Skip to main content

Failure Scenarios

Current Phase: Shadow Mainnet Testing

Multyr contracts are deployed on Arbitrum One. The system is currently in validation phase. Deposits are not open to the public. Behavior described on this page reflects the protocol's designed behavior; some mechanisms are active in shadow testing, others become active at public launch. See the Status page for details.

This page documents specific failure scenarios and the system's response. Each scenario is scoped to a concrete trigger, not a general category of risk.

Scenario 1: An underlying lending protocol is exploited​

Trigger. An exploit on Aave v3 Arbitrum (or similar whitelisted protocol) causes partial loss of deposited capital.

System response.

  1. Oracle/health monitors detect abnormal NAV drop
  2. Strategy is marked DEGRADED (by Guardian or automation)
  3. No new allocation flows to the affected strategy
  4. Existing capital in the strategy is unwound on next feasible withdrawal cycle
  5. Per-strategy loss cap caps the loss attributable to this strategy

Allocator impact. Capital allocated to the affected strategy at time of exploit is subject to the exploit's loss, bounded by the per-strategy loss cap and the strategy's share of vault capital.

Scenario 2: Oracle feed becomes stale​

Trigger. Chainlink price feed fails to update beyond freshness threshold.

System response.

  1. Deposits blocked
  2. Rebalances blocked
  3. Withdrawals continue using fallback pricing
  4. System remains in this state until oracle resumes

Allocator impact. Deposits unavailable until oracle recovery. Withdrawals remain possible but may use fallback pricing with documented approach.

Scenario 3: Governance multisig is compromised​

Trigger. SAFE_GOV (3-of-5) is compromised and submits a malicious parameter change.

System response.

  1. Parameter change enters ROOT_TIMELOCK (48h delay)
  2. Change is publicly visible during delay
  3. SAFE_VETO multisig can cancel the pending change
  4. If SAFE_VETO also fails, SAFE_GUARDIAN can pause system while community coordinates response
  5. Force withdrawals remain available throughout

Allocator impact. 48+ hour window to exit or monitor before any governance change takes effect. Exit path preserved through force withdrawal.

Scenario 4: A strategy experiences rapid unbounded loss​

Trigger. Leveraged or structured strategy incurs losses faster than the system's normal response cycle.

System response.

  1. Aggregate loss cap halts new allocation
  2. Guardian pauses the strategy at BROKEN state
  3. Capital in the strategy is unwound, accepting whatever execution is available
  4. Remaining capital in other strategies continues to operate normally

Allocator impact. Loss is bounded by the per-strategy loss cap and the strategy's allocation share. Capital in unrelated strategies is unaffected.

Scenario 5: Arbitrum sequencer failure​

Trigger. Arbitrum One sequencer experiences extended downtime.

System response.

  1. No transactions process during sequencer downtime
  2. On sequencer resumption, deposits and withdrawals resume in normal order
  3. Underlying positions continue to accrue or lose value based on their on-chain state during downtime

Allocator impact. Transaction unavailable during downtime. Positions continue to be exposed to underlying protocol dynamics during the same period. Force exit to L1 is available via Arbitrum's native escape hatch (independent of Multyr).

Scenario 6: A critical bug is discovered in Multyr contracts​

Trigger. Security researcher or internal review identifies a critical vulnerability.

System response.

  1. Guardian pauses deposits immediately
  2. Withdrawals proceed if safe, or are paused if they could worsen the issue
  3. Root cause analysis and disclosure timeline published
  4. Remediation executed via governance with appropriate delay
  5. Post-mortem published

Allocator impact. Funds accessible via withdrawal (instant, queued, or force depending on state). New deposits blocked until remediation complete.

What these scenarios share​

  • No discretionary loss absorption. The system does not socialize losses beyond what is encoded.
  • Exit paths preserved. Force withdrawal remains available in all scenarios short of total contract destruction.
  • Bounded exposure. Per-strategy and aggregate loss caps bound the magnitude of any single failure.
  • Public visibility. All state changes are on-chain.