Lifecycle & safety: the depeg playbook
When a stablecoin breaks, Spherra doesn't let it drain the pool. It runs a four-step lifecycle that quarantines the bad asset and reduces the pool's dimension, so the healthy stables keep trading. This is the §2.8 dimension-reduction machinery — and it's formally verified.
The four steps
- freeze — the depegged token is quarantined. The pool drops from
nton−1active dimensions; the
frozen asset stops trading while the survivors keep going. freeze(d) is permissionless when the swappable freeze-trigger's condition is met, so quarantine doesn't wait on a privileged party. A guardian can also act fast in an emergency.
- unfreeze — if the asset recovers to parity, it can be lifted back onto the sphere (the reverse of
freeze), restoring dimension. Gated on an invariant/polar check.
- settle — if the asset isn't coming back, its position is realized. This is the irreversible step,
so it sits behind an owner queue → timelock → execute flow (queueSettle(d) then settle(d) after the delay). No instant, unilateral settlement. LPs then claim their share of the settled proceeds.
- lift — re-list a token onto the pool (e.g. a fresh stable, or a recovered one), re-entering it on the
correct radius.
Who can do what
| Action | Who | Why |
|---|---|---|
freeze | anyone (keeper) / guardian | Quarantine can't wait on a privileged party |
unfreeze | permissioned, invariant-gated | Only back to parity |
queueSettle → settle | owner, behind a timelock | The irreversible step is never instant |
lift | owner | Re-listing a token |
claim | any LP | Redeem your settled proceeds |
poke | anyone | Advance the implied-price accumulator |
The freeze trigger
Whether a permissionless freeze is allowed is decided by a swappable TWAP-based freeze-trigger policy (an interface, replaceable by the owner). address(0) disables permissionless freeze (guardian-only). This keeps the depeg-detection oracle separate from the pool's own pricing, and lets it be upgraded without touching the core. We distinguish the reference oracle (is it depegged?) from the pool's implied price.
Transparency is the product
Everything here is designed to be watched, not hidden. In an incident, the dapp shows the quarantine state plainly ("oUSDX is quarantined — other stables trade normally"), and the crisis-comms playbook governs what we say. Our scariest scenario is meant to be a trust exhibit.
Safety claims here are "designed to" / "built to," never "guaranteed." See Security & risk.