Cowrie Research

fresh-market-seeding-and-activation-discipline

18 min read

Fresh-Market Seeding and Activation Discipline

  • Name: fresh-market seeding and activation discipline
  • Category: lending-market rollout reference / launch-sequencing checklist / dormant-market quarantine note / collateral-activation companion
  • Summary: A lending market, reserve, or wrapper-backed collateral path should not become economically meaningful just because deployment or listing succeeded. Healthy systems separate market exists, market has an irreversible seed floor, market accounting is verified, and market may create protocol-wide solvency into distinct states. This note exists to preserve the positive design target behind Onyx, Sonne, Radiant, Starlay, dTRINITY, ResupplyFi, Hundred, and HopeLend: fresh and effectively-fresh markets need explicit seeding, activation, and re-entry rules before their local accounting can define borrow power for the rest of the protocol.
  • Why this note exists:
    • fresh-market-initialization-failure already preserves the negative family clearly: the attacker reaches a market before hardening finishes and gets to define the opening state.
    • empty-market-exchange-rate-inflation preserves the sharper math family once a tiny-supply market can print fake collateral value.
    • What still deserves a narrower positive-design note is the operational control surface between those two ideas: how a market should be seeded, verified, activated, quarantined, and, if necessary, treated as fresh again after dormancy or supply collapse.

What this note means by fresh-market seeding and activation

  • Fresh market means a newly listed lending market, reserve, or wrapper-backed collateral path that has not yet earned downstream solvency trust.
  • Effectively fresh market means an older market whose economics have drifted back toward launch danger: near-zero supply, one dominant supplier, no organic deposits, or a dormant reserve whose next meaningful actor can again define the rate or index.
  • Seeding means establishing an irreversible minimum state before outside actors can monopolize the opening accounting: dead shares, non-redeemable seed liquidity, virtual offsets, or another floor that cannot later be burned away cheaply.
  • Activation means more than users can deposit. The dangerous activation is when the market may create debt, determine liquidation eligibility, or export collateral truth into sibling markets.
  • The core rule is simple: markets should become systemically relevant more slowly than they become locally reachable.

The three fresh-market promotions reviewers should not collapse

  1. The market or wrapper path exists and can be touched at all
  • Governance listed it, the contract was deployed, the reserve was initialized, or the collateral adapter can now point at a fresh wrapper object.
  • This is only a reachability claim. It is not yet a claim that the opening denominator, exchange rate, liquidityIndex, or share semantics deserve publication as money-good accounting truth.
  1. The protocol has published one local accounting object for that opening state
  • Even before full activation, the system may expose an exchange rate, vault mark, index, collateral quantity, or health-factor input for monitoring, deposits, withdrawals, migrations, or staged warmup.
  • That publication can be operationally necessary, but it is already a stronger claim than the market exists: the protocol has decided that one particular opening-state object counts as its canonical local accounting view.
  1. Downstream borrowing, liquidation, or recursion still honor that published object as protocol-wide solvency truth
  • The dangerous promotion is not merely that the market is listed or that the protocol can print a number for it. It is that deeper sibling reserves, liquidation rails, and recursive borrow paths still spend against that number as if launch hardening were already complete.
  • This note stays sharper when reviewers keep all three steps visible instead of flattening them into new market went live.

The six states healthy market rollout should keep separate

1. Listing or deployment is not activation

  • Creating the contract, adding the market to governance registries, or wiring an oracle is only the start of the lifecycle.
  • A newly listed market should still be treated as unfinished until its opening-state assumptions are locked in.
  • The protocol should be able to say exactly which later state transition makes the market safe enough for collateral or borrowing.

2. Irreversible seed state before first meaningful outside use

  • A healthy launch path establishes non-redeemable minimum supply before outside users can own the whole capitalization table or all scaled supplier balance.
  • In Compound-style systems this often means dead shares or locked seed liquidity; in wrapper-backed systems it can mean virtual offsets or pre-seeded non-burnable claims; in Aave-style reserves it may mean keeping the reserve economically irrelevant until real supply breadth exists.
  • The important property is not someone seeded it once. It is the first outside actor cannot cheaply undo or bypass the seed state.

3. Accounting verification before solvency admission

  • Even after seeding, a market should pass explicit checks before it is allowed to matter elsewhere: supply floor present, exchange-rate or index math sane, decimals aligned, collateral adapter reading the intended object, and monitoring hooks armed.
  • This is the stage where teams should prove the market’s opening state is coherent, not merely hope it is.
  • If the verification step is only a runbook and not an enforceable state transition, the protocol is still relying on operator folklore.

