---
title: "Guards"
description: "The transaction-time guard layer: per-asset halt flags, the halt mask, and the four per-asset risk thresholds."
audience: tech
type: reference
status: live
lang: en
updated: "2026-09-17"
publish: true
---
# Guards

A guard here is a **transaction-time revert**, not a policy or a monitor: it runs inside the call, it is
fail-closed, and it either lets the operation through or reverts it. Nothing on this layer widens,
waits, or asks an operator. The levers a human pulls live with the [guardian](/docs/3-1-4-guardian) and
the [risk steward](/docs/3-1-3-risk-steward).

---

## 1. Per-asset flags

Per-asset flags (`PoolConstantsLib.sol`). The three halt sources are one group; everything else gates a
single entrypoint or is set once at listing.

| Bit | Flag | Group | Meaning |
|---|---|---|---|
| `1 << 0` | `HALT_RISK_BIT` | halt | owner risk halt |
| `1 << 1` | `SWAP_ENABLED_BIT` | feature | `swap` permitted |
| `1 << 2` | `LIABILITY_SWAP_ENABLED_BIT` | feature | `swapLiability` permitted |
| `1 << 3` | `TOKEN_EXOTIC_BIT` | listing | token rebases or taxes the pool on outflow |
| `1 << 4` | `FLASH_ENABLED_BIT` | feature | flash loans permitted |
| `1 << 5` | reserved | reserved | unused, the symbol does not exist |
| `1 << 6` | `HALT_GUARDIAN_BIT` | halt | guardian emergency halt |
| `1 << 7` | `HALT_ANCHOR_BIT` | halt | anchor-collapse latch |
| `1 << 8` | `DEPOSIT_GATED_BIT` | listing | `deposit` and `donate` require an allowlisted depositor |

`HALT_MASK` is the three halt bits together, and it is checked at every value-moving gate. Halt
granularity is per-asset: there is no pool-wide pause bit, and `HALT_MASK` gates `deposit`, `donate`,
`withdrawTo` and `swapLiability` as well as swaps.

The sources refcount, so clearing one never relists a leg another still holds down. `setHalt` may raise
or clear the risk and guardian bits only; the anchor latch clears through a timelocked re-anchor,
because a collapsed leg still carries its mark in the old parent's units. Who may set and clear each
bit, and every other untimelocked lever: [Access control](/docs/3-1-overview).

---

## 2. Per-asset risk thresholds

The per-asset risk thresholds are four, and only four:

| Threshold | Bound |
|---|---|
| `minLiquidity` | per-asset reserve floor, the hard outflow gate |
| `maxLiabWeightBps` | a leg's share of the pool claim book, checked when a claim is credited; 0 disables it, and weights drift with marks afterwards |
| `kappaCovBps` | convex coverage-wall strength; 0 disables the wall and is forbidden on every listed asset including the hub |
| `refBandBps` | feed-relative depeg tolerance, mandatory on every non-base leg ([Flow Guards §10.4](/docs/3-2-1-flow-guards#104-per-asset-price-band-depeg-guard-for-spokes)) |

---

## 3. In this section

| Page | Role |
|---|---|
| [3.2.1. Flow Guards](/docs/3-2-1-flow-guards) | Every transaction-time guard: reentrancy, flash reserve, JIT cooldown, base depeg halt, spoke reference band |
| [3.2.2. Guardian Routines](/docs/3-2-2-guardian-routines) | Runbooks for the human levers that sit above the guards |