Emergency admin

UI for executing Emergency Admin function is located at https://permissionless-safe.gearbox.foundation/emergency/

Why is it needed?

The Emergency Admin role has a very limited set of actions that can be executed immediately, without a timelock. These actions are designed to let curators respond quickly to incidents and protect the solvency of the market.

---

How to add an emergency admin?

Only one address can have Emergency Admin role. It is set at the moment of creating a Market Configurator.

It can be configured in Curators' UI for the existing Market Configurator:

---

What are the available functions, its scope and impact?

Action	New positions	Borrow	Withdraw	Adapter call	Liquidate
Token Limit = 0 Impact: Asset (Pool)	❌	⚠️	✅	✅	✅
Forbid Adapter Impact: Adapter (CM)	⚠️	✅	✅	❌	⚠️
CM debt limit = 0 Impact: CM	❌	⚠️	✅	✅	✅
Forbid borrowing Impact: CM	❌	❌	✅	✅	✅
Set Main Feed Impact: Asset (Pool)	✅	✅	⚠️	⚠️	⚠️
Forbid Token Impact: Collateral (CM)	❌	❌	❌	❌	✅
Pause CM Impact: CM	❌	❌	❌	❌	❌
Pause Pool Impact: Pool	❌	❌	❌	❌	❌

---

Emergency scenarios

Collateral token incident

• Low severity (incident status is unclear)

  • Set token limit = 0 in Pool

    • Collateral exposure can't be increased

    • Existing positions operations are not limited

• Medium severity (collateral behavior is unhealthy, but no immediate bad debt risk)

  • Forbid token in Credit Manager

    • Collateral exposure can't be increased

    • Existing positions operations are limited

      • Operations which decrease HF are blocked (increase debt, withdraw collateral, swap into different collateral with lower LT)

      • Operations which increase balance of forbidden token are blocked

• High severity (collateral poses risk to market solvency)

  • Pause all Credit Managers which have exposure

    • No user-side operations are allowed

    • Only emergency liquidators can liquidate accounts

Price feed incident

Overpricing token

• Feed price is higher than market price enough to block liquidations In cases when price feeds deviates from market price by more than liquidation premium, liquidations become unprofitable.

  • Low severity (existing positions create no insolvency risks)

    • Set Token Limit = 0 in Pool to limit increasing exposure to Asset.

    • Consider creating a new Credit Manager with higher liquidation premium.

  • High severity (existing positions create risk to market solvency)

    • Set Main Feed of token to one that is closer to market value.

      • This action will reduce Health Factor of existing positions which may result in immediate liquidations.

      • If the new Main feed is equal to current Reserve feed, reserve feed will be automatically detached from token, which will block operations relying on Safe Price (Collateral withdrawals, Usage of adapters, Partial Liquidations).

• Feed price is higher than market price enough to drain Pool In cases when price feeds higher than market price by more than 1/LT of a token, one can buy token on secondary market and borrow more than was the cost, repeating it until "buy" liquidity or the pool is exhausted. &#xNAN;This risk is mitigated if at least one of Main and Reserve feeds returns adequate value, as the token at risk will be priced at minimal price during collateral withdrawals.

  • High severity

    • Forbid token in Credit Manager

      • Collateral exposure can't be increased

      • Existing positions operations are limited (users can only fully close accounts)

External protocol incident

An external contract that is used through Adapter may appear to be misconfigured, hacked or is a proxy contract having its implementation replaced for an unsafe one.

Call Forbid Adapter for every Credit Manager which has the adapter allowed.

Emergency Methods Definitions

Token‑Specific

setTokenLimit(token, 0)

• Impact Scope: Pool

• Sets the quota limit for a token to zero.

• Users cannot increase quota in that token, meaning new exposure to collateral can't be created.

• Withdrawals, debt increases, and adapter calls for existing positions remain enabled.

forbidToken(token)

• Impact Scope: Credit Manager

• Highly Restricts allowed operations for accounts.

  • Operations which decrease HF are blocked (increase debt, withdraw collateral, swap into different collateral with lower LT)

  • Operations which increase balance of forbidden token are blocked

• Liquidations are not impacted.

Feed‑Specific

setMainPriceFeed(token, feed)

• Switches the main price feed of a token to another feed pre‑approved in the Price Feed Store.

• Target feed must have been added at least 1 day earlier.

• Side effects:

  • If the new main feed equals the current reserve feed, the reserve feed is removed (token ends up with only one feed).

  • New main price may be low enough to trigger immediate liquidations of Credit Accounts.

Adapter‑Specific

forbidAdapter(adapter)

• Disables calls through a specific adapter.

• Prevents swaps on DEXes, vault deposits/withdrawals, etc.

• Side effects:

  • If the forbidden adapter highly contributes to some tokens' liquidity, forbidding it may break liquidations, since most of Gearbox's internal liquidators rely on allowed adapters for searching tokens' swap paths. External liquidators may or may not be affected.

Pool‑Global

pausePool(pool)

• Pauses pool‑level operations (deposit into pool, withdraw LP tokens)

  • Designed to be combined with Credit Manager pause to prevent bank runs in the most extremal scenarios.

setCreditManagerDebtLimit(cm, 0)

• Sets the Credit Manager debt limit to zero.

• Prevents new borrowing capacity from the pool into that CM. Existing positions are not affected.

Credit Manager‑Global

pauseCreditManager(cm)

• Pauses all Credit Manager operations.

  • Borrowing, withdrawing collateral, opening & closing credit accounts, performing adapter calls are blocked.

• Only whitelisted Emergency Liquidators can liquidate accounts.

forbidBorrowing(cm)

• Forbids opening new accounts in the CM.

• Prevents increasing debt in existing accounts.

Loss Policy

setAccessMode(mode)

• Adjusts who can execute liquidations which result in bad debt accrual.

• Modes must be documented (TBD).

setChecksEnabled(flag)

• Enables/disables specific safety checks within loss policy.