Cowrie Research

house-asset-collateral-quarantine-and-external-liquidity-discipline

13 min read

House-Asset Collateral Quarantine and External-Liquidity Discipline

  • Name: house-asset collateral quarantine and external-liquidity discipline
  • Category: solvency policy reference / protocol-native collateral checklist / house-token risk discipline
  • Summary: A protocol can publish, trade, incentivize, and govern around its own token without letting that token underwrite deep withdrawals from the rest of the balance sheet on ordinary terms. This note exists to keep that distinction explicit. The recurring failure is not just oracle manipulation; it is the protocol treated a thin house asset, or paper gains derived from it, as if it were external money-good collateral. Healthy design therefore starts from quarantine, crisis-depth sizing, and reserve-outflow skepticism rather than from ordinary listing defaults.
  • Why this note exists:
    • Incidents like Mango, Moola, Venus XVS, Fortress, Fuse VUSD, and Inverse INV all preserve the same design mistake: a protocol-adjacent asset got treated like finished solvency truth faster than external exit liquidity justified.
    • The sharper healthy-side question is usually not which oracle should we use? but why should this house asset be allowed to unlock BTC, ETH, SOL, CELO, or stablecoins at this size at all?
    • This note is the downstream-solvency companion to protocol-native collateral fragility: once the exploit family is recognized, this is the positive-design layer for how a healthy system keeps protocol-adjacent assets out of the reserve core or admits them only under unusually skeptical terms.

What this note means by house-asset collateral quarantine

  • House asset means a protocol’s own governance token, incentive token, house stablecoin, treasury-adjacent wrapper, or another asset whose main economic depth and narrative relevance come from the same ecosystem that wants to lend against it.
  • Collateral quarantine means the asset does not inherit ordinary collateral treatment merely because it has a price feed, a liquid-looking venue, or active governance enthusiasm.
  • External-liquidity discipline means collateral factors, debt ceilings, reserve-outflow caps, and PnL settlement rules are sized from stressed executable exit depth on venues that do not depend on the protocol itself to stay credible.
  • The design goal is not house assets can never matter. It is house assets must earn every unit of balance-sheet authority from external liquidation reality rather than from local market optics or governance desire.

The main solvency controls

1. Separate listing lane for house assets

  • A governance token or house stablecoin should not travel through the same admission checklist as external blue-chip collateral.
  • The default state should be not borrow-relevant, isolated, or heavily capped, not list it like another volatile asset and tune later.
  • This matters even when the oracle is technically correct, because the dangerous assumption is usually liquidation realism rather than feed freshness.

2. Crisis-depth sizing instead of market-cap sizing

  • House-asset collateral factors should be anchored to what could be sold during a disorderly unwind rather than to circulating market cap, recent spot volume, or peak-period liquidity.
  • If the protocol would lose stablecoins, BTC, ETH, or native reserves when the house asset reverses, then the relevant benchmark is stressed exit depth for those reserves, not headline token valuation.
  • Venus XVS is the durable reminder that a large quoted market cap can still support far less liquidation than the protocol recognized as borrow power.

3. Reserve-outflow caps independent of collateral math

  • Even if a house asset remains listed, the protocol should separately cap how much external reserve inventory can leave because of that one asset.
  • Debt ceilings, asset-specific borrow caps, withdraw throttles, and per-asset reserve-outflow budgets should all survive the case where the house-token mark itself fails high.
  • This is how a healthy system prevents one local repricing episode from evacuating the rest of the balance sheet in one window.

4. Settlement distrust for house-asset-derived PnL

  • Perp gains, unrealized profits, and same-window mark-to-market changes on a house asset should not become ordinary withdrawable equity just because the venue’s pricing engine can compute them.
  • Mango is the clean negative exemplar: the protocol honored attacker-shaped MNGO-PERP gains as reserve-spend authority before the market could prove those gains were realizable.
  • Healthy venues add haircuts, settlement delays, capped withdrawable PnL, or reserve-side quarantine when the underlying market is thin and protocol-adjacent.

5. No recursive same-system self-support loops

  • If users can borrow the house asset, post it back as collateral, use it to move the same oracle, or route treasury-supported demand into the same price path that unlocks more borrowing power, the protocol is manufacturing its own solvency story.
  • Moola is the canonical borrow house token -> post it back -> move local market -> borrow stronger assets warning.
  • Healthy systems forbid or sharply constrain same-system reposting, correlated borrow pairs, and other loops that let internal credit support the same asset’s solvency mark.

