# protocol complexity measured in composable DeFi primitives drives vulnerability surface area nonlinearly Analysis of the protocol-vulnerabilities-index — 460 vulnerability categories across 31 DeFi protocol types derived from approximately 10,600 audit findings — reveals that the number of distinct vulnerability categories per protocol type does not scale linearly with TVL or usage. Instead, it correlates with the number of DeFi primitives a protocol type composes together. Synthetics protocols top the chart at 22 vulnerability categories, followed by CDP (21), staking pools (21), cross-chain (20), leveraged farming (20), and liquid staking (20). At the other extreme, decentralized stablecoins have only 2 categories, reserve currencies have 4, and uncollateralized lending has 4. The pattern is explained by primitive composition. Synthetics protocols combine lending, trading, oracle price feeds, accounting, auction mechanisms, and liquidation logic into a single system. Each primitive brings its own vulnerability classes, and the interactions between primitives create emergent vulnerability categories that do not exist in any primitive individually. Since [[DeFi composability creates systemic exploit propagation risk because interconnected protocols transform local failures into cascades]], this composition effect operates at both the intra-protocol and inter-protocol level. This nonlinear relationship has practical implications for audit scoping and resource allocation. A synthetics protocol audit requires coverage across 22 vulnerability categories — nearly the same breadth as auditing 11 separate minimal protocols. Since [[yield aggregator strategy composition inherits vulnerabilities from every underlying protocol in the stack]], aggregators that interact with complex protocol types inherit both the target protocol's vulnerability surface and the interaction-specific risks on top. --- Relevant Notes: - [[DeFi composability creates systemic exploit propagation risk because interconnected protocols transform local failures into cascades]] — extends from inter-protocol to intra-protocol composition risk - [[yield aggregator strategy composition inherits vulnerabilities from every underlying protocol in the stack]] — demonstrates how composition cascades through aggregation layers - [[flash loan oracle manipulation enables price feed attacks against defi protocols]] — oracle manipulation is one of the universal primitives that appears across all complex protocol types - [[reentrancy oracle manipulation vault share inflation slippage precision loss and access control form the universal vulnerability kernel across all DeFi protocol types]] — the six universal classes that appear across protocol types regardless of complexity level - [[machine-generated vulnerability taxonomies from audit findings provide empirical frequency data that expert-curated taxonomies lack]] — the empirical methodology that revealed the nonlinear relationship between complexity and vulnerability surface Topics: - [[vulnerability-patterns]] - [[protocol-mechanics]]