Cowrie Research

effective-freshness-reclassification-and-dormant-market-quarantine

12 min read

Effective-Freshness Reclassification and Dormant-Market Quarantine

  • Name: effective-freshness reclassification and dormant-market quarantine
  • Category: lending-market lifecycle reference / dormant-market reactivation checklist / low-breadth solvency quarantine note
  • Summary: A market does not stay safe just because it is old. Healthy lending systems treat freshness as a current economic condition, not a historical timestamp. When supplier breadth collapses, when one actor can again monopolize fees or donations, or when a reserve sits unused long enough that the next meaningful user can redefine its accounting, the market should lose solvency authority and re-enter quarantine. This note exists to preserve the positive design target behind Hundred, HopeLend, Onyx, Sonne, Radiant, Starlay, and dTRINITY: protocols need an explicit way to say this market has become effectively fresh again, then revoke collateral trust before low-supply math turns into cross-market bad debt.
  • Why this note exists:
    • fresh-market-seeding-and-activation-discipline already preserves the launch-side lesson: newly listed markets must earn system-wide trust more slowly than they become reachable.
    • empty-market-exchange-rate-inflation and supplier-index-inflation preserve the cash-out math once a tiny-supply or first-supplier state already exists.
    • What still deserves its own positive-design note is the operational middle ground: how an old, dormant, drained, duplicated, or newly listed market gets reclassified as unsafe before attacker-controlled donations, flash-loan fees, or rounding edges can turn it into balance-sheet authority.

The core design rule

Market age must never substitute for current market breadth, current accounting resilience, or current right to define protocol-wide solvency.

A healthy system should be able to say, in code or at least in fast enforceable operations:

  • this market is economically mature enough to matter
  • this market has drifted back into an attacker-ownable low-breadth state
  • collateral, borrowing, liquidation, or recursion authority must shrink or turn off now
  • reactivation requires an explicit review, not mere passage of time

What this note means by effective freshness

  • Effectively fresh market means a market whose current economic state resembles launch danger even if the contract is old: near-zero totalSupply, one dominant supplier, no organic deposits, no recent borrow activity, dust-scaled reserve state, or a wrapper whose next meaningful flow can again define the mark.
  • Reclassification means the protocol deliberately moves that market out of trusted collateral source status and back into a narrower lifecycle state.
  • Dormant-market quarantine means the market can remain deployed and locally observable while collateral factors, recursion rights, liquidations, or borrow caps revert to safer settings.
  • The analytical habit is simple: old contract and mature solvency object are different claims.

The three reclassification promotions reviewers should not collapse

  1. The market became thin or effectively fresh again
  • Supplier breadth collapsed, scaled supply fell toward dust, activity vanished, or the next meaningful fee / donation / deposit could again redefine exchange-rate or index meaning.
  • This is a runtime-state claim about current manipulability, not yet a statement about what the protocol should publish or trust downstream.
  1. The protocol still publishes or recognizes a local accounting object for that thin state
  • Even after a market becomes effectively fresh again, the protocol may still compute and expose an exchange rate, liquidityIndex, vault mark, health-factor input, or other local accounting view.
  • That publication may be necessary for monitoring, withdrawals, migrations, or staged repair, but it is already a stronger claim than the market is thin again.
  1. Downstream borrowing, liquidation, or recursion still honor that published mark as solvency truth
  • The dangerous promotion is not merely that the thin market still exists or still reports a number. It is that deeper reserves, liquidation rails, or recursive borrow paths still spend against that number as if maturity had never been lost.
  • This note lives at that last boundary, but it stays sharper when reviewers keep all three steps visible instead of flattening them into the old market was still live.

The five separations healthy lifecycle design should preserve

1. Market age versus solvency authority

  • A market being months old does not prove that its current exchange rate, liquidityIndex, or collateral mark is hard to monopolize.
  • Supplier breadth, denominator size, and fee-socialization conditions matter more than deployment date.
  • If the next meaningful actor can again define what donations, fees, or redemptions mean, the market is functionally near genesis even if governance treats it as mature.

