Cowrie Research

internal-mark-publication-quarantine-and-reserve-spend-separation

18 min read

Internal-Mark Publication Quarantine and Reserve-Spend Separation

  • Name: internal-mark publication quarantine and reserve-spend separation
  • Category: oracle-safety reference / internal-mark governance note / protocol-authored valuation checklist
  • Summary: Some systems do not get rugged because an external oracle lied first. They get rugged because the protocol itself publishes a manipulable local mark, cache, quote, basket estimate, mark-to-market gain, or treasury-guidance variable and then spends reserves against it before that number proves durable, realizable, or even semantically coherent. The review habit this note tries to preserve is that local state moved, the protocol published one economic interpretation of that state, and downstream code may now spend reserves against that interpretation are three different promotions, not one generic the mark updated event. Protocol-authored marks may be observed and even published, but they should not become immediate reserve authority until a separate control layer proves they deserve it.

Why this note exists

  • A recurring family of exploits is not well described by use a better oracle alone. The sharper failure is the protocol hardened its own local state into a money-moving mark and let another path consume it immediately.
  • Indexed Finance, OneRing, Jimbo’s, MonoX, WOOFi, PancakeBunny, Makina, Mango, Hyperliquid JELLY, xToken xSNXa, Nirvana Finance ANA, Zunami, and Balancer STA all preserve the same design-side lesson: local market-state publication and downstream reserve spend must not be the same trust event, even when the published mark is a cached strategy NAV, a helper-priced reward conversion, an internally settled perp PnL claim, a venue-authored emergency mark, a protocol-native treasury quote, a protocol-authored wrapper issue price inferred from the attacker’s own just-shaped execution rather than from an independent solvency boundary, or a public reserve-sync helper that hardens dust-state custody reality into immediately spendable pricing truth.
  • This note is the healthy-side companion when the exploit taxonomy already tells you which protocol-authored mark failed, but the next question is how the system should have staged observation, publication, and reserve authority so one attacker-shaped local state print could not immediately cash out real assets.

What this note means by publication quarantine and reserve-spend separation

  • Internal-mark publication means a protocol records or exposes a locally computed value such as basket NAV, reserve ratio, quote slot, cached rate, active-bin guidance, strategy AUM, internal mark-to-market PnL, or initialization threshold.
  • Publication quarantine means that newly published mark is not yet allowed to mint debt, authorize treasury movement, unlock redemptions, or become liquidation truth at full size.
  • Reserve-spend separation means a later consumer must re-check bounds, realizability, freshness, provenance, and activation state before treating the published mark as authority to move money.
  • In derivatives systems, this includes refusing to let a freshly printed internal mark or newly settled PnL claim outrun the venue’s ability to prove executable depth, unwindability, and reserve-outflow safety.
  • The design goal is not never compute internal marks. It is do not let attacker-shapeable local state become immediate reserve authority just because the protocol itself wrote it down.

Three promotions healthy internal-mark systems should not collapse

  1. What local state actually changed?
  • This is the observation question.
  • A strategy balance moved, one active bin changed, one quote slot updated, one internal settlement printed PnL, one reserve ratio widened, or one basket component got perturbed.
  • At this stage the protocol has evidence about local state, not yet a money-good claim about realizable reserve value.
  1. What exact economic meaning did the protocol publish for that state?
  • This is the publication question.
  • The system may now expose a NAV, issue price, cached share price, internal mark, treasury-guidance variable, liquidatable equity figure, or withdrawable-looking PnL credit.
  • That publication is already a policy choice about interpretation, but it is still not the same thing as permission to move reserves.
  1. Which downstream consumers may spend against that publication, and how much?
  • This is the reserve-authority question.
  • Borrow, mint, redeem, settle, liquidate, rebalance, or treasury-outflow paths should still prove that the published mark is mature, bounded, realizable, and active for this exact consumer.
  • If the protocol lets one function or one transaction answer all three questions at once, it has usually collapsed observability, interpretation, and reserve authority into one unsafe privilege.

The main downstream-solvency controls

1. Separate observation, publication, and spend into three distinct states

  • A controller, helper, or cache writer may observe local state.
  • The protocol may publish that observation for monitoring, UX, or staged policy.
  • A separate gate should decide whether the published mark is mature enough to spend against.
  • If one function or one transaction can do all three, the system is usually over-trusting its own local state.

