Cowrie Research

borrowable-liquidity-and-deposit-ledger-coherence-discipline

13 min read

Borrowable-Liquidity and Deposit-Ledger Coherence Discipline

  • Name: borrowable-liquidity and deposit-ledger coherence discipline
  • Category: lending-reserve accounting reference / utilization-denominator coherence / direct-transfer reserve handling / off-ledger borrowable-liquidity companion
  • Summary: Healthy lending markets do not let raw tokens sitting at the market, borrowable liquidity, booked deposits, utilization denominator, depositor-share value, and collateral-visible reserve truth drift into separate partially-true ledgers. This note exists to preserve the positive-design lesson behind Silo’s WETH near miss and the broader utilization-boundary failure family: a market is already in danger once one path says these tokens may now be borrowed while another path still says those same tokens are not part of the deposits book that prices utilization, depositor yield, or reserve health.

Why this note exists

  • unexpected-balance-quarantine-and-explicit-recognition-discipline already preserves the first healthy boundary: tokens showed up is not yet recognized reserve truth.
  • helper-path-invariant-reuse-and-fail-closed-discipline already preserves the broader rule that helper paths should not trust a softer balance-sheet object than main paths do.
  • But lending markets need one sharper reserve-local note for the case where the dangerous split is specifically between what may be borrowed and what counts as deposits for utilization and interest math.
  • Silo Finance WETH donated-liquidity utilization inflation near miss is the clean negative exemplar: direct WETH transfer widened liquidity() and therefore the borrowable reserve, while totalDeposits stayed near zero; once a second account borrowed the donated WETH, utilization moved above 100% and depositor collateral value exploded.
  • The recurring healthy-side question is sharper than should donations be quarantined? It is: which exact reserve object is each money-moving path allowed to trust, and what keeps borrowability, utilization, depositor accounting, and collateral publication on one coherent ledger story?

Core claim

If a market lets one ledger answer how much may be borrowed right now? and a different, narrower ledger answer what denominator prices utilization and depositor economics?, then the interest model is already sitting on a false reserve object.

The exploit surface is not only unexpected tokens arrived. It is that the protocol silently upgraded those tokens into borrowable inventory before it upgraded the deposits ledger, reserve-health denominator, and collateral trust boundary on the same terms.

The five reserve ledgers a lending market should not split

  1. Raw custody balance

    • The literal token balance the market contract or reserve wrapper currently holds.
    • Useful for custody visibility, but not automatically the same thing as depositor-backed, borrowable, or collateral-relevant liquidity.

  2. Recognized reserve inventory

    • The amount the protocol has explicitly adopted as reserve-side inventory after handling direct transfers, rescues, fee drips, rebases, or other off-path changes.
    • This is stronger than tokens are present, but still weaker than those tokens may already be borrowed or socialize yield.

  3. Borrowable liquidity

    • The inventory the market is willing to lend out right now.
    • This should not outrun the reserve inventory and deposits book that utilization, reserve health, and depositor economics are still trusting.

  4. Deposit denominator / depositor book

    • The ledger that says how much supplier capital exists and what denominator interest, utilization, or depositor-share growth divides across.
    • If this ledger stays tiny while borrowable liquidity becomes large, the next utilization event can become attacker-authored value printing.

  5. Collateral-visible reserve truth

    • The state downstream health-factor checks, collateral valuation, and sibling markets are willing to honor as real borrower backing.
    • Even a locally coherent market may still need delay or quarantine before this ledger becomes system-wide borrow authority.

Three reserve promotions reviewers should not collapse

  1. Tokens are present at the market

    • Raw inventory exists because of a deposit, donation, rescue top-up, bridge settlement, rebase, or accidental transfer.
    • This is only a custody fact.

  2. Some of that inventory is treated as borrowable liquidity

    • A borrow path, liquidity() helper, or reserve reader now treats those tokens as usable inventory.
    • This is already a stronger claim than tokens are here, but it is still not the same thing as the deposits ledger and utilization denominator have adopted the same value on the same terms.

  3. That borrowable state is allowed to define depositor economics and collateral truth

    • Interest accrual, depositor-share growth, reserve health, or collateral valuation now treat that same liquidity story as money-good state.
    • This last promotion is where the family pays: the protocol did not merely expose more tokens to borrowing; it let the mismatch between borrowable liquidity and the deposits denominator become spendable solvency.

The design target is to keep those promotions explicit and separately enforceable. A market should be able to answer three different questions in code and in docs: what tokens are physically here?, which of those tokens are recognized reserve inventory?, and which of those recognized tokens may already affect borrowing, utilization, and collateral truth?

