Global Settlement

The core of the mechanism is the Final Price Oracle, which provides a single, immutable price for each collateral asset at the moment of shutdown. This reference price is used to calculate the final redemption value for all users, preventing disputes and ensuring a fair, deterministic outcome. It is typically sourced from a decentralized oracle network like Chainlink or a time-weighted average price (TWAP) at the time of activation.

Upon activation, the system freezes and allows users to directly redeem their stablecoin holdings for the underlying collateral at the final price. For example, if a user holds 100 DAI, they can redeem it for the proportional amount of ETH or other collateral backing it. This process unwinds all debt positions and converts the system from a dynamic lending market into a simple redemption contract, ensuring users can recover value even in a catastrophic failure.

Global Settlement is a last-resort action triggered only by specific, pre-programmed conditions to protect the protocol's long-term solvency. Common triggers include:

• Governance Vote: A decentralized autonomous organization (DAO) votes to shut down the system.
• Emergency Shutdown Module: A multisig or specialized module is activated in response to a critical bug or attack.
• Long-term Oracle Failure: A sustained failure of the price feed oracle makes the system unsafe to operate.

The process immediately halts all core protocol functions. This includes:

• New borrowing and lending is disabled.
• Liquidation auctions are stopped.
• Price feeds are fixed to the final oracle price.
• Stablecoin transfers may be frozen or limited to redemption-only functions. This complete freeze creates a stable, known state from which the orderly redemption of collateral can begin.

Global Settlement is fundamentally different from individual position liquidations.

• Scope: Liquidations target undercollateralized single positions; Global Settlement affects the entire system.
• Goal: Liquidations maintain system health during normal operation; Global Settlement is a terminal shutdown to preserve solvency.
• Price: Liquidations use live market prices; Global Settlement uses a single, fixed final price.
• Outcome: After liquidation, the protocol continues; after global settlement, it is permanently closed.

MakerDAO's Emergency Shutdown is the canonical implementation. When triggered, it:

1. Sets a Global Settlement price for ETH and other collateral assets.
2. Allows DAI holders to redeem collateral directly from the Collateralized Debt Position (CDP) system via a cash function.
3. Enables CDP owners to claim any excess collateral remaining after their debt is covered. This mechanism was designed as the ultimate backstop to guarantee that 1 DAI is always redeemable for at least $1 worth of collateral, even if the peg fails.

A malicious governance attack that compromises the protocol's administrative keys can trigger settlement. This is a defense against an attacker gaining unilateral control to drain vaults or alter critical parameters.

• Mechanism: A governance delay (e.g., MakerDAO's GSM Pause Delay) allows token holders to initiate settlement before malicious governance votes are executed.
• Purpose: Protects the system from hostile takeover, freezing operations in a known state.

A catastrophic drop in collateral value that outpaces the liquidation engine can be a trigger. While automated liquidations are the first line of defense, a "black swan" event may require system-wide settlement.

• Condition: The total system debt exceeds the value of all collateral, even after accounting for liquidation penalties and buffers.
• Outcome: Settlement redeems stablecoins for a fixed, final share of the now-undervalued collateral pool.

A critical bug discovered during or after a protocol upgrade can necessitate an emergency shutdown. If the new smart contract code contains a vulnerability that threatens user funds, settlement provides an escape hatch.

• Process: Governance can vote to trigger settlement, allowing users to exit based on the last known safe state before the faulty upgrade.
• Purpose: Limits damage from unforeseen technical failures in new code deployments.

A governance decision that the protocol is no longer economically viable or sustainable can manually trigger settlement. This is a strategic shutdown, not an emergency response.

• Scenarios: Regulatory pressure, irreparable market structure changes, or the emergence of a superior successor system.
• Action: Token holders vote to wind down the protocol in an orderly manner, returning capital to users.

Once triggered, the settlement process follows a deterministic sequence:

1. Freeze: All new minting, borrowing, and liquidations are halted.
2. Final Price: A Global Settlement price is set for each collateral type, typically using a final oracle snapshot.
3. Redemption: Stablecoin holders can redeem their tokens for a fixed claim on the underlying collateral basket at the settled price.

This ensures all parties receive a pro-rata share based on the system's final solvency.

Global Settlement acts as a circuit breaker, permanently halting a protocol's core operations (like minting new stablecoins or opening new CDPs) to protect the system from catastrophic failure. It is triggered by governance vote or an oracle failure, freezing the system in a known state to prevent further losses.

• Purpose: To stop a death spiral or bank run.
• Trigger: Governance vote, oracle failure, or security breach.
• Outcome: System enters a settlement phase where all positions are finalized.

