The GSM Pause Delay prevents changes from being made to the Maker Protocol without first waiting for a time delay.
However, changes may be made to some functionality without waiting for this delay.
This page lists the current exceptions and gives details of:
- The managing contract.
- The exceptional functionality.
- The reasoning behind the exception.
- The risk generated by the exception, in the event it is maliciously triggered.
Contracts may be looked up using the Chainlog.
{% hint style="warning" %}
While all reasonable effort has been made to ensure the accuracy and currency of this page, the authors are not smart contract developers, and exceptional functionality may be added or removed by Maker Governance at any time (subject to the GSM Pause Delay).
{% endhint %}
The MCD_PAUSE contract manages the general governance timelock of the GSM Pause Delay; however, it also contains an in-built exception to its own rule.
The executive drop functionality allows a successful governance proposal to cancel a previous governance proposal that has not yet passed the GSM Pause Delay period and been executed. Like any other, the new executive proposal must be the hat proposal, meaning more MKR is voting for it than is voting for any other executive proposal.
This functionality allows Maker Governance to prevent a malicious attack on the protocol if they are able to exceed the attacker's MKR weight before the GSM Pause Delay expires.
The risk opened up by this exceptional functionality is that a malicious attacker may be able to delay or permanently block a legitimate governance proposal.
The OSM_MOM contract manages the freezing of MakerDAO's oracles.
The freeze functionality allows a successful governance proposal to immediately freeze the oracle price for any or all of the vault types in the Maker Protocol. Once frozen, the oracle price will remain at its current value. The oracle cannot be unfrozen without waiting for the GSM Pause Delay as part of a regular governance proposal.
This functionality gives Maker Governance a chance to prevent a malicious oracle price from causing liquidations or the minting of unbacked DAI in the Maker Protocol. Due to the structure of Maker's oracles, the next oracle value is known one hour in advance of it becoming active in the Protocol. This is the window in which Maker Governance can act to prevent a malicious oracle price from entering the protocol.
The risk opened up by this exceptional functionality is that the oracles may be frozen by an attacker in order to either:
- Prevent an expensive liquidation.
- Take advantage of a significant drop in collateral prices to mint unbacked Dai.
The LINE_MOM contract manages the breaker for the Debt Ceilings of a configurable subset of the vault types in the Maker Protocol.
This Debt Ceiling Breaker allows a successful governance proposal to reduce the debt ceilings of a pre-configured whitelist of vault types to zero without waiting for the GSM Pause Delay to expire.
The whitelist may be configured via a successful governance proposal, but must wait the GSM Delay before changes come into effect. At time of writing, the following vault types are whitelisted on the Debt Ceiling Breaker:
- PSM (USDC) -
PSM-USDC-A - PSM (PAX) -
PSM-PAX-A - PSM (GUSD) -
PSM-GUSD-A
The Debt Ceiling Breaker affects both the Debt Ceiling and the Maximum Debt Ceiling of a given vault type when activated, disabling the Dynamic Debt Ceiling functionality for that vault type if enabled.
In the event that external news impacts the value of a collateral, the market has a large lead on Governance in its ability to react and drain value from the Maker Protocol via minting DAI against the affected collateral due to the GSM Pause Delay. This is especially relevant in the case of vault types using a fixed oracle price. This exceptional functionality reduces the response time for enabled collaterals to the time taken for an executive vote to pass. This gives Governance a better chance to minimize bad debt in the Maker Protocol due to collapse in the value of a collateral.
The risk opened up by this exceptional functionality is relatively small. If abused, it could prevent new DAI being minted from whitelisted vault types at a time when DAI is trading above its peg. This impact would last for at least the duration of the GSM Delay.
The CLIPPER_MOM contract manages the circuit breaker for vault types using Liquidations 2.0.
The circuit breaker functionality allows a successful governance proposal to impose Maker Governance's choice of limitations on liquidations for any or all of the vault types in the Maker Protocol.
- Level 0 - Liquidations Enabled - The breaker is not tripped, new vaults can be liquidated and old liquidations can proceed.
- Level 1 - New Liquidations Disabled - No new liquidations can take place.
- Level 2 - New Liquidations and Resets Disabled - No new liquidations can take place. No existing auctions can be reset if they expire.
- Level 3 - All Liquidations Disabled - No new liquidations, no resets, no bidding in active auctions.
Additionally, the contract allows for permissionless activation of the circuit breaker, if the price decrease in a collateral exceeds a preset percentage value between oracle price updates. The permissionless activation triggers the circuit breaker at Level 2 because both new auctions and resets reference the current oracle price.
This functionality is exceptional because liquidations at non-market prices have the potential to be irreversibly damaging to both users and the Maker Protocol. The circuit breaker allows Maker Governance to attempt to limit the damage in the event of an issue affecting liquidations without waiting for the GSM Pause Delay.
The risk opened up by this exceptional functionality is that liquidations may be halted by an attacker in order to either:
- Prevent an expensive liquidation.
- Take advantage of a significant drop in collateral prices to mint unbacked Dai.
The DIRECT_MOM contract manages the breaker for Direct Deposit Modules (D3Ms).
The breaker functionality allows a successful governance proposal to disable any or all of the active D3Ms. In practice, this will set the bar parameter to zero, which (contrary to intuition) disables the module by setting the allowed Debt Ceiling to zero. At this point, no further DAI can be minted through the Direct Deposit Module.
This functionality is exceptional to give Maker Governance a chance to limit the lost value if the target protocol or entity for a D3M becomes insolvent. Because targets are often publicly accessible protocols there is likely to be a race to extract as much value as possible in the event of a hack or insolvency event. Waiting for the GSM Pause Delay to expire makes it likely that the Maker Protocol will lose significant value, up to the maximum debt ceiling on the D3M.
The risk opened up by this exceptional functionality is that a given line of DAI credit is unexpectedly shut down, this has the potential to disrupt the protocol in question which may impact Maker indirectly.
The STARKNET_ESCROW_MOM contract manages the breaker for the StarkNet-DAI bridge.
The breaker functionality allows a successful governance proposal to freeze withdrawals from the L1 Starknet bridge contract without waiting for the GSM Pause Delay to expire.
This functionality is exceptional because StarkNet is expected to finalize its state on L1 at most every several hours. If an invalid or malicious state is finalized, it could lead to losses being transmitted from StarkNet to mainnet. The breaker gives Maker Governance a chance to prevent this, potentially limiting losses to the StarkNet L2.
The risk opened up by this exceptional functionality is that DAI withdrawals from Starknet to mainnet are unexpectedly blocked with circumstance or timing that benefits an attacker, and inconveniences others.
The MCD_IAM_AUTO_LINE contract manages the debt ceiling parameters for many of MakerDAO's vault types according to preset rules.
Keepers can use the contract to attempt to maintain a Target Available Debt in a given vault type. The contract modifies the debt ceiling up or down to maintain a level of available debt.
This functionality is exceptional so that the Maker protocol can react to changes in debt demand more quickly than waiting for the GSM delay.
The risk opened up by this exceptional functionality is a theoretical griefing attack on the IAM that prevents debt from being accessible in affected vault types.
Page last reviewed: 2022-11-25
Next review due: 2023-05-25