A Graph-Theoretic Framework for DeFi Vault Risk Decomposition

Abstract

Decentralized finance (DeFi) vaults-smart contracts that automate yield strategies across composable protocols-represent over $16 billion in total value locked yet lack standardized risk decomposition frameworks. We propose a graph-theoretic approach: representing vaults as directed acyclic graphs where nodes are typed by four atomic primitives (CONTRACT, ORACLE, GOVERNANCE, OPERATIONAL) and edges encode dependency relationships. This formalization enables node-level risk attribution, where every basis point of expected loss traces to a specific primitive. We calibrate base rates from a dataset of 449 documented exploits (2016-2026) totaling $15.7 billion in losses, sourced from DeFiLlama and validated against Rekt News. Key finding: CONTRACT failures dominate frequency (65%) while OPERATIONAL failures dominate severity (50% of losses)-a distinction invisible without formal decomposition. The framework provides: (i) a complete taxonomy covering all historical exploit root causes, (ii) transparent aggregation from node-level to vault-level risk, and (iii) crossprotocol comparison on a common basis. The framework does not predict exploits; rather, it provides the decomposition infrastructure that enables risk budgeting, concentration analysis, and board-level reportingcapabilities institutions require but DeFi currently lacks.