2. Local reachability versus cross-market trust

  • A dormant market can remain deposit-open, observable, or migration-accessible without being allowed to create large debt elsewhere.
  • The dangerous step is not someone can touch the market; it is the rest of the protocol accepts its printed mark as finished collateral truth.
  • This is where collateral-admission-lag-and-borrow-side-quarantine becomes the downstream companion.

3. Low-breadth warning states versus ordinary steady state

  • A reserve with one meaningful supplier, dust receipt supply, or zero organic activity should not inherit the same policy as a deep, active market.
  • Healthy systems treat low-breadth conditions as a named degraded mode with its own operating rules.
  • The point is to make this market is economically thin again an actionable state, not just a dashboard observation.

4. Dormancy versus retirement and reactivation

  • Some markets should be frozen, some should remain live but quarantined, and some should be retired entirely.
  • Healthy systems distinguish still deployed, temporarily distrusted, migration-only, and fully reactivated rather than collapsing them into market exists.
  • If reactivation after dormancy or supply collapse is expected, the protocol should define what new proof of readiness is required.

5. Monitoring signals versus authority changes

  • Alerting alone is not enough if the market can still be monetized before humans respond.
  • A useful lifecycle design ties monitoring to fast authority reductions: collateral factor cuts, isolated mode, paused borrowing, disabled recursive pairs, or liquidation restrictions.
  • Otherwise the system knows it is effectively fresh again but still behaves as if it were mature.

What sound design looks like

1. Explicit effective-freshness triggers

  • Define concrete triggers for when a market stops deserving ordinary trust: near-zero supply, one-address supplier dominance, long inactivity, abrupt exchange-rate or index jumps, denominator compression, or reserve revenue arriving into an otherwise empty book.
  • The exact thresholds differ by architecture, but the important property is that the protocol has a legible answer to when does this market become launch-dangerous again?
  • Governance memory is not a trigger; current market structure is.

2. Fast authority revocation when triggers hit

  • When effective freshness appears, collateral relevance should tighten quickly.
  • Examples include collateral factor 0, reduced debt ceilings, disabled self-collateral loops, isolated borrowing, liquidation disablement, or full market pause depending on design.
  • The operational design target is not only detect the thin state. It is prevent a locally republished thin-state mark from still behaving like ordinary sibling-market solvency truth.
  • Reclassification should therefore happen faster than an attacker can recycle the printed mark into sibling-market borrowing.

3. Distinct reactivation workflow

  • A reclassified market should not silently drift back to normal because another user deposited later.
  • Reactivation should rerun seed-floor checks, accounting sanity checks, collateral-path review, caps, monitoring, and wrapper / oracle validation as needed.
  • This is the same skepticism preserved by fresh-market-seeding-and-activation-discipline, but applied to old markets that have become fresh in practice.

4. Exposure caps even before quarantine is perfect

  • Some systems cannot fully automate reclassification, so they need standing blast-radius controls anyway.
  • Low debt ceilings, isolated listings, borrow-pair restrictions, and conservative collateral factors reduce the damage if a market slips into effective freshness before operators react.
  • This is the humility rule: lifecycle detection will never be perfect, so local mistakes should still fail locally.

5. Wrapper-backed collateral should inherit the same rule

  • A wrapper share admitted months ago can become effectively fresh if its supply compresses, its downstream users disappear, or its exchange-rate surface becomes attacker-ownable again.
  • The protocol should re-evaluate wrapper markets by current manipulability and exit depth, not by onboarding age.
  • vault-share-truth-security-object and low-supply-recovery-and-recapitalization-discipline are the upstream companions when the wrapper itself needs explicit low-supply recovery or recapitalization logic.

Negative exemplar cluster: what no effective-freshness discipline looks like

  • Hundred Finance hWBTC — an older side market with effectively no remaining supplier breadth was still trusted as if age itself made the exchange rate safe.
  • HopeLend hETHWBTC — a dormant reserve kept full solvency relevance even after liquidityIndex capture had become economically first-supplier capture again.
  • Onyx oPEPE and Sonne soVELO — just-listed markets were granted relevance before any hardening separated listed from mature.
  • Radiant native USDC, Starlay lUSDC, and dTRINITY cbBTC — fresh or near-empty rebasing reserves were allowed to behave like mature collateral objects before supplier breadth existed.
  • The recurring failure is not only math bug. It is the protocol never revoked or withheld solvency authority when the market's current state made first-actor capture possible again.