6. Governance and launch events treated as risk events

  • Emission changes, unlocks, treasury campaigns, market listings, collateral-factor increases, and borrow-cap expansions on house assets should be treated like upgrades to the liquidation engine, not ordinary growth work.
  • Many house-asset incidents arrive after governance normalized the dangerous premise first.
  • Event windows should default to tighter caps, slower settlement, and more monitoring rather than assuming that elevated local demand proves durable collateral quality.

7. House-asset constitutional power kept out of incident cleanup

  • If the exploited asset is also the governance token, an attacker can spill from solvency manipulation into influence over the cleanup path itself.
  • Mango and Fortress both preserve the lesson that balance-sheet exposure and constitutional exposure should be analyzed together.
  • Healthy design therefore pairs house-asset collateral limits with vote-neutrality, treasury backstop rules, and emergency response lanes that do not depend on attacker-retained governance weight.

What sound design looks like

  • House assets begin outside the ordinary solvency core.
    • They may be visible, tradable, incentivized, or even marginable without being allowed to underwrite deep reserve withdrawals on normal terms.
  • Collateral authority is earned from external exit depth.
    • The protocol sizes collateral credit from stressed executable liquidity on venues that remain meaningful after the narrative breaks, not from local enthusiasm while the narrative is still intact.
  • Reserve-outflow limits survive oracle correctness.
    • Even a technically fresh price does not let one house-asset market empty unrelated reserve pools in one episode.
  • Paper gains on house assets do not instantly become cash.
    • Perp PnL, unrealized gains, or same-window repricings face settlement distrust until the venue can show those gains are economically realizable.
  • Recursive self-support loops are closed by design.
    • Borrowing the house asset, reposting it, or using one local venue to validate another is treated as a solvency hazard rather than a product-growth feature.
  • Governance and solvency controls are bundled.
    • Changes to collateral factor, borrow caps, oracle composition, treasury support, or settlement rules for house assets are reviewed as one balance-sheet authority package.
  • Cleanup does not depend on attacker-held governance weight.
    • Emergency powers, insurance, and pause paths should still work even if the attacker retains the exploited house asset.

Failure-prevention checklist

  • Put governance tokens, incentive tokens, house stablecoins, treasury wrappers, and ecosystem-local synthetic assets into a dedicated collateral-policy lane with stricter defaults than external collateral.
  • Size house-asset collateral factors and debt ceilings from stressed executable unwind depth on external venues, not from market-cap narratives, recent momentum, or governance enthusiasm.
  • Add reserve-outflow caps specific to each house asset so a local repricing cannot drain unrelated BTC, ETH, SOL, CELO, or stablecoin reserves in one window.
  • Separate house-asset mark publication from immediate reserve-spend authority: same-window gains, SettlePnl, or newly updated collateral values should face haircuts, delays, or capped withdrawals.
  • Ban or heavily constrain recursive loops where the protocol can lend the house asset, price the house asset, and then accept the same asset back as collateral or margin support.
  • Treat collateral-factor increases, borrow-cap increases, oracle-source changes, launch events, and treasury-liquidity programs for house assets as upgrade-level change windows with temporary tighter limits.
  • Keep liquidation assumptions honest: if liquidators could not exit seized house-asset collateral near the credited value at stress size, the credited value is already too high.
  • Pair solvency controls with governance-neutrality controls when the house asset also carries voting power: incident response should not require attacker cooperation or treasury concessions merely because the attacker still controls votes.
  • Add monitoring specific to house assets: sudden price spikes on shallow venues, borrow-cap saturation, recursive self-borrow patterns, large PnL withdrawals tied to one local market, and governance concentration after solvency stress.
  • Document what objective conditions would graduate a house asset to looser policy, and what conditions automatically force it back into quarantine.

