Why Cross-Program Invocations Redefine Composable Finance

Assets and logic are siloed. A DeFi position on Arbitrum cannot natively interact with a lending pool on Base without a slow, expensive bridge transaction, breaking the atomic composability that defines DeFi.

• User Experience: Multi-step, multi-wallet flows kill adoption.
• Capital Efficiency: $10B+ TVL is locked in isolated liquidity pools.
• Security: Each bridge hop introduces a new trust assumption (e.g., LayerZero, Wormhole).

Protocols like Chainlink CCIP and Axelar enable smart contracts to call functions on foreign chains as if they were local, restoring atomic execution.

• Atomic Guarantees: Succeed or revert across all chains, eliminating partial-fill risk.
• Developer Abstraction: Write logic once, deploy everywhere—no custom bridge integration.
• Cost Predictability: Single gas payment in source-chain currency, unlike UniswapX's solver model.

Cross-chain intents, powered by solvers on networks like Anoma, allow users to declare a desired outcome (e.g., "best yield across 5 chains") without specifying execution. This is the evolution of intent-based architectures seen in CoW Swap and Across.

• Optimal Execution: Solvers compete across chains for best price/speed.
• User Sovereignty: No need to manage gas on 5 different networks.
• Market Structure: Creates a MEV-aware cross-chain liquidity layer.

Tight coupling via xCalls creates new failure modes. A bug or oracle failure on one chain can cascade instantly across all connected chains, unlike slower bridge withdrawals.

• Security Surface: The attack surface is the sum of all connected contracts.
• Oracle Criticality: Systems become as secure as their weakest oracle (e.g., Chainlink).
• Regulatory Arbitrage: A ruling against a dApp on one chain could invalidate its cross-chain state.

UniswapX's off-chain intent settlement is a precursor. Its success (billions in volume) proves the demand for abstracted, optimized execution. The next step is extending this model cross-chain with on-chain settlement guarantees.

• Volume Proof: $10B+ in fill-or-kill intent volume.
• Economic Model: Solvers are incentivized by MEV, not just fees.
• Limitation: Currently Ethereum-centric; lacks native cross-chain atomicity.

True composability means unbounded connectivity with atomic guarantees. Cross-program invocations are the infrastructure to rebuild this, moving beyond the brittle, custodial bridge model that currently dominates $30B+ in bridged value.

• End State: A single, virtual state machine spanning all chains.
• Winner Take Most: The protocol that standardizes the xCall (like TCP/IP) will capture the network effect.
• Real Yield: Fees will accrue to security providers (oracle/validator networks), not just L1s.

DeFi protocols like Aave and Compound operate as isolated vaults. Moving assets between them requires multiple user-signed transactions, exposing users to MEV and failed execution risk.

• Solution: CPI allows a single transaction to deposit collateral, borrow, and swap assets across protocols atomically.
• Result: Enables composite yield strategies and flash loan-like functionality without the complexity, reducing execution risk by ~90%.

Projects like Wormhole and LayerZero use CPI to build native cross-chain applications (xApps), moving beyond simple asset bridges.

• Mechanism: A program on Solana can CPI to a Wormhole core messaging contract to trigger an action on Ethereum, all within a single Solana transaction.
• Impact: Enables cross-chain DEX aggregators and unified margin accounts, reducing latency from minutes to ~500ms for state attestation.

CPI turns liquidity into a programmable layer. Oracles like Pyth and Switchboard use CPI for on-demand price updates, and AMMs like Orca use it for permissionless pool creation.

• Capability: Any program can pull real-time data or instantiate new financial instruments as a subroutine.
• Scale: This composability underpins the $10B+ TVL in Solana DeFi, enabling rapid innovation cycles and complex derivatives markets.

Unlike Ethereum's external calls or Cosmos IBC, CPI is a synchronous, in-process invocation with shared memory.

• Key Difference: The calling program's context (accounts, signers) is passed directly, eliminating the need for bridging middleware and its associated trust assumptions.
• Performance: Enables sub-second finality for complex compositions, a requirement for high-frequency DeFi and on-chain gaming that EVM L2s struggle with.

CPI's all-or-nothing execution creates a single point of failure for complex transactions. A single revert in a nested call chain can cascade, wasting resources and creating a poor UX.

• Failed transactions still incur compute unit (CU) costs, burning gas for no result.
• State rollback complexity increases with dependency depth, complicating error handling.
• Creates a brittle system where one faulty program can doom a $1M+ transaction.

