Cowrie Research

recursive-borrow-suppression-for-fresh-collateral

15 min read

Recursive-Borrow Suppression for Fresh Collateral

  • Name: recursive-borrow suppression for fresh collateral
  • Category: solvency rollout reference / recursive-leverage containment note / wrapper-collateral quarantine companion
  • Summary: A fresh wrapper, vault-share, LP-token, or newly repriced collateral object can be dangerous even before its price is proven outright false. The first borrow it enables can reflexively fund more of the same exposure, more correlated collateral, or an attacker-controlled liquidation loop. Healthy systems therefore separate the protocol can locally print or read a mark, the protocol can publish or recognize that mark as bounded accounting truth, and only later that published mark may fund recursive leverage, correlated borrows, or self-liquidation monetization. This note exists to say more plainly how healthy systems keep early debt from reflexively funding more of the same mark instead of leaving Lodestar, Wise, Venus ZKsync wUSDM, ResupplyFi, and Raft to imply that lesson only through postmortems.
  • Why this note exists:
    • Many wrapper-collateral incidents are not just bad price admitted as collateral. They are bad or too-fresh price admitted as recursion fuel.
    • Lower collateral factors alone are often not enough if the first borrow can immediately buy, mint, loop, or liquidate back into the same fragile valuation surface.
    • The useful analytical question is often not was borrowing enabled? but what kinds of second-step balance-sheet expansion did the protocol still permit once the first borrow was live?

What this note means by recursive-borrow suppression

  • Fresh collateral means a newly repriced wrapper, vault share, LP token, rebasing receipt, capped-oracle output, or other collateral object whose local valuation path is still in a distrust window.
  • Recursive-borrow suppression means the protocol deliberately narrows what the first borrow against that collateral can do: no same-family loops, no correlated-borrow pairs, no self-liquidation profit path, no instant rehypothecation into more of the same risk object.
  • The design goal is not never allow leverage. It is a fresh collateral mark should not immediately finance more of itself before the protocol has proved the mark is economically trustworthy under live exits.

The three rollout questions reviewers should not collapse

  1. Local mark or wrapper-side observation
  • A wrapper, vault share, LP receipt, or capped-oracle path can output a number that is locally readable enough to inspect or monitor.
  • That is still weaker than saying the protocol has adopted the number as meaningful accounting, and much weaker than saying the borrow side may now trust it as recursion fuel.
  1. Protocol publication or bounded accounting recognition
  • The protocol may publish that mark into user balances, collateral dashboards, exchange-rate caches, or other bounded accounting views.
  • Even that stronger step is still not the same thing as this mark may now fund same-family debt, correlated borrows, or self-liquidation profit paths.
  1. Recursive debt and liquidation monetization authority
  • The strongest step is when the fresh mark can finance another copy of the same thesis, borrow the deepest cash-out asset, or power the exact liquidation route that monetizes the newly created insolvency.
  • This note exists to keep that third step explicit. published accounting truth was never automatically loopable balance-sheet authority.

The main downstream controls

1. Ban same-family borrow pairs during the distrust window

  • If the fresh collateral is a wrapper around USDM, GLP, cbETH, Pendle LP exposure, or another narrow underlying family, the first live window should usually forbid borrowing the same underlying family or the deepest cash-out assets against it.
  • The point is to stop new collateral value -> borrow liquid asset -> buy or mint more of the same fragile collateral -> repeat.
  • This matters for wrapper-rate attacks like Lodestar, Wise Lending, and Venus ZKsync wUSDM.

2. Disable immediate rehypothecation into sibling wrappers or loop venues

  • A protocol can cap direct borrowing and still lose if borrowed funds may immediately be routed into another receipt token, vault share, Pendle position, or AMM LP that points back to the same pricing surface.
  • Recursive-borrow suppression therefore includes what may the borrower do next inside the same protocol graph?, not just how much may they borrow once?
  • If a fresh collateral object can still fund more wrapper-on-wrapper exposure, the system has not really quarantined it.