What sound design looks like

1. One reserve object feeds borrowing and utilization

  • A healthy market can point to one reconciled state object for borrowable liquidity, booked deposits, and utilization-sensitive interest math.
  • If a design intentionally separates those concepts, it must also name the guardrails that keep the wider object from becoming money-good before the narrower one catches up.
  • The adjacent path-parity companion is helper-path-invariant-reuse-and-fail-closed-discipline: reserve helpers should not get to widen the trusted liquidity object behind the deposits ledger’s back.

2. Direct transfers stay economically inert until explicit recognition

  • Donations, rescues, rebases, and accidental sends should not become borrowable reserve merely because balanceOf(address(this)) increased.
  • A healthy market either ignores them for borrow capacity, sweeps them into an inert bucket, or recognizes them through a controlled adoption step.
  • The first healthy boundary here is unexpected-balance-quarantine-and-explicit-recognition-discipline.

3. Borrow activation never outruns deposit-book adoption

  • A market should not be willing to lend an inventory object that the depositor book and utilization denominator still do not acknowledge.
  • Borrowable now, booked later is already a balance-sheet split, not a harmless operational convenience.
  • The preserved Silo lesson is that once another account can borrow the wider object, the next accrual step can turn denominator mismatch into printed depositor value.

4. Out-of-domain utilization fails closed instead of printing value

  • If the protocol somehow still reaches borrow > deposits or utilization above its intended ceiling, the interest model and collateral engine should degrade toward pause, clamp, treasury routing, or bounded no-op behavior.
  • The protocol needs two layers of safety: one to keep the impossible state from arising, and another to keep it non-monetizable if it does.

5. Thin-market states stay quarantined

  • Markets with zero or dust-sized deposits should not grant immediate borrowing and collateral authority merely because a helper reports some liquidity.
  • A side where one actor can cheaply own almost all depositor exposure is exactly where a reserve-ledger split becomes economically explosive.
  • The downstream admission companion is collateral-admission-lag-and-borrow-side-quarantine.

6. Paper depositor gains do not instantly become borrow power

  • Even if a reserve computes some accrued depositor gain, that output should not automatically become collateral truth before real repayment or economically justified reserve growth exists.
  • The adjacent publication boundary is reward-recognition-presentation-and-collateral-separation.

Useful positive design shapes

1. Explicit reserve-recognition lane before borrow activation

  • Keep raw balance exists, recognized reserve inventory exists, and borrowable liquidity exists as separate states.
  • A simple healthy rule is that direct transfers and rescue flows can enter reserve custody without entering borrow capacity.

2. Borrow capacity pinned to the deposits ledger or a reconciled mirror of it

  • If the market uses an optimized or cached liquidity reader, that reader should still be derived from the same reconciled reserve object that the deposits book, utilization denominator, and reserve-health checks trust.
  • Helper says there is liquidity should not be stronger than the ledger says depositors actually back it.

3. Utilization-domain invariants monitored as first-class safety properties

  • Healthy systems continuously assert relationships like:
    • borrowable liquidity <= recognized reserve inventory
    • totalBorrowAmount <= totalDeposits or an equivalent stronger condition
    • utilization-sensitive interest output remains bounded even if the first invariant is violated
    • collateral-visible depositor value cannot outrun economically justified reserve growth

4. Multi-account, multi-block exploit testing

  • This family often needs one address to manufacture the reserve mismatch and another to harvest it a block later.
  • Good tests cover donate -> second account borrows -> accrue interest -> first account borrows against paper gain, not only single-transaction traces.

5. Explicit recovery instead of ambient reactivation

  • If a market falls toward zero deposits or reserve-ledger coherence breaks, operators should recover it through quarantine, reseeding, or recapitalization rather than by letting the next raw balance increase silently become ordinary borrowable liquidity.
  • The nearby lifecycle companion is low-supply-recovery-and-recapitalization-discipline.

Design questions worth asking first

  • What exact variable defines available to borrow?
  • What exact variable defines the deposits denominator used for utilization and depositor interest accrual?
  • Are those two variables guaranteed to move together under every balance-changing path?
  • If raw underlying reaches the market outside deposit(), which subsystems react immediately and which stay inert?
  • What exact guard stops another account from borrowing off-path inventory before the deposits book recognizes it?
  • If borrow > deposits still appears, what exact clamp, pause, or treasury-routing rule keeps the rate model and collateral engine non-monetizable?
  • Which exact state transition first upgrades recognized reserve inventory exists into borrowable liquidity exists, and which later upgrade makes that state valid collateral truth elsewhere?
  • What automated condition demotes a market back into quarantine if deposits collapse toward dust or reserve-ledger coherence breaks?