Upon activation, the protocol calculates a final redemption price, allowing users to redeem their stablecoin tokens for the underlying collateral at a fixed rate. This process ensures that, even in failure, claimholders can recover a proportional share of the backing assets.

• Fixed Snapshot: The system's state is frozen at the time of settlement.
• Pro-Rata Distribution: Users redeem based on the total collateral pool.
• Example: In MakerDAO's old Single-Collateral DAI (SAI) system, 1 DAI could be redeemed for $1 worth of locked ETH.

A primary trigger for Global Settlement is a critical oracle failure. If the price feed providing the value of collateral is corrupted, delayed, or manipulated, the protocol may be forced to settle to prevent the creation of undercollateralized positions.

• Attack Vector: Manipulating the oracle price to trigger unnecessary settlement.
• Mitigation: Use of decentralized, time-delayed oracle networks.
• Consequence: A premature settlement can lock in losses and disrupt the ecosystem.

The power to trigger Global Settlement is typically held by protocol governance (token holders). This concentrates immense power, creating a risk of malicious proposals, governance attacks, or coercion forcing an unnecessary shutdown.

• Risk: A hostile actor acquiring majority voting power.
• Safeguards: Timelocks on execution, multi-sig requirements, and emergency security modules.
• Trade-off: Balancing decisive emergency action with decentralized control.

Global Settlement intentionally breaks the stablecoin peg by fixing the redemption price. This causes immediate disruption to secondary markets, DEX liquidity pools, and integrated protocols that rely on a functioning, liquid stablecoin.

• Market Impact: Trading halts, arbitrage opportunities vanish.
• Protocol Contagion: Other DeFi apps using the stablecoin may fail.
• Outcome: The asset transitions from a circulating currency to a redeemable claim.

It is critical to distinguish Global Settlement from a simple pause function. A pause is temporary and reversible, often used for upgrades or to stop exploits in progress. Global Settlement is permanent and irreversible, designed as a last-resort termination.

• Pause: Temporary halt, system can resume.
• Global Settlement: Permanent shutdown, assets are distributed.
• Use Case: A hack might trigger a pause; a fundamental design flaw might require settlement.

A collateral auction is a process triggered during or after Global Settlement to liquidate a system's remaining asset inventory. Its goal is to convert seized collateral into the settlement asset (e.g., DAI) to repay the system's final liabilities. Key aspects include:

• Reverse Dutch Auction: Often used, starting at a high price and descending until a bid is placed.
• Participants: Open to any external actor, creating a market-driven price discovery mechanism.
• Objective: To maximize recovery value for the system and its users, determining the final redemption price.

A debt ceiling is a protocol-level parameter that limits the total amount of stablecoin debt (e.g., DAI) that can be generated against a specific collateral type. It is a primary risk management tool.

• Risk Isolation: Limits exposure to any single collateral's failure.
• Pre-Global Settlement: Breaching a debt ceiling prevents new debt issuance but doesn't trigger settlement.
• Post-Global Settlement: The global debt ceiling becomes irrelevant as the system enters its terminal state.

Emergency Shutdown is the governance-initiated process in systems like MakerDAO that activates Global Settlement. It is a defensive action taken in response to a critical threat, such as:

• A governance attack or smart contract exploit.
• Long-term market irrationality threatening solvency.
• A mandate from legal authorities. The process freezes the system, fixes oracle prices, and begins the settlement sequence, allowing users to claim their fair share of the underlying collateral.

Redemption is the final user-facing action in a Global Settlement, where holders of the system's stablecoin (e.g., DAI) exchange it for a fixed claim on the underlying collateral basket at the final redemption price.

• Process: Users invoke a redemption function, burning their tokens and receiving a pro-rata share of collateral.
• Price Finality: The redemption rate is immutable once set, eliminating price volatility.
• Settlement Finality: This action concludes a user's position within the terminated system.

System solvency refers to the fundamental condition where the total value of a protocol's collateral assets exceeds the total value of its liability (minted stablecoin debt). It is the core guarantee a stablecoin system provides.

• Collateralization Ratio: The key metric (e.g., 150%) used to measure solvency for individual positions and the system aggregate.
• Trigger for Settlement: A severe, systemic breach of solvency that cannot be resolved via liquidations is a primary catalyst for initiating Global Settlement to prevent insolvency.

An oracle is a service that provides external data (like asset prices) to a blockchain. In Global Settlement, oracles play a decisive and time-sensitive role.

• Price Feed Finalization: At the settlement trigger, the system uses a final oracle price to snapshot the value of all collateral assets. This price must be resistant to manipulation.
• Security Critical: The integrity of the settlement process and the fairness of redemptions depend entirely on the accuracy and liveness of the oracle at this critical moment.