3. Separate collateral recognition from self-liquidation profit paths

  • Fresh collateral should not immediately support the exact liquidation route an attacker would use to monetize their own manipulated mark.
  • The moment a new or fragile exchange rate can drive both borrowing power and a profitable attacker-controlled closeout, the protocol has turned its own safety discount into the payout rail.
  • This is the sharper downstream companion to Self-liquidation monetization in wrapper-collateral rollout contexts.

4. Count gross balance-sheet expansion, not only the first borrow

  • Protocols often think in terms of the initial debt cap, but recursive systems fail on the second and third use of that debt.
  • Exposure limits should ask how much total position growth can one fresh mark finance after looping, route reuse, or puppet-account recycling?, not just what is the first borrow amount?
  • A bounded initial borrow is not meaningful safety if it can be turned into larger synthetic collateral, larger liquidation rights, or more of the same share object one block later.

5. Use correlated-asset deny lists and exit-depth-aware borrow allowlists

  • The protocol should distinguish between borrowing anything and borrowing the exact assets that monetize this fragile mark fastest.
  • The correct question is usually not just is the collateral factor small? but which borrow pairs give the attacker deep exit liquidity or the ability to fund another copy of the same collateral thesis?
  • Fresh-collateral rollout is safer when the borrow side begins from a conservative allowlist rather than an optimistic market-wide default.

6. Fast asset-local unwind and pause paths

  • If recursive use of a fresh collateral path starts to look unsafe, operators need a narrow way to stop new borrowing, new collateral enablement, or new same-family loops without forcing a full protocol shutdown.
  • The important rollback question is not only can we pause the price feed? but can we freeze the recursive debt-growth path faster than bots can compound it?
  • Recursive leverage is often faster than governance and faster than collateral-factor edits if those edits do not also cut the dangerous borrow pairs.

What sound design looks like

  • Fresh collateral does not immediately fund more of itself.
    • The first live window blocks same-family and tightly correlated borrow pairs by default.
  • Observation, accounting recognition, and recursive leverage are separate permissions.
    • An asset can be locally readable, later published or haircutted as bounded accounting truth, and only after that become eligible for loopable debt.
  • Self-liquidation routes stay closed while trust is still being earned.
    • The protocol does not let one fragile mark both create the profitable insolvency and award the liquidation spread.
  • Exposure accounting follows looped balance-sheet growth, not only first-touch debt.
    • Risk controls ask how large the funded position can become after one or two protocol-native feedback loops.
  • Borrow allowlists reflect monetization reality.
    • The protocol cares which assets are easiest to dump into, bridge out, or recycle back into more of the same collateral object.
  • Rollback is faster than recursive compounding.
    • Operators can cut the dangerous borrow graph before a suspicious mark turns into protocol-wide debt.

Useful positive design shapes

1. Isolated collateral with broad-deny borrow defaults

  • The safest first live state is often asset may be supplied, but borrow pairs begin from a tiny explicit allowlist or none at all.
  • This is stricter than ordinary isolated mode because it assumes the real risk is not only market-wide contagion, but reflexive self-funding from the fresh mark itself.
  • It pairs naturally with collateral-admission-lag-and-borrow-side-quarantine.

2. Correlated-family and deep-exit deny lists

  • Protocols should explicitly block the assets that collapse the distance between fragile collateral and final payout: stablecoins, the wrapper’s own underlying family, route-adjacent LP receipts, or the exact assets used in self-liquidation.
  • The point is to deny the first fast monetization graph, not just to publish a smaller collateral factor.
  • This is especially important when a wrapper’s exchange rate can be printed locally faster than external markets can challenge it.

3. Liquidation distrust during fresh-collateral warmup

  • Liquidation permissions should lag fresh collateral recognition when the same fragile mark could otherwise be used for attacker-controlled self-liquidation.
  • A protocol gets meaningfully safer when it first proves the mark under observation and bounded debt before it lets that mark seize collateral at a discount.
  • This is the wrapper-rollout counterpart to the attack family preserved by self-liquidation-monetization.

4. Recursive leverage thawed in stages, not all at once

  • Borrow-side rights can widen gradually: first no borrowing, then non-correlated borrowing, then wider borrow pairs, then only later full recursive or E-Mode-like treatment once the collateral path has survived live observation.
  • The important design habit is that mark exists, mark is published as accounting truth, and mark may now fund aggressive looping are different state transitions.