4. Local usability before cross-market authority

  • A market can be deposit-live, test-live, or locally active while still having collateral factor 0, isolated borrow caps, no recursive borrow pairs, or liquidations disabled.
  • This separation matters because the protocol can publish one opening-state accounting object is still not the same thing as deeper sibling liquidity should already lend and liquidate against it.
  • Many launch failures are survivable while the mark stays local and catastrophic only when that printed mark reaches deeper sibling liquidity.
  • collateral-admission-lag-and-borrow-side-quarantine is the downstream-solvency companion once the question becomes how long that distrust boundary should remain in place.

5. Gradual activation with blast-radius limits

  • Healthy systems do not jump straight from fresh market exists to full borrow-side authority.
  • Collateral factors, debt ceilings, borrow caps, eligible borrow pairs, liquidation permissions, and recursive usage rights should grow in stages.
  • The design goal is not to prove perfection before launch. It is to ensure that any mistake in the opening state fails locally before it becomes protocol-wide bad debt.

6. Dormancy and supply collapse should re-enter the same caution state

  • A market that has one meaningful supplier, dust totalSupply, or months of zero organic activity is economically close to a launch-state market even if governance considers it mature.
  • Dormant markets should not inherit full trust just because they are old.
  • If supply compresses, utilization becomes singular, or the last live users can define future exchange-rate or index meaning, the market should fall back into the same quarantine logic as a fresh listing.

What sound design looks like

1. Atomic or tightly committed launch bundles

  • The cleanest shape is one bounded action that creates the market, establishes the irreversible seed floor, verifies expected state, and leaves collateral or borrowing disabled until those preconditions are onchain.
  • If multiple transactions are unavoidable, the allowed intermediate states should still be safe under adversarial execution order.
  • Timelock execution should be modeled as hostile whenever arbitrary third parties can press execute.

1a. Public timelocks must expose a finished launch bundle, not a ceremony gap

  • A queued launch path should already encode the safe ordering it depends on. Create market now, let operators seed later, then raise collateral factor is not one launch bundle; it is a public race over an unfinished market.
  • The review question is not only whether each queued transaction looks reasonable in isolation. It is whether the whole post-expiry state machine stays safe when the attacker is the first executor. Sonne is the clean reminder that a known-empty-market bug can be reopened even when the team has a mitigation, if the mitigation lives in a post-timelock ceremony rather than in the queued effect set itself.
  • Temporary seed-and-burn rituals are especially weak here. If the plan is to establish a seed only briefly and remove it again after launch, then the protocol has still not encoded a durable answer to who owns the opening denominator once the ceremony is skipped, raced, or later unwound.
  • The adjacent governance-side design companion is timelock-action-bundle-commitment: delayed privileged execution should freeze a safe, ordered effect set rather than publish a list of individually sensible transactions whose unsafe intermediate states are left to operator timing.

2. Seed floors that survive runtime adversity

  • Dead shares, locked seed deposits, or virtual offsets should survive redemptions, migrations, emergency paths, and cleanup operations.
  • The real question is not was launch seeded? but can the market ever return to attacker-ownable dust supply anyway?
  • This is where bootstrap-state-irreversibility-and-supply-floor-design becomes the broader low-supply lifecycle companion.

3. Explicit activation flags instead of implied readiness

  • Market listed should not imply market may act as collateral.
  • Readiness should depend on explicit state: seeded, verified, monitored, caps configured, and optionally manually reviewed.
  • Healthy design keeps three gates legible: this market exists, this market may publish one local accounting object, and this market may now export that object into borrow-side solvency authority.
  • If readiness is inferred from weak signals such as the contract exists, someone deposited, or governance added the oracle, the protocol is already too trusting.

4. Fresh wrappers should inherit the same discipline

  • Wrapper-backed collateral paths deserve the same launch paranoia as native lending markets.
  • A newly admitted ERC-4626 vault share, staking receipt, or LP token should not skip seed-state, donation-resistance, and collateral-quarantine checks just because the underlying wrapper exists elsewhere.
  • vault-share-truth-security-object is the upstream share-accounting companion when the sharper question is what that wrapper mark should already mean before the lending layer trusts it.

5. Dormant-market quarantine should be a first-class control

  • Old empty markets, duplicate listings, and thin side markets should be monitored as if they were new.
  • A healthy system can freeze collateral usage, keep factors at zero, or require reactivation review when supplier breadth collapses.
  • This is how protocols avoid relearning Hundred and HopeLend from assets that were technically live but economically fresh again.

6. Reactivation should be a governed state change, not an accident

  • If a market comes back from dormancy, dust supply, migration, or post-incident repair, the protocol should reactivate it deliberately.
  • Fresh seed verification, collateral-factor review, and blast-radius limits should re-run before the market regains full solvency authority.
  • low-supply-recovery-and-recapitalization-discipline is the companion when the sharper question becomes how depleted or damaged share systems should explicitly recover rather than silently resume normal semantics.

