External keeper/relayer not redundant
A oracle & external dependencies factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor checks whether the protocol depends on a single external keeper or relayer (e.g., Gelato, Chainlink Automation, a bespoke keeper bot) for a critical protocol function — such as liquidations, oracle updates, or reward distribution — without redundancy or a documented failover path. Source inspection and protocol documentation are the primary data sources.
**Why it matters** A single keeper with no redundancy is a centralisation risk and a potential availability failure: if the keeper goes offline, goes rogue, or is compromised, protocol functions that depend on it halt. The Badger DAO hack ($120M, 2021) involved a Cloudflare front-end dependency that was compromised via an off-chain infrastructure attack. SwissBorg ($41.5M, 2025) lost funds when a Kiln staking partner API compromise allowed malicious authorisations to be embedded in routine keeper transactions. MonoX's novel AMM design reduced effective audit coverage due to infrastructure complexity. Keeper redundancy is a maturity indicator for protocols: single-keeper designs are common in early-stage deployments but represent an operational risk that scales with TVL.
**Green / Yellow / Red** Green is scored when critical protocol functions use multiple independent keepers or a permissionless execution path (any address can trigger liquidations). Yellow is scored when a single keeper is in use but the function is also triggerable by a backup path or by governance in an emergency. Red is scored when a single keeper is the sole triggering mechanism for a critical function and no failover path is documented.
**Common gray cases** Gray is applied when keeper infrastructure is partially off-chain and the redundancy configuration cannot be verified from public sources.
**Notable historical examples** - **SwissBorg** ($41.5M, 2025): Kiln staking partner API compromise; malicious authorisations embedded in keeper transactions over 8 days. - **Badger DAO** ($120M, 2021): Off-chain Cloudflare infrastructure dependency compromised; front-end served malicious approval scripts.
Measurement what to look for #
Determine whether the protocol depends on a single keeper or relayer (Gelato, Chainlink Automation, custom) with no redundancy or failover.