Negative exemplar cluster: what no recursive-borrow suppression looks like

  • Lodestar — a donated plvGLP exchange-rate increase was not merely observable; it immediately financed real borrowing against deeper-liquidity assets.
  • Wise Lending — an attacker-printed Pendle LP share mark could immediately support borrowing through puppet accounts instead of hitting a recursive distrust boundary first.
  • Venus ZKsync wUSDM — a thin wrapper’s local exchange-rate inflation controlled both borrowing power and later self-liquidation math before the protocol meaningfully constrained same-thesis monetization.
  • ResupplyFi — a near-empty vault mark was admitted as immediate borrowing truth instead of entering a state where recursive debt creation and cash-out routes were structurally impossible.
  • Raft Finance — a collateral-index path driven by donation-sensitive local state became direct stablecoin issuance authority instead of first proving that the mark could not reflexively finance more bad balance-sheet expansion.
  • The common lesson is not only collateral was priced badly. It is the first fresh mark was allowed to finance its own monetization path.

Red flags that usually mean the recursive boundary is underdesigned

  • The collateral factor is low, so looping risk is acceptable
  • Isolation mode is enough when the isolated market still lets the attacker borrow the exact cash-out asset they need
  • We can widen borrow pairs later even though dangerous pairs are already open by default on day one
  • Self-liquidation is only a later concern when the same fresh mark already controls liquidation eligibility
  • The wrapper rate is canonical, so borrowing the underlying is fine
  • We only need to cap initial debt when one borrowed stablecoin can immediately buy or mint more of the same collateral story
  • The collateral is just a safer wrapper around a blue-chip asset used as if wrapper-local exchange-rate manipulation and deep-exit routing were not their own risk surface

Design questions worth asking first

  • Which borrow pairs most directly monetize this fresh collateral mark into deep-exit assets or more of the same exposure?
  • Could the first borrow buy, mint, or route into another wrapper, LP receipt, or position that points back to the same fragile valuation surface?
  • During the first live window, can the borrower self-liquidate or use puppet accounts to capture the protocol’s own closeout discount?
  • Are the protocol’s debt caps measuring only first-touch borrowing, or the larger recursive position those borrows can finance one or two steps later?
  • What exact asset-local pause can stop new recursive debt growth without freezing unrelated markets?
  • What observation period or trust-building event must happen before recursive leverage rights widen?

Failure-prevention checklist

  • Default fresh collateral to no recursive borrow rights until the protocol explicitly proves otherwise. Mark observed, mark published as bounded accounting truth, and may finance correlated leverage should be separate permissions.
  • Start from a conservative borrow allowlist rather than a broad denylist. If a fresh mark needs time to earn trust, the first enabled borrow pairs should be the ones least useful for self-funding the same thesis or extracting deep liquidity.
  • Block same-family, tightly correlated, and route-adjacent assets during the distrust window: underlying asset, wrapper siblings, LP legs, Pendle-style adjacent claims, and the exact stablecoins or majors that make the fastest unwind path.
  • Keep liquidation monetization closed while the collateral mark is still fresh. If the same actor can print the mark, borrow against it, and then capture liquidation spread on the unwind, the protocol has not really quarantined the asset.
  • Measure recursive blast radius, not only first-touch debt. Caps, isolation rules, and exposure checks should model one or two protocol-native loop steps, puppet-account reuse, and same-block route recycling.
  • Require a stronger graduation event than price feed looks stable or the wrapper already published the new rate: exit-depth observation, supply breadth, borrow diversity, liquidity floor checks, and wrapper-share accounting sanity should all improve before correlated borrow pairs widen.
  • Keep asset-local pause controls narrower and faster than full-protocol shutdowns: freeze new collateral enables, freeze new borrows against the asset, cut correlated borrow pairs, and disable self-liquidation routes quickly when fresh-collateral behavior looks suspicious.
  • Apply the same suppression logic to repaired or recapitalized collateral objects, not only newly listed ones. A wrapper emerging from recovery is still a fresh solvency object from the borrow-side graph’s point of view.
  • Test recursive paths adversarially: borrow underlying, mint more wrapper, post that wrapper again, route into sibling adapters, use puppet accounts, and attempt self-liquidation or closeout capture within the same funding loop.
  • Keep monitoring tied to action. Alerts for sudden growth in one collateral family’s debt usage, rapid correlated-borrow concentration, or same-address loop patterns should trigger authority reduction fast enough to matter.