Negative exemplar cluster: what underdesigned activation looks like

  • Onyx Protocol oPEPE — governance listed PEPE, but the listing itself effectively handed the attacker the right to define the first meaningful market state.
  • Sonne Finance soVELO — the team had a seed-and-burn hardening plan, but permissionless timelock execution meant the attacker controlled sequencing instead.
  • Radiant Capital native USDC and Starlay lUSDC — fresh reserves were allowed to become borrow-relevant before the first-supplier problem was economically defused.
  • dTRINITY dLEND cbBTC — a six-day-old zero-supply reserve was functionally still at launch, but the protocol had already granted it meaningful solvency authority.
  • ResupplyFi cvcrvUSD — a newly admitted wrapper-collateral path inherited full lending relevance before its opening exchange-rate state was economically hardened.
  • Hundred Finance hWBTC and HopeLend hETHWBTC — older markets can still be effectively fresh when almost nobody remains in them and one actor can again define what future donations or fees mean.
  • The recurring lesson is not merely launch math was wrong. It is the protocol never encoded when this market was actually allowed to matter system-wide.
  • The governance-side wrinkle matters too: a public timelock or multisig queue can publish an unsafe launch state machine even when every individual queued action looked operationally familiar. If safe initialization depends on a team-only ceremony after expiry, the launch bundle was incomplete before the attacker ever arrived.

Red flags that usually mean activation logic is relying on folklore

  • We will seed it right after listing
  • The timelock is public, but we will execute the safe order first
  • Collateral can go live now because the market already exists
  • No one uses that side market anyway when low usage is exactly why one actor can monopolize it
  • The reserve is old, so it is no longer a launch-risk surface
  • We can reopen it later if needed without a defined reactivation checklist
  • Wrapper collateral is different from market launch risk even though the lending layer is still trusting an opening exchange-rate state

Design questions worth asking first

  • What exact irreversible fact proves the market is past its dangerous opening state?
  • Can any outside actor become the first meaningful supplier or wrapper holder before that fact becomes true?
  • Are market creation, seeding, verification, and collateral activation bundled safely under adversarial execution order?
  • If the market stays empty or nearly empty after listing, what prevents its local accounting from becoming borrow truth elsewhere?
  • What policy reclassifies an old but dormant market as effectively fresh again?
  • Which caps, isolation rules, or liquidation limits keep a bad opening state local while confidence is still being earned?
  • For wrapper-backed collateral, what prevents the first meaningful holder or donor from defining the opening mark before the lending layer trusts it?
  • If operators are offline during activation or reactivation, what contract state still forces the safe path?

Minimal rollout state machine worth encoding

StateWhat is trueWhat must still be falseTypical controls
listedMarket / reserve / wrapper path exists and governance has named itNo outside actor can yet make the opening denominator matter system-widecollateral factor 0, borrow disabled, liquidations disabled, recursion disabled
seededIrreversible floor or virtual-offset equivalent exists and cannot be trivially unwoundThe market still should not define sibling-market solvency just because seeding happenednon-burnable seed, dead shares, supply-floor assertions, activation flag still off
verifiedDecimals, oracle / adapter path, accounting invariants, and monitoring hooks have passed explicit checksFull collateral power and liquidation authority still remain offinvariant checks, smoke tests, risk caps preloaded, telemetry armed
warmLimited local or bounded collateral usage is allowedRecursive leverage, large debt growth, and ordinary liquidation authority remain constrainedisolated mode, low debt ceilings, low collateral factor, borrow-pair allowlists, liquidation grace / caps
activeThe market has earned ordinary borrow-side authority under observed depth and stable accountingThe protocol should still be ready to demote it automatically if breadth collapsesfull caps, steady-state monitoring, downgrade triggers
reclassification-requiredSupply breadth, denominator resilience, or market activity has degraded back toward launch-dangerous conditionsHistorical age must not preserve full trustautomatic quarantine, factor cuts, borrow disablement, reactivation review
  • The design question is not does the market ever become active? but what exact irreversible fact moves it from one state to the next, and what exact fact forces it backward?
  • Healthy rollout usually allows only monotone forward movement through listed -> seeded -> verified -> warm -> active, while reclassification-required is an explicit backward edge triggered by current market structure rather than governance memory.
  • The exploit-family shortcut is simple: if an attacker can monetize a state that your protocol still labels listed, seeded, or merely verified as though it were already active, then the lifecycle boundary is still too implicit.

