Recovery Mode

Analyzing these protocols reveals core design patterns for recovery states:

• Triggers: Based on system-wide health metrics (TCR) or governance votes.
• Restrictive Actions: Commonly include pausing new borrowing, modifying liquidation rules, or halting exchanges.
• Corrective Actions: May involve forced redemptions, debt auctions, or using insurance funds/staked tokens to absorb losses.
• Exit Conditions: Defined by a return to a safe collateral ratio or a governance vote to resume normal operations. The goal is always to protect the protocol's solvency and minimize losses for the majority of users.

Recovery Mode activates when the system's Total Collateral Ratio (TCR) falls below a protocol-defined minimum, often 150%. The TCR is the aggregate value of all collateral divided by the total debt in the system, measured in the protocol's native stablecoin (e.g., LUSD, DAI). This is a global health metric, distinct from individual position health.

During Recovery Mode, the liquidation process changes to prioritize system survival:

• Lower Collateral Thresholds: Individual positions with a collateral ratio below the TCR (e.g., 150%) become eligible for liquidation, not just those below a lower 'normal mode' threshold (e.g., 110%).
• Liquidation Bonuses: Incentives for liquidators are typically increased to ensure undercollateralized debt is cleared quickly.
• The goal is to redistribute collateral and burn debt until the TCR is restored above the minimum.

To prevent further degradation of system health, certain user actions are blocked or restricted while in Recovery Mode:

• New borrowing of the stablecoin is prohibited.
• Collateral withdrawals that would lower a user's collateral ratio below the current TCR are blocked.
• Users can only repay debt or add more collateral. This 'circuit breaker' halts risky actions until stability returns.

Protocols define two key collateral ratio benchmarks:

• Minimum Collateral Ratio (MCR): The lowest ratio (e.g., 110%) allowed for a position in Normal Mode. Below this, it can be liquidated.
• Recovery Mode Threshold (RMT): The higher, system-wide ratio (e.g., 150%) that triggers Recovery Mode when the TCR falls below it. A position with a 130% ratio is safe in Normal Mode but would be liquidatable in Recovery Mode if the TCR is 150%.

The system exits Recovery Mode when the Total Collateral Ratio (TCR) rises back above the Recovery Mode Threshold (e.g., 150%) and remains there. This is achieved through:

• Successful liquidations that burn bad debt.
• Users voluntarily repaying debt or adding collateral to their positions.
• An increase in the market price of collateral assets. Once exited, normal operations and liquidation rules resume.

Recovery Mode activates when the Global Collateral Ratio (GCR) of a vault or the entire system falls below a predefined Recovery Mode Threshold. This threshold is a critical safety parameter, often set significantly higher than the standard Liquidation Ratio, and is calculated using a time-weighted average price feed to prevent manipulation. Once triggered, the protocol enters a special state where normal operations are restricted to prioritize debt repayment.

In Recovery Mode, the protocol can initiate recollateralization auctions to sell a vault's collateral at a discount to cover its debt, even if this results in a loss for the vault owner. This process differs from standard liquidations by:

• Prioritizing system solvency over individual position health.
• Potentially liquidating positions that are not individually undercollateralized but are part of an undercollateralized system.
• Using mechanisms like Dutch auctions or reverse auctions to maximize recovery value.

For vault owners, Recovery Mode poses significant risks:

• Loss of Collateral: Users can lose a substantial portion of their collateral, potentially beyond their outstanding debt, to recapitalize the system.
• Suspended Operations: Deposits, borrowing, and withdrawals are typically frozen to prevent further instability.
• Price Impact: Forced large-scale liquidations can create severe market slippage, worsening the collateral's value and the recovery outcome. This represents a systemic risk where well-collateralized users may subsidize undercollateralized ones.

The safety of Recovery Mode hinges on carefully calibrated parameters:

• Recovery Mode Threshold (RMT): The GCR level that triggers the mode. Set too low, it may trigger too late; too high, it may trigger unnecessarily.
• Collateral Auction Parameters: Including minimum bid, auction duration, and discount rates, which determine recovery efficiency.
• Grace Periods: Time allowed for voluntary recapitalization before forced liquidations begin. Protocols like MakerDAO (with its Emergency Shutdown and Global Settlement) and Liquity pioneered and refined these mechanisms.

Recovery Mode is a distinct safety mechanism often confused with Emergency Shutdown.

• Recovery Mode: An automated, in-protocol process to restore solvency while the system is running. It uses auctions and may result in partial losses for users.
• Emergency Shutdown: A manual, governance-triggered process that freezes the entire system. It allows users to claim a fixed, pro-rata share of the remaining collateral based on a final price snapshot, aiming for a more orderly and equitable wind-down. Understanding this distinction is critical for risk assessment.

The forced sale of a borrower's collateral to repay their debt, triggered when their Health Factor falls below the protocol's threshold (e.g., 1.0).

• Purpose: Protects the protocol from undercollateralized debt.
• Process: A liquidator repays part or all of the debt in exchange for the collateral at a discounted rate, incurring a liquidation penalty for the borrower.

The aggregate value of all crypto assets deposited (locked) in a DeFi protocol's smart contracts. In the context of Recovery Mode:

• System-Wide Metric: A sharp decline in overall TVL can increase systemic risk and the likelihood of entering Recovery Mode.
• Collateral Backing: Represents the total pool of assets securing the protocol's outstanding loans.

Also known as the Loan-to-Value (LTV) ratio, this is the maximum percentage of an asset's value that can be borrowed against. It is a key risk parameter set by governance.

• Risk Management: A lower collateral factor for an asset makes borrowing against it safer for the protocol.
• Dynamic Adjustment: Protocols may adjust factors in response to market volatility, which directly impacts users' Health Factors.

The decentralized process by which token holders propose, vote on, and implement changes to a protocol's parameters, including those critical to Recovery Mode.

• Control Levers: Governance typically sets collateral factors, liquidation penalties, and the specific conditions that trigger Recovery Mode.
• Emergency Powers: In some designs, governance may have the ability to trigger Recovery Mode manually in a crisis.

A source of external, real-world data (primarily asset prices) fed on-chain to DeFi protocols. Oracle accuracy is fundamental to all risk calculations.

• Critical Input: Oracle prices are used to compute the value of collateral and debt, determining every user's Health Factor.
• Failure Mode: Oracle manipulation or failure (e.g., providing stale prices) can cause incorrect liquidations or prevent Recovery Mode from activating when needed.