Red flags

  • Direct transfers only help solvency, so they can safely increase available liquidity.
  • The deposits ledger will catch up on the next user action.
  • Utilization above 100% is impossible, so we do not need bounded behavior there.
  • Borrowable liquidity can read raw balance while the interest model reads totalDeposits; those are close enough.
  • This market is tiny, so any mismatch is economically irrelevant.
  • Paper depositor gains can immediately improve collateral because they came from the rate model, not from a spot oracle.

Failure-prevention checklist

  • Define one authoritative reserve object for borrowable liquidity, booked deposits, and utilization-sensitive interest math, or document the exact staged transitions and guards if those objects intentionally differ.
  • Keep raw direct transfers, rescue top-ups, rebases, and other off-path balance changes economically inert until explicit recognition adopts them into reserve accounting.
  • Prevent borrow paths from trusting a wider liquidity object than the deposits ledger and reserve-health denominator trust.
  • Encode and monitor the intended ledger invariant directly: totalBorrowAmount <= totalDeposits or an equivalent stronger reserve-solvency condition.
  • Bound the dangerous state twice: stop or quarantine paths that create borrow > deposits, and separately keep utilization-sensitive math and collateral publication bounded if the state still appears.
  • Quarantine empty and dust-dominated markets. A market where one actor can own nearly all depositor exposure should not also be allowed to define the next utilization regime.
  • Separate paper interest recognition from borrow-side authority. If unrealized depositor gain can immediately become collateral headroom, a reserve-ledger split becomes a cross-market drain surface.
  • Fuzz multi-account, multi-block donation-and-borrow bundles rather than only single-wallet happy paths.
  • Alert on production-impossible states: borrowable liquidity materially above recognized reserve inventory, borrow > deposits, utilization above the documented ceiling, abrupt depositor-APR explosions, or collateral value jumps unsupported by real reserve growth.
  • Treat dust-state recovery and reserve recapitalization as explicit operator ceremonies, not as ambient balance drift that mature-state borrowing may silently consume.

Audit prompts

  • What exact variable says these tokens may now be borrowed, and what exact variable says these same tokens now belong inside the utilization denominator?
  • If someone transfers underlying directly to the market today, what changes immediately: raw balance, recognized reserve inventory, borrowable liquidity, total deposits, utilization denominator, collateral value, or none of the above?
  • Can one account donate inventory while another account borrows it, so the reserve split only becomes visible across identities or blocks?
  • Does the market intentionally tolerate borrow > deposits or utilization above its documented ceiling? If yes, what keeps the resulting rate output and collateral path economically bounded?
  • Can accrued but unpaid interest immediately raise collateral value, LTV headroom, or depositor share value for the dominant supplier before any real repayment occurs?
  • How does the market behave in zero-deposit, near-zero-deposit, and one-major-supplier states? Are borrowing and collateral admission still enabled there?
  • Which helper paths or reserve readers can observe a broader liquidity object than the deposits book can observe?
  • What monitor would fire first if borrowable liquidity, booked deposits, and collateral-visible value stopped telling the same reserve story?
  • If the deposits denominator stayed tiny while another path widened borrowable liquidity, how much value could the dominant depositor print before operators could intervene?

Lessons that should already be standard

  • Tokens are here is not the same thing as depositors back them, and neither statement is automatically the same thing as borrowers may use them.
  • A borrow path that trusts a wider ledger than the utilization denominator already owns a latent interest-printing surface.
  • Empty markets make reserve-ledger splits economically violent. If one actor owns nearly all depositor exposure, the next denominator mistake belongs to that actor.
  • Direct transfers into lending markets are balance-sheet events, not harmless clutter.
  • Utilization > 100% is an incident state, not a valid rate-discovery regime.
  • Paper depositor yield becomes dangerous the moment the protocol is willing to lend against it before real reserve growth exists.
  • Multi-block and multi-account exploit choreography is part of the family, not a reason to underrate it.
  • Good reserve design separates inventory exists, inventory is recognized, inventory is borrowable, and inventory can already support collateral truth instead of collapsing them into one ambient liquidity state.

How to use this note with the exploit corpus

Internal linkages

Control surface

Graph View

Backlinks