2. Treat protocol-authored marks as claims about realizable value, not facts by default

  • A local mark should have to prove what it means: full-basket value, executable unwind value, bounded treasury-guidance delta, mark-to-market PnL that can actually be socialized safely, or a narrower advisory-only estimate.
  • Partial-basket extrapolations, same-path reserve reads, active-bin pointers, self-authored quote slots, and house-asset perp profits should begin life as low-trust estimates, not as canonical reserve authority.

3. Delay or stage fresh internal marks before full money movement

  • Same-block publication should not automatically enable same-block mint, borrow, redemption, liquidation, or treasury rotation at size.
  • A protocol can let fresh marks influence dashboards, canaries, shadow accounting, or tiny bounded actions before it lets them control large reserve spend.
  • This timing break is what stops manipulate -> publish -> monetize -> normalize from being a single atomic exploit path.

4. Require consumer-side checks, not only publisher-side promises

  • Reserve-paying consumers should independently ask whether the mark is fresh, bounded, activation-approved, and economically realizable.
  • The dangerous design smell is the publisher already handled that, because exploit families in this area usually live in the seam between publisher and consumer.
  • Good consumers can cap movement, reject immature marks, or route into degraded mode even when the publisher technically succeeded.

5. Keep partial-state marks advisory until a stronger aggregation step clears them

  • First-initialized constituent balances, current active bins, instantaneous reserve ratios, single-slot quotes, same-path strategy balance views, and freshly settled local PnL claims should not receive full balance-sheet power.
  • If a protocol needs them for responsiveness, it should still run a slower or broader confirmation layer before they gain treasury, collateral, redemption, or withdrawal authority.
  • The stronger layer might be delayed snapshots, broader basket valuation, depth-aware sanity bounds, settlement haircuts, withdrawal queues, or explicit governance / keeper confirmation.

6. Bound one-step reserve authority from locally authored moves

  • Even after publication, one update should not be able to move treasury guidance, mint authority, or redemption value by unbounded multiples.
  • Per-update caps, depth-aware clamps, growth ceilings, or shadow-vs-live divergence limits keep one bad local-state print from becoming protocol-wide insolvency.
  • When the protocol cannot explain why an internal mark moved dramatically, the correct default is to spend less or spend nothing.

7. Make degraded mode honest and asset-local

  • If the protocol loses confidence in an internal mark, it should be able to freeze fresh borrowing, narrow treasury actions, pause redemptions, isolate one asset, or route into a shadow-only state without halting unrelated systems.
  • Internal-mark incidents often become protocol-wide because the only available response is broad shutdown after the reserve-paying path has already consumed the bad mark.

8. Treat protocol-native treasury loops as internal-mark systems too

  • A protocol does not escape internal-mark risk just because it authors both sides of the loop. If the same machine computes the buy quote, updates the displayed reserve ratio or native-asset mark, and then pays treasury assets back out, the buy-side quote is still only a freshly published internal interpretation of local state.
  • Healthy reserve-backed native-asset designs keep user paid in, protocol published a richer native-asset mark, and treasury may now honor exits against that richer mark as separate promotions rather than one atomic round trip.
  • The practical rule is harsh: if a protocol-native asset can be bought through one locally authored quote path and sold into treasury through another, the sell-side path should behave as if it were consuming an external oracle published one block ago by an adversarial-but-authenticated source.
  • Nirvana Finance ANA is the clean preserved treasury-side exemplar. The protocol’s own buy path undercharged ANA, the same trade pushed the protocol’s ANA mark upward, and treasury reserves still honored the resulting ANA exits. That is not outside-oracle failure; it is internal publication and reserve-spend separation failing inside one reserve-backed loop.
  • When this is the sharper design question, pair this note with reserve-backed-claim-truth-security-object so the protocol keeps one bounded round-trip claim object from issuance through treasury payout instead of letting local publication outrun reserve truth.

What sound design looks like

  • Local marks are typed by authority level. The protocol distinguishes observed, published, shadow-valid, spend-valid, and degraded states instead of treating every written number as equally authoritative.
  • Publication is reversible; reserve spend is harder to reach. A protocol can tolerate writing down a suspicious mark if downstream reserve-moving paths still require stronger checks.
  • Consumer trust is narrower than producer capability. The component that can compute or cache a mark is not automatically the component allowed to monetize it.
  • Partial-state views stay clearly partial. Controllers, quote helpers, freshly settled PnL ledgers, and initialization thresholds are labeled and enforced as advisory unless they pass a stronger realizability and timing gate.
  • Large internal-mark moves fail narrower, not looser. The more a locally authored mark deviates from stable expectations, the less reserve authority it should receive until the protocol understands why.
  • One manipulated local print cannot outrun the response path. The system has enough delay, caps, and asset-local rollback to keep reserve spend slower than attacker-authored state publication.

