break too. A bug in a lending market or a bad price feed does not stay contained. It travels through every integration.

7. It hands attackers the same tools as builders

Flash loans and permissionless innovation are neutral. The same features that let an honest trader do arbitrage let an attacker borrow $100 million for one transaction and use it to bend a market. The next section shows exactly how that has played out.

The Dark Side of DeFi Composability: Real Exploits and Illegal Activity

It would be dishonest to write about DeFi composability without looking at how it has been abused. The pattern repeats: an attacker borrows huge sums through a flash loan, uses that money to distort a price or a vote in one protocol, and then cashes out through another. The code does exactly what it was written to do. The problem is what the code was never designed to expect.

A timeline of well-known incidents

Loss figures below are approximate, based on widely reported totals at the time.

Oracle manipulation: the most common weak point

Many of these attacks share one root cause: oracle manipulation. A lending protocol needs to know what collateral is worth, so it reads a price from somewhere, often a trading pool. If that pool is small, a flash loan can push the price far off for a few seconds. The lending protocol trusts the fake price and lets the attacker borrow far more than the collateral is really worth.

Governance attacks

Beanstalk showed another angle. Its governance let whoever held the most tokens pass proposals quickly. The attacker flash-borrowed enough tokens to win a vote, approved a proposal sending the treasury to themselves, and repaid the loan in the same transaction. Composability turned a voting system into a vending machine.

The Mango Markets case: is exploiting code a crime?

In October 2022, Avraham Eisenberg used two accounts to inflate the price of Mango’s MNGO token, then borrowed over $100 million against his inflated position. He publicly called it a legal trading strategy. He later returned about $67 million under a deal with Mango’s community.

US prosecutors disagreed with his framing. A jury convicted him of commodities fraud, commodities manipulation and wire fraud in April 2024. Then, in May 2025, Judge Arun Subramanian vacated those convictions. According to a legal analysis by Venable LLP, the court found prosecutors had not properly tied the conduct to New York and had not shown a false statement to support the wire fraud count. Mango had no terms of service banning manipulation, which mattered.

The lesson is not that manipulation is legal. The judge found enough evidence of a manipulative scheme; the case fell mainly on venue and on how wire fraud is defined. Eisenberg also remained in prison on an unrelated conviction. What the case shows is that the law around “the code allowed it” is still unsettled, and that is a poor bet to build a life on.

Laundering through composable tools: Tornado Cash and Lazarus

The Ronin Bridge theft in March 2022 was tied to North Korea’s Lazarus Group, which moved stolen funds through Tornado Cash, an Ethereum mixing protocol. The US Treasury sanctioned Tornado Cash in August 2022. A federal appeals court later ruled that its immutable smart contracts were not “property” Treasury could sanction, and Treasury lifted the sanctions in March 2025.

That did not end the criminal case. In August 2025, a Manhattan jury convicted co-founder Roman Storm of conspiring to run an unlicensed money transmitting business, while deadlocking on money laundering and sanctions charges. Prosecutors had alleged the service helped launder over $1 billion. Willkie Farr & Gallagher’s summary of the verdict lays out the full timeline.

The point for this article: open, composable money is also open to people laundering stolen funds, and the developers behind privacy tools have faced real criminal exposure, even when the outcome is mixed.

Ethics and Regulation Around DeFi Composability

The cases above raise questions that go beyond any one hack. Who is responsible when a stack of open contracts fails? Is “the code allowed it” a defense? Should developers answer for how strangers use their tools?

“Code is law” does not hold up in court

Some people in crypto argue that if a smart contract lets you do something, it is fair game. Courts and regulators have mostly rejected that. Prosecutors brought charges in the Mango case, and civil regulators like the SEC and CFTC pursued their own actions. Even where convictions were overturned, it was on specific legal grounds, not because judges accepted that exploiting a bug is automatically fine.

