DeFiBeat is a public-goods transparency layer for DeFi dependency risk. We map the hidden trust assumptions behind every major collateral asset, lending market, bridge, oracle, and governance path — so users, risk teams, and governance voters can see how a failure in one dependency propagates across protocols before it becomes an emergency response problem.
Four milestones, $10,000 each. Dated, scoped, with explicit "evidence of completion" markers.
Deploy defibeat.app publicly. Publish 20 reviewed collateral assets and 10 reviewed lending markets across Aave v3, Compound v3, Morpho, Spark, Maker/Sky, Lido, EtherFi, Kelp, Ethena, and major stablecoins on Ethereum, Arbitrum, Base, and Optimism. Each page carries source links, review status, and a coverage-limitations banner.
Evidence of completion: live URL, public GitHub release, KarmaGAP milestone marked complete.
Ship the typed dependency graph as a first-class product: protocol dependency tree, asset lineage tree, and blast-radius views. Publish a versioned read-only public API so wallets, frontends, and risk teams can consume the graph. KarmaGAP profile fully populated with milestones, transactions, and evidence.
Evidence of completion: live API docs, three example queries documented (e.g. "all markets depending on LayerZero DVN X"), at least one external integration committed in writing.
Move the monitoring layer from local evaluation to scheduled runtime: proxy implementation changes, admin/guardian/Safe-signer rotations, oracle staleness beyond heartbeat, bridge/DVN configuration drift, large supply/backing invariant breaks. Critical monitors emit public alerts and open internal review tasks. Coverage expanded to 50 reviewed protocols and markets.
Evidence of completion: monitor change-log entries, public alert feed, postmortem of at least one drift detected in the wild.
Publish stress-test pages for the top five collateral assets by lending exposure: bad-debt-at-risk under 10%/30%/50% price shocks, liquidation-at-risk vs DEX depth, redemption-queue stress, bridge-pause scenario, oracle-stale scenario. Each scenario shows assumptions, data sources, and limitations transparently.
Evidence of completion: five public scenario pages with reproducible inputs, methodology version 1.0 frozen and tagged in the repo.
Contingency: if funding lands below target, we prioritize Milestones 1 and 2 (public launch and the graph) — these unlock the most external value. If above target, Milestone 3 expands to 100 protocols and Milestone 4 adds two more assets.
DeFiBeat is non-extractive infrastructure for an ecosystem that currently has no neutral, machine-readable map of its own dependencies.
Open by construction. All research data lives in source-controlled config under an MIT-licensed repository. Every page cites its sources. Reviews carry explicit status labels (reviewed, partial, under_review, unreviewed) so the limits of our coverage are public, not hidden. Methodology is versioned in the repo; material changes generate changelog entries.
Credibly neutral. We do not take fees from protocols we cover, do not gate research behind tokens, do not promote assets, and do not give financial advice. We separate observed onchain facts from analyst judgment and label uncertain claims as assumptions. Severity is expressed as user-outcome — funds can be stolen, withdrawals can halt, bad debt can accrue, oracle data can become manipulated — not as a single opaque score.
Impact is concrete and recent. The April 18, 2026 KelpDAO/LayerZero rsETH exploit released 116,500 rsETH (~$292M) on the destination chain without a matching source burn, because a 1-of-1 DVN verification path failed off-chain. The loss propagated into lending markets that had accepted rsETH as collateral without ever auditing the bridge verifier set. Chainalysis framed the missing capability as cross-chain invariant monitoring; Galaxy's postmortem called for every collateral listing to inherit the trust assumptions of its bridge and custody stack. That is the gap DeFiBeat closes — at the visibility layer, before the emergency response begins.
Beneficiaries are broad. Retail users choosing where to deposit. Wallets and frontends warning before risky approvals. Risk teams at Aave, Morpho, Spark, Compound, and Maker/Sky evaluating collateral listings. Governance delegates voting on parameter changes. Researchers and journalists writing about incidents. Security firms triaging exposure. Each group benefits without paying, and the more comprehensive the map gets, the more valuable it becomes to all of them — classic public-good economics.
For every reviewed asset and market, DeFiBeat answers questions like: What actually backs this token? Which bridge or messaging layer carries it cross-chain, and how many verifiers need to collude to release unbacked supply? Which oracle feed prices it, with what heartbeat and fallback? Who can pause, mint, freeze, or upgrade — and on what timelock? Where is this asset used as collateral, and what bad debt accrues if it stops being fully backed?
The product surface is three layers:
The lineage is deliberate: L2BEAT made L2 trust assumptions legible. DeFiLlama made TVL legible. DeFiScan made protocol decentralization stages legible. DeFiBeat completes the picture by making cross-protocol dependency risk legible — the kind of risk that turned a single bridge verifier compromise into a $292M loss in April 2026.
Global