Failure-prevention checklist

  • Encode market lifecycle states explicitly: listed, seeded, verified, locally usable, borrow-relevant, fully active, and reactivation-required should not be inferred from age or operator intent.
  • Keep the rollout ladder explicit in code and review: market exists, the protocol publishes one opening-state accounting object, and sibling markets may already spend against that object are separate promotions, not one generic activation event.
  • Establish an irreversible seed floor before any outside actor can become the first meaningful supplier, wrapper holder, or fee recipient. The important property is not that seeding happened once, but that runtime paths cannot cheaply erase it later.
  • Make collateral admission, borrowing, liquidation eligibility, and recursive borrow routes depend on explicit readiness flags rather than the mere existence of a market, reserve, oracle, or wrapper adapter.
  • Treat fresh wrappers exactly like fresh native markets: donation resistance, exchange-rate sanity, decimals alignment, and supply-floor assumptions should be verified before the lending layer trusts the mark.
  • Bundle market creation, seeding, parameterization, and unsafe-path disabling so adversarial execution order cannot expose an intermediate attacker-ownable state.
  • Review launch bundles as state machines, not checklists. Every queued governance or timelock action should be safe not only alone but also in the exact partial prefixes a public executor can realize before operators re-enter the flow.
  • Add dormant-market and low-supply reclassification rules in code or monitoring: if supplier breadth collapses, totalSupply approaches dust, or one actor dominates remaining supply, the market should fall back into quarantine automatically or operationally fast.
  • Keep blast-radius controls active during warmup and reactivation: collateral factor 0, isolated debt ceilings, borrow caps, disabled self-collateral loops, disabled liquidations, or route-specific pair restrictions until confidence is earned.
  • Fuzz and scenario-test the exact low-supply lifecycle that matters in production: post-redeem dust states, migration residue, emergency exits, fee accrual in near-empty reserves, and wrapper donations after collateral listing.
  • Monitor for production-impossible opening states: one meaningful supplier, zero or near-zero live supply, sudden exchange-rate or liquidityIndex jumps, or new markets whose first revenue event creates protocol-wide borrow power.
  • Require deliberate reactivation after repairs, migrations, prolonged dormancy, or incident response. Old market and safe market are not synonyms.

Audit prompts

  • What exact irreversible onchain fact proves this market is past its dangerous opening state, and can an external actor interact meaningfully before that fact becomes true?
  • Can any redeem, migration, emergency exit, bad-debt socialization, or cleanup path erase the supposed seed floor and return the market to attacker-ownable dust supply?
  • Which state transitions actually unlock protocol-wide solvency authority here: collateral factor changes, borrow enablement, liquidation eligibility, adapter whitelisting, or recursive borrow pairs?
  • Are those transitions bundled safely under adversarial ordering, or can public execution, governance latency, or operator delay expose an unsafe intermediate state?
  • If the asset is a wrapper or vault share, what exactly guarantees that its opening exchange-rate semantics are hardened before the lending layer consumes them as collateral truth?
  • What conditions classify an old market as effectively fresh again, and are those conditions enforced automatically anywhere?
  • If a market remains empty for days or months after listing, what prevents the first meaningful supplier or fee recipient from still defining the economic opening state?
  • Which blast-radius controls remain active while confidence is being earned, and what precise event removes each one?
  • How would the team detect that supplier breadth collapsed back toward a launch-dangerous state before an attacker could monetize it across sibling markets?
  • If operators disappear during activation or reactivation, what contract state still forces the safe path rather than trusting the runbook?

Lessons that should already be standard

  • Deployment is not activation. A market existing onchain does not mean it has earned the right to define borrow power for the rest of the system.
  • The market exists is not yet the protocol should publish one opening-state accounting object, and even that is still not sibling markets may already lend and liquidate against it as ordinary solvency truth.
  • Seed floors only matter if they survive runtime reality. A one-time seeding ceremony that later redeem paths can undo is operational theater, not hardening.
  • Dormant markets deserve the same paranoia as new ones. The exploit family cares about current supplier breadth and accounting leverage, not market age.
  • Wrapper onboarding is market launch by another name. If the lending layer is trusting a fresh exchange-rate object, it has inherited fresh-market risk even when the wrapper itself is mature elsewhere.
  • Public timelocks and multi-tx rollout plans are adversarial environments. If safe sequencing matters, code needs to enforce it.
  • A market can be locally useful before it is systemically trusted. Conflating those stages is how small launch mistakes become protocol-wide bad debt.
  • Reactivation is a security event. Recovery from dormancy, migration, or post-incident repair should re-run the same skepticism as original launch.

How this note complements the exploit corpus

Internal linkages

Control surface

Graph View

Backlinks