Audit prompts

  • Which listed assets here are really house assets once operator concentration, ecosystem-local liquidity, treasury support, and governance relevance are considered together?
  • How much of the quoted liquidity behind this asset survives after the protocol itself is stressed, and how does that compare with the amount of deep reserves the protocol would release against it?
  • Can a user borrow the house asset, move its trusted venue, settle resulting gains, and withdraw stronger assets before the market can prove those gains are realizable?
  • What exact state transition converts a higher house-asset mark into reserve outflow: direct borrowing, reduced margin requirement, SettlePnl, cross-margin equity, liquidation avoidance, or treasury redemption?
  • Which governance actions can silently loosen house-asset solvency without looking like explicit collateral changes: oracle swaps, shorter TWAPs, treasury market making, launch incentives, new margin pairs, or borrow-side route changes?
  • If the largest house-asset borrower defaulted after a violent reversal, where would liquidators actually source the exit liquidity and which reserves would the protocol lose first?
  • Do reserve-outflow caps remain binding even if the house-asset oracle is technically fresh but economically untrustworthy at crisis size?
  • Are there same-system recursive loops, correlated borrow pairs, or treasury-sponsored demand paths that let protocol-internal capital support the same asset’s solvency mark?
  • If the asset is also the governance token, what prevents the attacker from using retained voting power to influence settlement, treasury socialization, or claim waivers after the exploit?
  • What concrete telemetry would tell operators that the house asset has re-entered a danger state and must fall back into quarantine immediately?

Lessons that should already be standard

  • A protocol’s own token ecosystem does not count as independent collateral just because it has a live price feed.
  • Market-cap optics are not liquidation depth. If the protocol cannot actually sell the collateral at stress size, it should not lend as if it can.
  • House-asset PnL is not automatically cash. When the mark is local and thin, fast settlement is a reserve-withdrawal decision, not just a matching-engine detail.
  • Recursive self-support loops are solvency bugs in slow motion. If the system can lend the asset, mark the asset, and accept it back as collateral, it is writing its own credit narrative.
  • Governance changes on house-asset collateral deserve the same paranoia as upgrades to liquidation code.
  • Reserve-outflow caps are first-class controls, not mere afterthoughts for when the oracle fails.
  • If the exploited asset also controls governance, incident response design has already started before the exploit. Cleanup power must not depend on the attacker’s continued goodwill.
  • The healthy default for house assets is skepticism. Extraordinary external liquidity and intentionally conservative sizing are what earn them limited balance-sheet authority.

Useful positive design shapes

1. House-asset isolated mode with reserve-outflow budget

  • A house asset can remain listed but only inside an isolated solvency bucket with low debt ceilings and strict reserve-outflow caps.
  • The key move is to separate asset is visible from asset can reach the rest of the balance sheet at scale.
  • This is the simplest way to keep one local repricing from becoming systemwide bad debt.

2. Crisis-depth recalibration before every parameter increase

  • Before raising collateral factor, borrow cap, or withdrawable PnL limits, the protocol reruns a stressed liquidation-depth exercise against external venues.
  • The point is to make how would we exit this after a 60–90% narrative break? a required input to governance rather than a postmortem question.
  • This is the healthier opposite of the XVS is large enough now reasoning that repeatedly shows up before bad-debt events.

3. Delayed settlement lane for house-asset derivatives

  • Profits on house-asset perps or margin positions become withdrawable only after additional checks, time delay, or reduced haircut ladders.
  • The key design move is that a local mark change can update monitoring and margin state before it becomes permission to remove the venue’s best reserves.
  • This is the direct downstream-solvency fix for the Mango-style mark -> settle -> withdraw path.

4. Governance-neutral emergency response for house-asset stress

  • Emergency collateral disablement, borrow-cap reduction, and reserve protection do not depend on ordinary tokenholder voting from the exploited asset itself.
  • The useful design habit is to assume a house-asset exploit may also create governance concentration exactly when fast response is needed.
  • This keeps solvency containment from becoming a hostage negotiation with the attacker.

Negative exemplar cluster: what no house-asset quarantine looks like

  • Moola — borrowed MOO could be posted back as collateral while the same shallow MOO/CELO market defined borrow truth.
  • Mango — attacker-shaped MNGO-PERP gains became reserve-spend authority before the market could prove they were realizable.
  • Venus XVS — a large protocol-native token repriced faster than liquidations could unwind it, leaving bad debt once the narrative broke.
  • Fortress — governance first admitted the thin house token to the collateral set and then an unauthenticated oracle path monetized that decision.
  • Fuse VUSD — a protocol-adjacent stablecoin rode a manipulable oracle path into effectively unbounded borrow power against the rest of the pool.
  • Inverse INV — one thin governance-token checkpoint became real borrowing power against stronger reserves.
  • The common lesson is not just prices were manipulated. It is the protocol lent real reserves against a house asset as if external exit liquidity and local enthusiasm were the same thing.

How this note complements the exploit corpus

Internal linkages

Control surface

Graph View

Backlinks