LendingMarket or ReserveConfig, applied via the standard config-update flow.
The graduated controls
- SDK
- API
- Kamino CLI
What each control does
Soft pause: stop new borrows
borrow_disabled: 1 on the market. The minimal-disruption switch. Existing positions continue accruing interest. Repayments, deposits, withdrawals work. New borrows revert with BorrowingDisabled.
Use when: you’ve noticed something off and want to limit new exposure while you investigate.
Reserve-level utilization brake
utilizationLimitBlockBorrowingAbovePct: 80 on the reserve. A softer alternative to borrow_disabled for situations where you want to throttle borrowing only when the reserve is highly utilized. Borrows that would push utilization above the configured percentage revert; borrows at lower utilization continue.
0 disables.
Reserve-level disable: block price usage
tokenInfo.blockPriceUsage: 1 on the reserve. The reserve’s price feed is treated as unusable. Every operation that needs to read the price reverts. The reserve is effectively offline; the rest of the market continues normally.
Use when: a specific reserve’s oracle is misbehaving and you want to halt that reserve while replacing the oracle config.
Reserve-level emergency mode
emergency_mode: 1 on the reserve. Stricter than blockPriceUsage. Halts the reserve at the program level — operations targeting the reserve revert.
Pause price-triggered liquidations
price_triggered_liquidation_disabled: 1 on the market. Blocks every liquidation triggered by oracle price movement, including obligation orders that fire on price conditions. Standard liquidations driven by manual triggers (e.g., obligation orders with Always condition) still work.
Use when: an oracle is misbehaving market-wide and you want to prevent cascading liquidations on bad prices.
Market-wide emergency mode
emergency_mode: 1 on the market. The strongest reversible switch. Restricts most operations market-wide. Use only when the market needs to be brought to a near-complete stop.
Pair with emergency_council to delegate emergency-only powers to a fast multisig.
Permanent freeze: immutable
immutable: 1 on the market. Once flipped to 1, the program rejects every owner-initiated config change. Existing positions continue with current parameters; no flag, threshold, cap, or oracle can be modified by anyone.
Use when:
- The market is being archived
- You’re providing a trust-minimization commitment to depositors
- A migration to a new market is complete and you want the old market frozen
Socialize loss (last-resort)
If a position becomes truly unrecoverable — debt exceeds collateral, even the bad-debt liquidation bonus can’t make liquidators whole — the curator can callsocialize-loss to spread the loss across the affected reserve’s depositors.
The mechanics:
- The
lending_market_owner(oremergency_councilif configured) callssocialize-lossfor the affected obligation. - The unrecoverable debt is written off.
- Each depositor’s claim on the reserve is reduced proportionally to their share of total deposits.
- The position is genuinely unrecoverable
- Standard liquidation paths (including bad-debt liquidation) have been exhausted
- The reserve has a credible plan for handling the impact (curator-funded backfill, treasury, etc.)
Configuring the emergency council
emergency_council: <MULTISIG_PUBKEY> on the market. Setting an emergency_council distinct from the main lending_market_owner lets you keep ordinary operations on a slow timelocked multisig while keeping incident response on a fast one.
Recommended setup:
Operational playbook
A rough decision tree for incident response:
Always fix the root cause before re-enabling. Pausing then immediately unpausing without addressing the issue achieves nothing.
Reference
- Market config reference — every emergency-related field
- Reserve config reference —
emergency_mode,blockPriceUsage - Updating reserves — the standard reserve update flow
- Liquidations — bad debt and liquidator economics