Solana's finite per-transaction CU limit (~1.4M CUs) is the ultimate composability cap. Deeply nested CPIs can exhaust the budget mid-execution, a hard constraint that scaling solutions like Jito's Bundle or state compression must work around.

• Limits the maximum depth and complexity of a single atomic action.
• Forces protocol designers to make trade-offs between feature richness and atomic guarantees.
• Parallel execution via Sealevel mitigates but does not eliminate this fundamental bottleneck.

CPI passes the transaction's signing authority, creating a trust vector where a called program can act with the user's permissions. This is the core of composability but also its greatest security risk.

• Malicious or buggy programs in a call chain can drain wallets or manipulate state.
• Increases the attack surface exponentially; security is now the weakest link in the dependency graph.
• Necessitates rigorous auditing of the entire stack, not just the primary protocol.

Atomic CPI transactions require locking all involved accounts, creating hotspots. When popular accounts (e.g., a USDC mint, Jupiter router) are targeted, parallel execution fails, causing network-wide congestion and failed transactions.

• Direct cause of the Solana congestion events of Q2 2024.
• ~50%+ failure rates observed during peak demand for composed DeFi actions.
• Highlights the conflict between atomic guarantees and high-throughput design goals.

CPIs that depend on real-world data (price oracles like Pyth, Switchboard) must trust the CPI chain to propagate that data atomically. A delay or failure in the oracle CPI breaks the entire transaction's logic.

• Oracle latency (~300-400ms) becomes a critical path in a sub-second blockchain.
• Creates a systemic risk where a single oracle's downtime can freeze major money legos.
• Contrasts with Ethereum's slower, more deliberate block times which mask this issue.

While CPI abstracts away token approvals, it cannot abstract transaction fees. Users must still hold SOL for gas, and complex compositions have unpredictable costs. This creates friction for new users and complicates sponsored transaction models.

• Fee estimation for a 10-CPI deep transaction is non-trivial and volatile.
• Gasless onboarding solutions require relayer infrastructure, adding centralization vectors.
• Limits the "invisible blockchain" ideal that CPI's UX otherwise enables.

Traditional multi-step DeFi interactions are vulnerable to MEV and front-running between transactions. CPIs enable atomic composability, where a single transaction can execute a complex, multi-contract workflow.

• Guaranteed Execution: The entire sequence succeeds or fails as one unit, eliminating toxic order flow.
• Native Integration: Protocols like Raydium and Jupiter use CPIs to bundle swaps, lending, and staking without user intervention.

Building cross-protocol apps on EVM often requires complex, error-prone off-chain orchestrators or bridging layers. Solana's CPI model acts as a native composability SDK.

• Direct Function Calls: Contracts call each other synchronously within the same runtime, with ~400ms finality.
• Reduced Overhead: Eliminates the need for external relayers or liquidity bridges like LayerZero for simple logic, slashing integration complexity.

Fragmented liquidity across isolated smart contracts creates capital inefficiency and poor UX. CPIs enable programmatic liquidity routing, creating a unified financial primitive.

• Dynamic Routing: A single swap can source liquidity from Orca, Raydium, and a custom AMM pool in one atomic operation.
• Capital Efficiency: Lending protocols like Solend can use deposited collateral in yield strategies without moving funds, mimicking MakerDAO's DSProxy but natively.

EVM's message-passing model forces a trade-off between security (audited, slow integrations) and innovation (fast, risky composability). Solana's CPI, with its single global state, offers a third path.

• Deterministic Costing: Transaction costs are predictable and bounded before execution, unlike Ethereum's gas auction dynamics.
• No Wrapper Hell: Avoids the UniswapX or CowSwap intent-based workarounds needed for safe batching on EVM.

CPIs shift security from pure contract isolation to a call graph security model. A vulnerability in one program can cascade, but this enforces stricter audit standards across the ecosystem.

• Explicit Privileges: Called programs must be passed the correct PDAs and accounts, creating clear security boundaries.
• Ecosystem Cohesion: This forces a higher baseline of code quality, similar to the scrutiny seen in Cosmos IBC, but at the smart contract layer.

CPIs enable smart contracts to be consumed as high-level APIs, not just standalone applications. This creates a Lego-brick economy for financial primitives.

• Monetizable Logic: Programs can charge fees for their logic, not just liquidity provision.
• Meta-Protocols Emerge: Platforms like Drift or Mango Markets can be used as liquidity engines for entirely new derivative products built on top.