Onchain(name to be discussed) supply chain - smart contracts depended on each other(through calls from different smart contract addresses, so we can extract it from Traces)
Smart contract libraries, for example, the OpenZepplin SafeMath, called in the same contract address. Maybe a static analysis of the code.
Offchain(name to be discussed) supply chain - e.g. wallet, oracle(?), timestamp
Supply chain for smart contract: