Cowrie Research

utilization-domain-enforcement-and-supercritical-rate-quarantine

12 min read

Utilization-Domain Enforcement and Supercritical-Rate Quarantine

  • Name: utilization-domain enforcement and supercritical-rate quarantine
  • Category: lending-reserve design reference / interest-model domain discipline / out-of-range utilization containment / collateral-publication quarantine
  • Summary: Healthy lending markets do not merely hope utilization stays inside the interest model’s intended range. They prove or enforce the denominator that keeps utilization meaningful, and they separately make sure that if an out-of-domain state still appears, the protocol degrades toward bounded accounting, treasury routing, pause, or quarantine instead of turning utilization > 100% into borrower-visible or depositor-visible money. This note exists to preserve the positive-design lesson behind Silo’s WETH near miss and the broader utilization-boundary failure family: a protocol needs two different defenses — one that keeps the rate model inside its intended economic domain, and another that stops any accidental supercritical output from becoming immediate collateral or reserve truth.

Why this note exists

  • borrowable-liquidity-and-deposit-ledger-coherence-discipline preserves the upstream reserve-ledger lesson: borrowable liquidity, booked deposits, and utilization inputs should stay on one coherent reserve story.
  • unexpected-balance-quarantine-and-explicit-recognition-discipline preserves the earlier boundary that raw inventory and off-path balances should not become economically active reserve state by accident.
  • But lending systems also need one sharper note for the next failure boundary: what should happen if utilization still leaves the model’s intended domain anyway?
  • Silo Finance WETH donated-liquidity utilization inflation near miss is the clean negative exemplar. Direct WETH donation widened borrowable liquidity without widening booked deposits; once a second account borrowed the donated WETH, the next accrual step saw totalBorrowAmount > totalDeposits, utilization moved above 100%, and the interest model’s output became a collateral-printing event.
  • The reusable healthy-side question is therefore not only how do we keep reserve ledgers coherent? It is also: if the impossible state still appears, what exact clamps, routing rules, or publication delays keep the rate model from becoming a solvency oracle for fake value?

Core claim

Interest-model domain assumptions are part of the solvency boundary.

A lending protocol that says utilization will never exceed the documented range has already made a security claim. Healthy design does two things explicitly:

  1. it keeps the utilization denominator and borrow ledger coherent enough that the out-of-range state is difficult or impossible to reach, and
  2. it makes any out-of-range observation economically weaker than live depositor yield, live collateral repricing, or live borrow authority.

The dangerous collapse is out-of-domain state observed -> rate model produced a number -> that number was immediately capitalized into depositor or collateral truth.

Four states healthy systems should keep distinct

  1. Configured model domain

    • The intended utilization range, kink geometry, fallback branch, and maximum economically meaningful rate behavior.
    • This answers what region was the model designed and reviewed to operate in?

  2. Observed reserve state

    • The real market state the protocol is currently seeing: deposits, borrows, recognized reserve inventory, and the utilization fraction derived from them.
    • This answers what denominator and numerator are actually live right now?

  3. Rate-output publication state

    • The protocol’s decision about whether an observed utilization value should produce a canonical interest output at all, and if so whether that output is clamped, bounded, rerouted, delayed, or merely logged for operators.
    • This answers does the model get to publish an economically active answer for this state?

  4. Collateral / depositor admission state

    • The protocol’s decision about whether the produced rate output may already change depositor share value, supplier index, collateral headroom, liquidation status, or cross-market borrow power.
    • This answers even if the model returned something, who is allowed to spend against it already?

Three promotions reviewers should not collapse

  1. The reserve observed an out-of-range utilization state

    • Something made the numerator and denominator inconsistent enough that the computed utilization exceeded the intended domain.
    • This is already serious, but it is still only an observation about reserve state.

  2. The protocol treated that observation as valid rate-publication input

    • The interest model or accrual path still produced a live economically meaningful rate from the out-of-range utilization value.
    • This is a stronger claim than merely observing the bad state. It says the model is willing to author new accounting truth from it.

  3. That published rate output still carried depositor or collateral authority

    • Depositor-share value, accrued interest, collateral headroom, reserve index growth, or sibling-market borrowing still honored the output as money-good.
    • This is the costly final promotion: the protocol did not only misobserve the reserve; it let the resulting supercritical rate become spendable solvency truth.

What sound design looks like

1. Utilization-domain invariants are explicit and monitored

  • The protocol names the intended relationship between borrow amount, recognized deposits, reserve inventory, and model input domain.
  • A healthy system can state and test invariants such as:
    • totalBorrowAmount <= totalDeposits, or the precise stronger relation the design actually intends
    • borrowable liquidity cannot exceed the recognized reserve inventory that the deposits denominator and utilization math trust
    • utilization-sensitive rate publication remains bounded even if the first invariant is violated
  • This is the upstream coherence companion to borrowable-liquidity-and-deposit-ledger-coherence-discipline.

2. The out-of-domain state fails closed before it becomes economics

  • If utilization still exceeds the intended domain, the protocol does not behave as though it discovered a real market-clearing rate.
  • Healthy fallback behavior usually looks like pause, capped-rate accrual, treasury routing, frozen collateral growth, stale-mark retention, or other bounded degradation — not let the curve improvise and capitalize the result into user value.
  • A good design answer is often this state is diagnostic, not monetizable.

3. Rate output is weaker than collateral publication

  • Even if some bounded fallback rate is published for local accounting continuity, that output should still be weaker than immediate collateral or cross-market borrow truth.
  • Depositor accrual, supplier share value, and collateral headroom deserve their own slower or stricter admission rule when the reserve recently passed through an impossible state.
  • The downstream trust companion is reward-recognition-presentation-and-collateral-separation when paper yield or rate output is the thing being over-promoted, and collateral-admission-lag-and-borrow-side-quarantine when the sharper question is why the rest of the lending stack still had to trust it immediately.

4. Supercritical states should route into containment, not yield socialization

  • If a reserve hits utilization > 100%, the next value flow should usually favor containment: freeze the affected side, quarantine collateral, route excess or ambiguous interest to treasury / bad-debt accounting, or require explicit recovery.
  • It should not automatically become depositor-owned value, supplier-index growth, or new borrow capacity.
  • This is especially important in thin markets where one actor may still own most meaningful deposit-share state.

5. Thin markets and impossible rate states compound each other

  • Empty or dust-dominated markets make any rate-model domain failure economically violent because one actor can own nearly all of the next interest or share-price update.
  • A healthy system therefore treats thin market and out-of-domain rate state as mutually reinforcing reasons to narrow power, not as separate concerns.
  • The closest thin-market admission companion is collateral-admission-lag-and-borrow-side-quarantine.

6. Recovery should be explicit after impossible-state observation

  • Once a reserve has passed through a supercritical utilization state, healthy design should re-enter normal operation deliberately: reseed, recapitalize, re-recognize inventory, or clear stale debt before ordinary collateral and borrowing powers return.
  • The closest lifecycle companion is low-supply-recovery-and-recapitalization-discipline.

Useful positive design shapes

1. Two-layer containment: denominator guard plus output clamp

  • First guard: stop the reserve from reaching the impossible state through coherent ledgers and borrow/deposit invariants.
  • Second guard: if the impossible state still appears, bound or quarantine the rate output so it cannot become a value printer.
  • Many systems have one guard in theory and neither in production.

2. Diagnostic rate path separate from economic rate path

  • A useful design is to let observability continue while economics narrow.
  • The protocol may still log, surface, or store the out-of-range utilization observation while refusing to let it drive depositor yield, supplier index growth, or collateral-value changes.
  • We saw the bad state should not mean we let the bad state price user balances.

3. Treasury-routing or non-user-owned accrual for ambiguous interest

  • If the protocol cannot fully trust the economic meaning of a supercritical-rate event, any resulting accrual should land in a quarantine bucket, treasury buffer, or bad-debt accounting lane rather than directly in user-owned depositor value.
  • This keeps continuity without turning diagnostic output into attacker-owned collateral.

4. Post-incident collateral quarantine

  • Markets that recently passed through out-of-domain utilization should often keep borrowing, recursive collateral use, or cross-market collateral authority disabled until operators or code can prove the reserve is coherent again.
  • Accrual resumed is not the same thing as collateral trust fully restored.

5. Multi-account, multi-block impossible-state testing

  • The clean exploit path often spans more than one identity or one block: one account manufactures the denominator split, another account borrows, and a later accrual step harvests the supercritical-rate output.
  • Good testing should preserve the temporal shape of the exploit, not only single-call traces.

Design questions worth asking first

  • What exact invariant keeps utilization inside the documented model domain?
  • If that invariant breaks, what exact path prevents the model from publishing economically active output anyway?
  • Does the system clamp utilization input, clamp rate output, or quarantine downstream consumers — and are those three boundaries intentionally different?
  • If the reserve sees utilization > 100%, what changes immediately: depositor yield, supplier index, collateral headroom, borrow capacity, or only operator alerts?
  • Is there a non-user-owned accounting bucket for ambiguous or out-of-domain accrual, or does every produced rate immediately become user value?
  • Which powers narrow first after an impossible-state observation: borrowing, collateral admission, liquidation, or only UI display?
  • What explicit state proves the market is safe to graduate back from supercritical-state quarantine into normal operation?

Red flags

  • Utilization above 100% cannot happen, so the model does not need meaningful behavior there.
  • If the curve returns a number, depositors should get it.
  • A fallback rate branch is harmless because it is only for edge cases.
  • The reserve can keep accruing normally while operators investigate an impossible state.
  • Out-of-range input is acceptable as long as the function does not revert.
  • We only need to prove the main ledger invariant, not the economics of the state if the invariant fails.

Failure-prevention checklist

  • Name the intended utilization domain explicitly and tie it to reserve-ledger invariants, not only to comments in the rate model.
  • Prove or monitor the denominator relation that keeps utilization meaningful: recognized deposits, borrowable liquidity, reserve inventory, and borrow amount should tell one coherent story.
  • Add a second containment layer for impossible states: clamp input, clamp output, quarantine accrual, or route ambiguous interest into a non-user-owned bucket instead of publishing it as depositor value.
  • Keep out-of-domain rate output weaker than collateral truth. Even if local accounting continues, freeze or haircut collateral admission and recursive borrowing until reserve coherence is restored.
  • Treat thin markets as force multipliers for model-domain failures; keep dust or one-supplier markets on stricter borrow and collateral policy.
  • Test multi-account and multi-block bundles that push the reserve past its intended utilization ceiling, then inspect depositor value, collateral headroom, and sibling-market borrowability.
  • Alert on production-impossible states and tie alerts to automatic narrowing when possible: borrow > deposits, utilization above documented ceiling, abrupt depositor APR explosions, or depositor-value jumps unsupported by real repayment.
  • Define recovery exit criteria explicitly. The protocol should know what state clears supercritical-rate quarantine instead of drifting back to normal by operator intuition.

Audit prompts

  • What exact relationship between borrows, deposits, and reserve inventory keeps this rate model inside its intended domain?
  • If utilization > 100% appears anyway, what exact code path stops the produced rate from becoming depositor-owned value or collateral headroom?
  • Does the protocol distinguish observed utilization, published rate, and collateral-relevant accrual, or are those states fused?
  • Where does ambiguous or out-of-domain interest go: user balances, treasury, a quarantine bucket, or nowhere?
  • Can a dominant dust depositor still capture almost all of the next rate update if the reserve reaches a supercritical state?
  • Which powers stay disabled after the impossible-state observation even if accrual or UI display continues?
  • What exact state transition proves the market has recovered enough to trust rate output normally again?
  • Has anyone tested the fallback branch economically, not just for non-reversion?

Lessons that should already be standard

  • Utilization > 100% is not a price discovery regime; it is a reserve-integrity failure.
  • Interest-model domain assumptions are security assumptions. If they are not enforced, they will eventually be traded against.
  • The protocol needs two answers, not one: how do we avoid the impossible state? and how do we keep the impossible state from printing value if it still appears?
  • A fallback branch that returns a huge number is not graceful degradation; it is a mint surface in disguise.
  • Thin markets make supercritical-rate states much more dangerous because the next published depositor gain often belongs almost entirely to one actor.
  • Local accrual continuity is weaker than collateral truth. A system may need to keep bookkeeping going while still refusing to let that bookkeeping support new debt.
  • If a protocol cannot say where ambiguous interest goes, the answer is often to the attacker.

How to use this note with the exploit corpus

Internal linkages

Control surface

Graph View

Backlinks