Audit prompts

  • Which enabled borrow pairs turn this collateral mark into the fastest path to deep-exit assets, stablecoins, or more of the same wrapper exposure?
  • Can one borrowed asset be transformed inside the protocol or a standard integration route into another copy of the same collateral thesis before risk controls re-evaluate the account?
  • What exact controls prevent self-liquidation, puppet-account liquidation, or discount capture while the collateral is still in its distrust window?
  • Are caps and isolation rules computed on gross recursive exposure, or only on the first debt position before that debt is looped into fresh collateral?
  • Which routes are considered correlated for this asset family, and is that classification encoded anywhere other than team intuition?
  • What precise event graduates the asset from observable, to published as bounded accounting truth, to fully recursive collateral, and why is each step economically meaningful rather than merely operationally convenient?
  • If the collateral is repaired, migrated, or reactivated after dormancy, does the protocol automatically re-enter recursive-borrow suppression, or does it silently inherit prior permissions?
  • Can a liquidator, router, or keeper use standard protocol flows to convert the fresh mark’s local valuation into protocol-paid liquidation profit before humans can intervene?
  • What asset-local emergency control cuts the dangerous borrow graph fastest, and has that path been tested under live market conditions?
  • If operators were offline for one hour after this collateral path went live, what existing settings would still stop the first bad mark from financing a larger recursive position?

Lessons that should already be standard

  • Fresh collateral should earn recursive rights later than it earns basic visibility and later than it earns bounded accounting recognition. The first safe states are usually you may observe it and later you may post it in a bounded way, not you may lever it immediately.
  • Low collateral factors do not solve recursive design mistakes by themselves. If the enabled borrow pair is the exact monetization rail the attacker needs, a haircut is often just a smaller launch subsidy.
  • Same-family borrow bans are not product friction; they are how a protocol proves it understands what the collateral actually is.
  • Self-liquidation should be treated as part of rollout policy, not only as a downstream liquidation-engine concern. If the attacker can both create and monetize the insolvency, the quarantine failed.
  • Borrow-side graphs deserve the same freshness logic as collateral admission. A repaired, repriced, or newly listed wrapper can be locally valid while still being globally too fragile to finance loops.
  • Recursive risk is route-shaped, not only asset-shaped. The dangerous question is often what can borrowed funds become in one more hop?, not merely what token was borrowed first?
  • Emergency controls matter only if they are narrower and faster than the feedback loop. A full governance process is not meaningful recursive-borrow suppression when the exploit composes in minutes.

How this note complements the exploit corpus

  • Start here when the design question is how should a protocol stop a fresh collateral mark, even after it is already locally visible or protocol-published, from immediately financing more of the same risk?
  • Use collateral-admission-lag-and-borrow-side-quarantine when the broader question is whether a fresh wrapper price should have immediate collateral or liquidation authority at all.
  • Pair with vault-share-truth-security-object when the upstream problem is that the collateral object itself is a donation-sensitive, low-supply, presentation-sensitive, or wrapper-priced share system.
  • Pair with reward-recognition-presentation-and-collateral-separation when the sharper upstream question is how reward-sync, cached-NAV, rebasing, or other wrapper-local repricing crossed too quickly into user-visible or collateral-admissible value before recursive loops were even considered.
  • Pair with self-liquidation-monetization when the sharper question becomes why the attacker was also allowed to capture the liquidation side of the insolvency they just created.
  • Drop into donation-share-price-manipulation or empty-market-exchange-rate-inflation when the fresh collateral mark was itself printed through donation or tiny-supply share math.
  • Compare against protocol-native-collateral-fragility when the deeper issue is not fresh wrapper rollout, but that the protocol lent against its own thin or reflexive house asset.

Internal linkages

Control surface

Graph View

Backlinks