There is also a simple ethical test. If you take money that other users deposited, by tricking a system into thinking it is worth something it is not, those users lose real savings. Calling it “trading” does not change who gets hurt.

Developer responsibility

The Tornado Cash prosecution worries many developers, because it touches the question of whether writing open-source code can make you liable for how others use it. Reasonable people disagree here. What is clear is that teams who market a tool to criminals, ignore known laundering, or keep control over a service while claiming it is fully decentralized take on serious legal risk.

Where crypto regulation is heading

Regulators in the US, EU and elsewhere are increasingly focused on stablecoins, anti-money-laundering rules and the “front ends” people use to reach DeFi. Protocols that want to last are adding compliance features, clearer terms of service and stronger monitoring. Expect DeFi composability to keep working at the contract level, with more rules layered around the edges where users actually connect.

How to Use DeFi Composability Safely

You do not have to avoid DeFi to stay safe, but you should go in with your eyes open. Smart contract risk compounds with every layer you add.

For users

1. Count the layers. Before depositing, ask how many protocols your money passes through. A vault that deposits into another vault that lends on a third market has three points of failure.
2. Check audits and track record. Audits do not guarantee safety, but a protocol with several audits and years of live use is a better bet than one launched last month.
3. Look at the price source. If a protocol uses a single small pool for prices, it is more exposed to oracle manipulation. Established oracle networks and time-weighted prices are harder to game.
4. Be wary of very high yields. Unusually high returns usually mean unusually high risk, whether from leverage, a new token or untested code.
5. Only use what you can afford to lose. It sounds obvious. It is also the rule most people break right before a hack.

For builders

1. Treat every external call as untrusted. Assume any protocol you integrate could return bad data or be manipulated within one transaction.
2. Use robust price feeds. Avoid spot prices from thin pools. Combine sources and add sanity checks.
3. Protect governance from flash loans. Use time delays, snapshot-based voting and minimum holding periods so votes cannot be bought and used in one block.
4. Get audits and run a bug bounty. Paying white-hat researchers is far cheaper than losing user funds.
5. Write clear terms and act in good faith. The Mango ruling showed that the absence of rules can matter legally. More importantly, your users deserve to know what they are signing up for.

The Future of DeFi Composability

The biggest open question is what happens to DeFi composability as activity spreads across many chains and layer-2 networks. Atomic composability works best when everything lives on one ledger. Once assets sit on different chains, combining them in one all-or-nothing transaction gets much harder.

Bridges try to fill that gap, but they have been some of the most attacked pieces of crypto infrastructure, as the Ronin theft showed. Newer designs, including shared sequencers and cross-chain messaging standards, aim to bring back some of that seamless interoperability without the same weak points. It is too early to say which will win.

At the same time, the industry has learned hard lessons. Better oracle designs, flash-loan-resistant governance and more mature audit practices have made the classic attacks from 2020 to 2022 harder to repeat. The next wave of risk is likely to come from complexity itself: stacks so deep that no single team fully understands how they interact.

If DeFi composability is going to keep its promise, it needs to grow up. That means more transparency, better security, honest marketing and a clear stance against the people who treat open systems as free money.

Conclusion

DeFi composability is what turns a pile of separate smart contracts into a working financial system: shared standards, direct contract calls and atomic transactions let builders stack lending, trading and stablecoins into products like Yearn vaults and Aave flash loans, which speeds up innovation, makes capital more efficient and opens finance to anyone with a wallet, but the same openness has fueled oracle manipulation, flash-loan governance attacks and laundering on a massive scale, from Beanstalk and Euler to the Mango Markets case and the Tornado Cash prosecution, and those cases show that “the code allowed it” is neither an ethical defense nor a reliable legal one, so the smart approach for users is to count the layers, check audits and price sources, and avoid yields that look too good, while builders should treat every external call as untrusted and design governance that cannot be bought in one block, because DeFi composability will only keep its promise if the people using it value security and honesty as much as speed.