Failure-prevention checklist

  • Enumerate every protocol-authored value that downstream code can spend against: NAV helpers, cached rates, internal quotes, reserve-ratio marks, active-bin pointers, strategy AUM, freshly settled PnL credits, initialization thresholds, or treasury guidance variables.
  • For each one, write down three separate questions: who can change the underlying local state, who can publish one economic interpretation of it, and which exact consumer can monetize that publication.
  • Classify each mark by authority level: informational only, shadow accounting, bounded spend, or full reserve authority.
  • Require a distinct activation condition before a freshly published mark graduates into money-moving authority.
  • Put hard caps on how much one internal-mark update can change minting, borrowing, redemption, liquidation, or treasury deployment rights.
  • Force reserve-paying consumers to verify freshness, maturity, bounds, and provenance rather than trusting any protocol-authored mark blindly.
  • Keep partial-basket, partial-liquidity, or microstructure-derived marks advisory until a slower or broader confirmation path clears them.
  • Add a kill-switch or narrow degraded mode per affected asset / controller / pool so suspicious internal-mark behavior can be isolated before deeper reserves are touched.
  • For derivatives venues, separate mark published, PnL recognized, and reserve-withdrawable states. A venue should be able to freeze one without pretending the others never happened.
  • Test atomic bundles that do move local state -> publish mark -> consume mark -> restore state; if they still pay, the publication boundary is too weak.
  • Monitor divergence between internal marks and slower realizability checks, especially when publication and reserve consumption happen in the same block.

Audit prompts

  • Which exact protocol-authored marks can directly or indirectly move money today?
  • Which internal accounting edges turn quoted gains or locally settled PnL into assets a user can actually withdraw?
  • Can the same actor or same transaction perturb local state, publish the resulting mark, and consume it before any independent check runs?
  • What does this mark actually mean: executable unwind value, advisory routing hint, partial-state estimate, or full reserve authority?
  • Which downstream consumers trust the mark, and do they independently enforce maturity, bounds, and realizability?
  • If the mark moved 3x or 10x in one block, what explicit gate would stop treasury movement, borrowing, minting, liquidation, or redemption?
  • Does the protocol distinguish published from spend-valid, or is every written number implicitly canonical?
  • What local-state components can poison the mark: one constituent balance, one active bin, one quote slot, one cache write, one updater, or one strategy-side helper?
  • Can operators quarantine the affected asset or controller faster than the attacker can recycle the mark into deeper reserves?
  • When monitors fire on internal-mark anomalies, can responders tell whether the problem is publisher logic, upstream local-state manipulation, or an over-trusting consumer?

Lessons that should already be standard

  • A protocol writing the number down does not prove the number deserves reserve authority.
  • Internal marks need lifecycle states, not just storage slots.
  • SettlePnl is a publication step unless the venue has separately proved the gains are durable enough to become reserve-outflow authority.
  • Published and safe to spend against are different claims and should usually become true at different times.
  • Consumer-side skepticism matters more when the producer and consumer live in the same codebase, not less.
  • Partial-state views are useful operationally and dangerous economically; the mistake is letting them skip straight from observability into solvency.
  • Same-transaction publication and monetization is usually a design choice, not an unavoidable property.
  • The sharp design question is not just can this mark be manipulated? but what exactly stops manipulation from becoming immediate reserve spend?

Useful positive design shapes

1. Shadow publication before live reserve authority

  • The protocol records and displays the internal mark immediately, but live borrowing, minting, or treasury movement continues to rely on an older or more conservative authority path until the new mark ages or clears confirmation.

2. Bounded-consumer envelopes

  • Downstream reserve-paying paths consume the mark through a typed envelope that includes activation state, freshness window, movement cap, and provenance metadata, rather than reading a naked storage slot and assuming it is canonical.

3. Dual-lane internal pricing

  • A fast internal mark exists for routing or canarying, while a slower realizability lane controls reserve authority. The useful discipline is not speed vs slowness alone; it is refusing to let the fast lane spend like the slow lane.

4. Asset-local degraded mode

  • If one internal mark becomes suspicious, only the affected pool, wrapper, controller, or treasury branch narrows authority while unrelated assets keep operating.

