Skip to main content
When something goes wrong, such as a bad oracle, suspicious activity, or an incident, the curator has a graduated set of switches to limit damage while a fix is prepared. This page covers each switch, when to use it, and what’s still possible after it’s flipped. The emergency switches range from softest (pause new borrows) to hardest (freeze the market permanently). Each is a single flag flip on LendingMarket or ReserveConfig, applied via the standard config-update flow.

The graduated controls

Flip emergency flags via SDK

All emergency controls are single-field updates on LendingMarket or ReserveConfig. Use the standard market or reserve update flow.

Market-level flags

Reserve-level flags

To re-enable, set the flag back to 0 (or 0 on the relevant numeric field) and re-apply.

What each control does

Soft pause: stop new borrows

borrow_disabled: 1 on the market. The minimal-disruption switch. Existing positions continue accruing interest. Repayments, deposits, withdrawals work. New borrows revert with BorrowingDisabled. Use when: you’ve noticed something off and want to limit new exposure while you investigate.

Reserve-level utilization brake

utilizationLimitBlockBorrowingAbovePct: 80 on the reserve. A softer alternative to borrow_disabled for situations where you want to throttle borrowing only when the reserve is highly utilized. Borrows that would push utilization above the configured percentage revert; borrows at lower utilization continue. 0 disables.

Reserve-level disable: block price usage

tokenInfo.blockPriceUsage: 1 on the reserve. The reserve’s price feed is treated as unusable. Every operation that needs to read the price reverts. The reserve is effectively offline; the rest of the market continues normally. Use when: a specific reserve’s oracle is misbehaving and you want to halt that reserve while replacing the oracle config.

Reserve-level emergency mode

emergency_mode: 1 on the reserve. Stricter than blockPriceUsage. Halts the reserve at the program level — operations targeting the reserve revert.

Pause price-triggered liquidations

price_triggered_liquidation_disabled: 1 on the market. Blocks every liquidation triggered by oracle price movement, including obligation orders that fire on price conditions. Standard liquidations driven by manual triggers (e.g., obligation orders with Always condition) still work. Use when: an oracle is misbehaving market-wide and you want to prevent cascading liquidations on bad prices.

Market-wide emergency mode

emergency_mode: 1 on the market. The strongest reversible switch. Restricts most operations market-wide. Use only when the market needs to be brought to a near-complete stop. Pair with emergency_council to delegate emergency-only powers to a fast multisig.

Permanent freeze: immutable

immutable: 1 on the market. Once flipped to 1, the program rejects every owner-initiated config change. Existing positions continue with current parameters; no flag, threshold, cap, or oracle can be modified by anyone. Use when:
  • The market is being archived
  • You’re providing a trust-minimization commitment to depositors
  • A migration to a new market is complete and you want the old market frozen
immutable: 1 is irreversible. The program has no path to undo it. Confirm twice on a multisig review before signing.

Socialize loss (last-resort)

If a position becomes truly unrecoverable — debt exceeds collateral, even the bad-debt liquidation bonus can’t make liquidators whole — the curator can call socialize-loss to spread the loss across the affected reserve’s depositors. The mechanics:
  1. The lending_market_owner (or emergency_council if configured) calls socialize-loss for the affected obligation.
  2. The unrecoverable debt is written off.
  3. Each depositor’s claim on the reserve is reduced proportionally to their share of total deposits.
This is depositor-affecting and irreversible. Use only when:
  • The position is genuinely unrecoverable
  • Standard liquidation paths (including bad-debt liquidation) have been exhausted
  • The reserve has a credible plan for handling the impact (curator-funded backfill, treasury, etc.)

Configuring the emergency council

emergency_council: <MULTISIG_PUBKEY> on the market. Setting an emergency_council distinct from the main lending_market_owner lets you keep ordinary operations on a slow timelocked multisig while keeping incident response on a fast one. Recommended setup:

Operational playbook

A rough decision tree for incident response: Always fix the root cause before re-enabling. Pausing then immediately unpausing without addressing the issue achieves nothing.

Reference