Guards
A guard here is a transaction-time revert, not a policy or a monitor: it runs inside the call, it is fail-closed, and it either lets the operation through or reverts it. Nothing on this layer widens, waits, or asks an operator. The levers a human pulls live with the guardian and the risk steward.
1. Per-asset flags
Per-asset flags (PoolConstantsLib.sol). The three halt sources are one group; everything else gates a
single entrypoint or is set once at listing.
| Bit | Flag | Group | Meaning |
|---|---|---|---|
1 << 0 | HALT_RISK_BIT | halt | owner risk halt |
1 << 1 | SWAP_ENABLED_BIT | feature | swap permitted |
1 << 2 | LIABILITY_SWAP_ENABLED_BIT | feature | swapLiability permitted |
1 << 3 | TOKEN_EXOTIC_BIT | listing | token rebases or taxes the pool on outflow |
1 << 4 | FLASH_ENABLED_BIT | feature | flash loans permitted |
1 << 5 | reserved | reserved | unused, the symbol does not exist |
1 << 6 | HALT_GUARDIAN_BIT | halt | guardian emergency halt |
1 << 7 | HALT_ANCHOR_BIT | halt | anchor-collapse latch |
1 << 8 | DEPOSIT_GATED_BIT | listing | deposit and donate require an allowlisted depositor |
HALT_MASK is the three halt bits together, and it is checked at every value-moving gate. Halt
granularity is per-asset: there is no pool-wide pause bit, and HALT_MASK gates deposit, donate,
withdrawTo and swapLiability as well as swaps.
The sources refcount, so clearing one never relists a leg another still holds down. setHalt may raise
or clear the risk and guardian bits only; the anchor latch clears through a timelocked re-anchor,
because a collapsed leg still carries its mark in the old parent’s units. Who may set and clear each
bit, and every other untimelocked lever: Access control.
2. Per-asset risk thresholds
The per-asset risk thresholds are four, and only four:
| Threshold | Bound |
|---|---|
minLiquidity | per-asset reserve floor, the hard outflow gate |
maxLiabWeightBps | a leg’s share of the pool claim book, checked when a claim is credited; 0 disables it, and weights drift with marks afterwards |
kappaCovBps | convex coverage-wall strength; 0 disables the wall and is forbidden on every listed asset including the hub |
refBandBps | feed-relative depeg tolerance, mandatory on every non-base leg (Flow Guards §10.4) |
3. In this section
| Page | Role |
|---|---|
| 3.2.1. Flow Guards | Every transaction-time guard: reentrancy, flash reserve, JIT cooldown, base depeg halt, spoke reference band |
| 3.2.2. Guardian Routines | Runbooks for the human levers that sit above the guards |