Negative exemplar cluster: what underdesigned internal-mark systems look like

  • Indexed Finance — partial-basket state was hardened into new-token initialization and mint / burn authority too quickly.
  • OneRing — reserve-shaped local state was published and redeemed against in the same economic window.
  • Jimbo’s — local microstructure pointers became treasury deployment authority without a stronger policy layer.
  • MonoX — a protocol-authored quote path overwrote its own internal truth and sibling pools spent against it.
  • WOOFi — one oversized trade published a pathological internal price and the next swap immediately monetized it.
  • PancakeBunny — a dust-sized real fee entitlement entered a minter path that adopted attacker-shaped LP inventory and reserve state, then published a fake BNB-denominated contribution large enough to mint transferable BUNNY.
  • xToken xSNXa — the fund’s own mint path hardened attacker-shaped routed execution into issue-side NAV, then let the resulting wrapper supply cash out against firmer redemption and Balancer exit rails.
  • Balancer STA — the pool’s nominal-versus-actual reserve drift only became maximally spendable once gulp() republished the attacker-driven dust balance as canonical spot-price truth for the next reserve-paying swap.
  • Nirvana Finance ANA — the protocol’s own treasury loop is the useful cross-branch reminder that a native-asset buy quote is still just a freshly published internal mark until a separate reserve-paying boundary decides whether treasury assets should honor it.
  • Mango — venue-authored SettlePnl credit turned an attacker-shaped MNGO mark into withdrawable reserve authority before the quoted gain had to prove real exit depth.
  • Hyperliquid JELLY — emergency mark handling and internal liquidation / settlement logic sat close enough to reserve authority that a reflexive local mark could threaten the venue balance sheet before operators overrode it.
  • Makina and KiloEx — permissionless or weakly authenticated publication paths turned internal marks into direct reserve authority.
  • Zunami — a public cache write let attacker-shaped strategy value jump from observation into canonical _assetPriceCached, then expand balanceOf, totalSupply, and allowance before the manipulated state had to prove it was durable or economically realizable.

Control-surface review map

1. Mark authoring surface

  • Which exact component can transform local state into a new mark: quote model, cache writer, settlement helper, AUM updater, liquidation engine, emergency override, or keeper path?
  • What attacker-shapeable inputs reach that authoring step: current reserves, active-bin pointers, partial basket balances, local order-book depth, one constituent price, or one authenticated-but-cheap updater message?
  • Can one actor cheaply create the same state the author thinks is only an informational estimate? If yes, the mark is already adversarially writable even before it is consumed.

2. Publication and activation surface

  • Where does the mark cross from written somewhere into recognized by policy? Healthy systems make this a separate gate with freshness, bounds, quorum, or delay semantics instead of letting storage write equal activation.
  • Ask whether the activation object is explicit: shadow/live flag, delayed snapshot, bounded envelope, capped settlement lane, or governance / keeper approval. If there is no explicit activation surface, the design is probably collapsing publication into authority.
  • Review the same-block path specifically: can a fresh local mark become active before any independent bound, realizability check, or delayed consumer window has a chance to run?

3. Reserve-spend consumer surface

  • Which downstream functions actually monetize the mark: mint, borrow, redeem, settle PnL, rebalance treasury inventory, liquidate, unwrap, or pay out insurance / vault exits?
  • Do those consumers read the mark directly, or through a typed envelope that still carries maturity, bound, and provenance data? A naked storage read is usually the smell that publication and spend were never really separated.
  • Consumer reviews should ask what if the publisher was technically honest but economically wrong for one block? If the answer is still full-size reserve movement succeeds, the consumer is over-trusting publication.

4. Degraded-mode and rollback surface

  • Which component can narrow authority when the internal mark looks suspicious: per-asset pause, cap clamp, delayed activation only, shadow-only mode, or settlement haircut?
  • Can responders roll one asset or one controller back to a last-known-safe mark without pretending the fresh local observation never happened? If not, the protocol may be forced into all-or-nothing shutdown after the mark was already monetized.
  • The important operational question is whether the system can fail narrower than the authoring surface. If a broken quote helper can instantly become a venue-wide reserve emergency, the rollback surface is too coarse.

Design questions worth asking first

  • Which protocol-authored numbers are allowed to move money, and why do they deserve that authority?
  • What exact component authors the mark, what separate gate activates it, and which downstream consumers are actually allowed to spend against it?
  • What explicit step turns a fresh internal mark from observed into spend-valid?
  • What explicit step turns freshly settled PnL from accounting update into withdrawable claim on reserves?
  • How much reserve authority can one local-state update create before humans or automation can intervene?
  • If the published mark is wrong but only for one block, what still stops loss from being permanent?
  • Does the protocol know which components are publishers, which are activators, which are consumers, and which are supposed to be only observers?

How this note complements the exploit corpus

Internal linkages

Control surface

Graph View

Backlinks