Emergency admin
UI for executing Emergency Admin function is located at https://permissionless-safe.gearbox.foundation/emergency/
Why is it needed?
The Emergency Admin role has a very limited set of actions that can be executed immediately, without a timelock. These actions are designed to let curators respond quickly to incidents and protect the solvency of the market.
How to add an emergency admin?
Only one address can have Emergency Admin role. It is set at the moment of creating a Market Configurator.
It can be configured in Curators' UI for the existing Market Configurator:
What are the available functions, its scope and impact?
Token Limit = 0 Impact: Asset (Pool)
❌
⚠️
✅
✅
✅
Forbid Adapter Impact: Adapter (CM)
⚠️
✅
✅
❌
⚠️
CM debt limit = 0 Impact: CM
❌
⚠️
✅
✅
✅
Forbid borrowing Impact: CM
❌
❌
✅
✅
✅
Set Main Feed Impact: Asset (Pool)
✅
✅
⚠️
⚠️
⚠️
Forbid Token Impact: Collateral (CM)
❌
❌
❌
❌
✅
Pause CM Impact: CM
❌
❌
❌
❌
❌
Pause Pool Impact: Pool
❌
❌
❌
❌
❌
Emergency scenarios
Collateral token incident
Low severity (incident status is unclear)
Set token limit = 0 in Pool
Collateral exposure can't be increased
Existing positions operations are not limited
Medium severity (collateral behavior is unhealthy, but no immediate bad debt risk)
Forbid token in Credit Manager
Collateral exposure can't be increased
Existing positions operations are limited
Operations which decrease HF are blocked (increase debt, withdraw collateral, swap into different collateral with lower LT)
Operations which increase balance of forbidden token are blocked
High severity (collateral poses risk to market solvency)
Pause all Credit Managers which have exposure
No user-side operations are allowed
Only emergency liquidators can liquidate accounts
Price feed incident
Overpricing token
Feed price is higher than market price enough to block liquidations In cases when price feeds deviates from market price by more than liquidation premium, liquidations become unprofitable.
Low severity (existing positions create no insolvency risks)
Set Token Limit = 0 in Pool to limit increasing exposure to Asset.
Consider creating a new Credit Manager with higher liquidation premium.
High severity (existing positions create risk to market solvency)
Set Main Feed of token to one that is closer to market value.
This action will reduce Health Factor of existing positions which may result in immediate liquidations.
If the new Main feed is equal to current Reserve feed, reserve feed will be automatically detached from token, which will block operations relying on Safe Price (Collateral withdrawals, Usage of adapters, Partial Liquidations).
Feed price is higher than market price enough to drain Pool In cases when price feeds higher than market price by more than 1/LT of a token, one can buy token on secondary market and borrow more than was the cost, repeating it until "buy" liquidity or the pool is exhausted. &#xNAN;This risk is mitigated if at least one of Main and Reserve feeds returns adequate value, as the token at risk will be priced at minimal price during collateral withdrawals.
High severity
Forbid token in Credit Manager
Collateral exposure can't be increased
Existing positions operations are limited (users can only fully close accounts)
External protocol incident
An external contract that is used through Adapter may appear to be misconfigured, hacked or is a proxy contract having its implementation replaced for an unsafe one.
Call Forbid Adapter for every Credit Manager which has the adapter allowed.
Emergency Methods Definitions
Token‑Specific
setTokenLimit(token, 0)
Impact Scope: Pool
Sets the quota limit for a token to zero.
Users cannot increase quota in that token, meaning new exposure to collateral can't be created.
Withdrawals, debt increases, and adapter calls for existing positions remain enabled.
forbidToken(token)
Impact Scope: Credit Manager
Highly Restricts allowed operations for accounts.
Operations which decrease HF are blocked (increase debt, withdraw collateral, swap into different collateral with lower LT)
Operations which increase balance of forbidden token are blocked
Liquidations are not impacted.
Feed‑Specific
setMainPriceFeed(token, feed)
Switches the main price feed of a token to another feed pre‑approved in the Price Feed Store.
Target feed must have been added at least 1 day earlier.
Side effects:
If the new main feed equals the current reserve feed, the reserve feed is removed (token ends up with only one feed).
New main price may be low enough to trigger immediate liquidations of Credit Accounts.
Adapter‑Specific
forbidAdapter(adapter)
Disables calls through a specific adapter.
Prevents swaps on DEXes, vault deposits/withdrawals, etc.
Side effects:
If the forbidden adapter highly contributes to some tokens' liquidity, forbidding it may break liquidations, since most of Gearbox's internal liquidators rely on allowed adapters for searching tokens' swap paths. External liquidators may or may not be affected.
Pool‑Global
pausePool(pool)
Pauses pool‑level operations (deposit into pool, withdraw LP tokens)
Designed to be combined with Credit Manager pause to prevent bank runs in the most extremal scenarios.
setCreditManagerDebtLimit(cm, 0)
Sets the Credit Manager debt limit to zero.
Prevents new borrowing capacity from the pool into that CM. Existing positions are not affected.
Credit Manager‑Global
pauseCreditManager(cm)
Pauses all Credit Manager operations.
Borrowing, withdrawing collateral, opening & closing credit accounts, performing adapter calls are blocked.
Only whitelisted Emergency Liquidators can liquidate accounts.
forbidBorrowing(cm)
Forbids opening new accounts in the CM.
Prevents increasing debt in existing accounts.
Loss Policy
setAccessMode(mode)
Adjusts who can execute liquidations which result in bad debt accrual.
Modes must be documented (TBD).
setChecksEnabled(flag)
Enables/disables specific safety checks within loss policy.
Last updated