Guards
A guard is a transaction-time revert, not a policy or a monitor. It runs inside the call, is fail-closed, and either lets the operation through or reverts it. Nothing on this layer widens, waits or asks an operator. The levers a human pulls live with the guardian and the risk steward.
1. Per-asset flags
Per-asset flags (PoolConstantsLib.sol). The two halts are one group; the rest enable or gate a
single entrypoint, are set once at listing, or carry the depeg halt code.
| Bit | Flag | Group | Meaning |
|---|---|---|---|
1 << 0 | HALT_BIT | halt | manual halt: guardian, owner or seat |
1 << 2 | HALT_ANCHOR_BIT | halt | anchor-collapse latch |
1 << 4 | SWAP_ENABLED_BIT | enable | swap_qe and swapCoop_cd permitted |
1 << 5 | LIABILITY_SWAP_ENABLED_BIT | enable | swapLiability permitted |
1 << 6 | FLASH_ENABLED_BIT | enable | flash loans permitted |
1 << 8 | TOKEN_EXOTIC_BIT | listing | token rebases or taxes the pool on outflow |
1 << 9 | DEPOSIT_GATED_BIT | gate | deposit and donate require perms lane 9 |
1 << 10 | SWAP_GATED_BIT | gate | swap_qe in or out of the leg requires perms lane 10 |
1 << 11 | COOP_ENABLED_BIT | enable | coop fill (swapCoop_cd); also the perms lane the caller needs |
12..15 | DEPEG_MASK | depeg | USD depeg halt: max |mark − 1| in code · 250 bps, 0 = off |
Bits 1, 3 and 7 are unused and rejected at listing and at setRiskConfig. A gate bit is also the
AccessControl.perms lane that passes it; a lane held by a forwarder (router, multicall, a relayer) opens the gate to every caller behind it. SWAP_GATED_BIT is porous while
LIABILITY_SWAP_ENABLED_BIT is on: a cross withdrawTo or swapLiability is an ungated delayed swap.
| Mask | Value | Covers |
|---|---|---|
HALT_MASK | 0x0005 | both halts |
HALT_SETTABLE_MASK | 0x0001 | the bit setHalt may raise or clear |
ENABLE_MASK | 0x0870 | swap, liability swap, flash, coop |
GATE_MASK | 0x0600 | deposit and swap gates |
DEPEG_MASK | 0xF000 | depeg halt code |
KNOWN_FLAGS_MASK | 0xFF75 | every defined bit; anything else reverts |
The mark store carries its own per-lane halt, a status value in the lane word that reads the lane markless; getFeed exposes it as FEED_HALT_BIT = 1 << 0 in FeedData.flags:
see Internal oracle.
HALT_MASK is checked at every value-moving gate. Halt granularity is per-asset: there is no
pool-wide pause bit, and HALT_MASK gates deposit, donate, withdrawTo and swapLiability as
well as swaps.
The sources refcount, so clearing one never relists a leg another still holds down. setHalt may raise
or clear HALT_SETTABLE_MASK only; the anchor latch clears through a timelocked re-anchor,
because a collapsed leg still carries its mark in the old parent’s units. Who may set and clear each
bit, and every other untimelocked lever: Access control.
2. Per-asset risk thresholds
There are five per-asset risk thresholds:
| Threshold | Bound |
|---|---|
minLiquidity | per-asset reserve floor, the hard outflow gate |
maxLiabWeightBps | a leg’s share of the pool claim book, checked when a claim is credited; 0 or 10,000 disables it; weights drift with marks afterwards |
depositCapCode | leg notional cap, m·10^e whole base tokens, checked after the liability write (ExcessiveAmount); a queued raise is at most 10× per op (Parametrization §6) |
kappaCovBps | convex coverage-wall strength, [50, 10000] on every listed asset including the hub |
refBandBps | feed-relative depeg tolerance, mandatory on every non-base leg (Flow Guards §10.4) |
3. In this section
| Page | Role |
|---|---|
| 3.2.1. Flow Guards | Every transaction-time guard: reentrancy, flash reserve, JIT cooldown, base depeg halt, spoke reference band |
| 3.2.2. Guardian Routines | Runbooks for the human levers that sit above the guards |