Failure-prevention checklist

  • Define concrete effective-freshness thresholds for each market type: low supply, supplier concentration, inactivity duration, low borrow breadth, denominator compression, or large index / exchange-rate jumps against thin state.
  • Keep the runtime-state ladder explicit in operations and code: market became thin again, the protocol still publishes some local accounting view, and downstream paths may still honor that view should be treated as separate questions rather than one generic market is live state.
  • Encode or operationalize automatic authority reduction when those thresholds hit: collateral factor cuts, borrow disablement, isolated mode, pause hooks, or route-specific recursion shutdown.
  • Treat duplicate markets, side listings, and low-usage wrappers as permanently suspect until current depth and breadth prove otherwise.
  • Re-run launch-style checks before reactivation: irreversible seed floor, accounting sanity, decimals alignment, wrapper semantics, oracle path, caps, and monitoring.
  • Keep blast-radius limits active by default on markets that could plausibly become effectively fresh again, especially side markets and wrapper-backed collateral.
  • Add monitoring for one meaningful supplier, months of inactivity followed by sudden revenue, supply collapsed toward dust, and large mark change in a thin market.
  • Require humans to approve reactivation deliberately when the market had already fallen back into quarantine; do not let ordinary deposits implicitly certify maturity.
  • Treat fresh wrappers and old wrappers the same way if current manipulability is the same. Age is not a defense against donation-sensitive or low-depth marks.
  • Document whether the right response for each market is freeze, quarantine, migration-only, or retire; ambiguity during an incident is itself a risk.
  • Test the full lifecycle, not only launch: post-redeem dust states, abandoned side markets, duplicated listings, reserve fee accrual after months of dormancy, and post-incident recapitalization.

Audit prompts

  • What exact onchain or operational condition proves this market is still economically mature today, not merely historically old?
  • Can supplier breadth, scaled supply, or reserve activity collapse enough that the next meaningful actor again controls exchange-rate or index meaning?
  • Which monitoring signal would tell the team this market has become effectively fresh again, and how fast does that signal change authority?
  • If the market goes dormant for months, what prevents the next fee event, donation, or tiny seed deposit from becoming borrow truth across sibling markets?
  • When the market becomes thin again, which step happens automatically: thin-state detection, local mark republication, downstream authority reduction, or all three at once? Which of those steps is still relying on human reaction time?
  • Does reactivation require explicit review, or can ordinary runtime activity silently restore full collateral relevance?
  • For wrapper collateral, what metric of current manipulability or exit depth matters more than onboarding age, and is that metric actually watched?
  • Which caps, isolated modes, or pair restrictions remain in place while a market is thin enough to be dangerous again?
  • If operators are offline when effective freshness reappears, what contract state still forces the safer path?

Lessons that should already be standard

  • Dormancy is a security state, not a marketing footnote. An old empty market is often just a new market with more governance confidence than it deserves.
  • Supplier breadth matters more than listing age. The protocol should trust current denominator resilience, not historical existence.
  • Effective freshness should be reversible even if deployment is not. Markets need a way to lose trust when current state degrades.
  • The market got thin again is not yet the same thing as the protocol must keep publishing its mark as ordinary accounting truth, and even that is still not sibling markets may keep lending and liquidating against it as usual.
  • Alerts without authority reduction are mostly hindsight tooling. If a market can be monetized before humans react, the lifecycle model is incomplete.
  • Reactivation is a security event. Restoring trust after dormancy, dust supply, or repair should be a deliberate state change, not an accidental consequence of renewed activity.
  • Wrapper-backed collateral inherits the same lifecycle problem. A stale or thin wrapper mark is not safer just because the adapter was onboarded months ago.

How this note complements the exploit corpus

Internal linkages

Control surface

Graph View

Backlinks