DeFi Security: Mento Circuit Breaker in Action

In the previous installment of our DeFi Security series, Inside the Mento Protocol’s Circuit Breaker, we looked at the theory of our circuit breaker. Today, let’s look at practice. We will examine a few actual circuit breaker events in the wild.

First, let’s briefly recap the key concepts involved.

Circuit Breaker: The entire mechanism encompassing multiple components such as the Breaker Box or individual Breakers

Rate Feed: A specific asset pair, such as CELO/USD or USDC/USD, for which our smart contracts receive price reports from external oracles.

Breaker Box: The central control unit for the circuit breaker mechanism monitors all individual breakers and halts trading when a breaker triggers.

Breaker: A smart contract that monitors rate feeds for abnormal market conditions with abrupt price fluctuations. There are different breaker types, as explained below.

Trading Mode: The allowed trading operations for a given rate feed. It can be bidirectional (default), inflow trading blocked, outflow trading blocked, or trading fully halted. Managed by the Breaker Box. This article will only refer to trading as “enabled” or “halted” for simplicity’s sake.

Breaker Types

There are currently two types of breakers in use in the Mento protocol.

The Median Delta Breaker monitors the median price for a given rate feed. It trips when a newly reported median price exceeds the previous one by a predefined threshold (typically 2-3%, but it can be higher for more volatile assets).

We use this breaker type for volatile asset pairs with low price correlation, such as CELO/USD. This breaker can defend against flash crashes, where the price spikes heavily for a few minutes before it retraces.

Note: In newer versions, we added an Exponential Moving Average on top of the median price to make this breaker even more resilient. But for this post, we’ll stick to the original code used at the time of the breaker event.

The Value Delta Breaker stores a fixed reference value. It trips when a newly reported median oracle rate exceeds the reference rate by a predefined threshold.

We use this breaker type for stable asset pairs such as cUSD/USDC, where one asset is pegged to the other. This breaker defends against stable asset depegs caused by temporary market volatility.

Breakers in Action 🎬

Now let’s look at a list of all recorded circuit breaker events in the Mento protocol:

Exhibit A: CELO/USD trading halted!

At 9:44 pm on August 17th, 2023, the crypto market experienced one of its infamous liquidation cascades, where prices can fall rapidly in a matter of seconds.

This rapid selloff also included the CELO/USD price, which fell ~20% within minutes:

Now, these are precisely the situations our breakers were made for!

The Trigger

So let’s dive into the breaker that tripped as a result of the sudden CELO/USD price volatility. If we click on the transaction that triggered the breaker and navigate to the transaction logs, we can see the following sequence of events:

1. OracleReported Oracle contract received a new CELO/USD price: $0.378141
2. MedianUpdated Oracle contract updated the rate feed’s median price to $0.38195
3. BreakerTripped The new median price breached the threshold and tripped the MedianDeltaBreaker!

To understand what happened here, let’s look at the config of the tripped breaker:

ELI5: A new median price cannot be more than 3% higher or lower than the previous median price.

The previous median price reported by the oracle was $0.40019 per CELO, as can be seen in the value of the last `MedianUpdated` event.

🚨 4.56% is above the allowed change rate threshold of 3% ⇒ trip the breaker! 🚨

The Cooldown

Ok, the breaker tripped and halted trading of CELO/USD. Now, let’s see if our cooldown period worked as expected.

Every new oracle report for the CELO/USD rate feed, which come in every couple of seconds, will automatically attempt to reset the breaker. But according to the rateFeedCooldownTime config above, trading should remain halted for 30 minutes. So, let’s look at the following oracle report that came in right after the breaker tripped.

The oracle tried to reset our tripped breaker, but it hasn’t cooled down yet and emits a ResetAttemptNotCool event. This will keep happening for the next 30 minutes until it is finally possible to reset the breaker.

The Reset

After 30 minutes, the cooldown is over and the next oracle report will automatically reset the breaker if volatility has calmed down. Let’s look at the first oracle report transaction after the cooldown completed. This time we see a ResetSuccessful event! Price fluctuation had died down at this point, so trading could be safely re-enabled.

Key Takeaways

We saw how our circuit breaker mechanism was able to:

• detect increased volatility
• temporarily halt trading
• wait for volatility to calm down
• and resume trading.

All fully automated without any human intervention!

Exhibit B: USDC/USD trading halted!

Now, let’s look at our second breaker type: ValueDeltaBreaker. Contrary to the MedianDeltaBreaker, this breaker has a fixed reference value. This is great for pegged assets like cUSD or USDC, which should closely follow the US dollar price.

The config for the breaker we are going to look at is:

The Trigger

At 08:15 pm on May 7th, 2023, there was a brief spike in the USDC/USD price that tripped this ValueDeltaBreaker. We can see the oracle reporting a new USDC/USD price of ~$1.011, which exceeded our reference value of $1.00 by more than the allowed 0.5% and tripped the breaker in this trigger transaction.

The Cooldown

The cooldown is very short, 1 second, because we know exactly what the price should be at all times: $1 USD per USDC. So whenever the price is within 0.5% of this fixed reference value, we can resume trading immediately.

The Reset

Luckily, the price normalized very quickly, leading to a successful breaker reset just a few seconds later in this reset transaction:

Key Takeaways

Although there was no connected big market event in this case, such as the infamous USDC Depeg in March 2023, it shows how quickly our breakers can react and defend against real depegs and oracle manipulation attacks.

Conclusion

Today we have seen how our circuit breaker system is protecting users from extreme price volatility in practice. It’s been live since early 2023 and we’re very happy with how it’s performing.

The circuit breaker mechanism is a valuable pattern to enhance the security of the Mento protocol and decentralized finance at large.

By incorporating lessons from traditional finance and electrical engineering, we can increase resilience while staying true to our core values of decentralization and transparency.

If you’d like to explore our Circuit Breaker System in more depth, check out our On-Chain Circuit Breaker docs!