Comment on page
ESM - Detailed Documentation
The ESM is the trigger system for the shutdown of the ABM Protocol
- Contract Name: esm.sol
- Type/Category: Emergency Shutdown Module
The Emergency Shutdown Module (ESM) is a contract with the ability to call
End.cage() to trigger the Shutdown of the ABM Protocol.
Key Functionalities (as defined in the smart contract)
join - Deposit ABM to the shutdown modulefire - Trigger shutdown by calling End.cageOther
gem - ABM Token contract [address]end - The End contract [address]min - Minimum ABM amount required for fire [uint]Sum - Total ABM deposited [uint]pit - Address where burned gem's are sent [address]fired - True if fire has executed [bool]sum(usr: address) - ABM join balance by user [address: uint]ABM holders that wish to trigger Shutdown must
join ABM into the ESM, which is immediately burned. When the ESM's internal Sum variable is equal to or greater than the minimum threshold (min), the ESM's fire() method may be called by anyone. This method, in turn, calls End.cage(), which starts the Shutdown process.The ESM is intended to be used in a few potential scenarios:
- To mitigate malicious governance
- To prevent the exploitation of a critical bug (for example one that allows collateral to be stolen)
In the case of a malicious governance attack, the joiners will have no expectation of recovering their funds (as that would require a malicious majority to pass the required vote), and their only option is to set up an alternative fork in which the majority's funds are slashed and their funds are restored.
In other cases, the remaining ABM holders may choose to refund the ESM joiners by minting new tokens.
Note: If governance wants to disarm the ESM, it can only do so by removing its authorization to call
end.cage() before the ESM is triggered.It is important for users to keep in mind that joining ABM into the ESM is irreversible—they lose it forever, regardless of whether they successfully trigger Shutdown. While it is possible that the remaining ABM holders may vote to mint new tokens for those that lose them triggering the ESM, there is no guarantee of this.
The parameters that govern the ESM are set upon creation and cannot be changed (without re-deploying the ESM contract); thus care must be taken to ensure that they are correct and allow the contract to function properly.
An entity wishing to trigger the ESM but possessing insufficient ABM to do so independently must proceed with caution. The entity could simply send ABM to the ESM to signal its desire and hope others join in; this, however, is poor strategy. Governance, whether honest or malicious, will see this, and likely move to de-authorize the ESM before the tipping point can be reached. It is clear why malicious governance would do so, but honest governance might act in a similar fashion—e.g. to prevent the system from being shut down by trolls or simply to maintain a constant threshold for ESM activation. (Honest governance, or even deceptive malicious governance, would be expected to then replace the ESM.) If governance succeeds in this, the entity has simply lost ABM without accomplishing anything.
If an entity with insufficient ABM wishes to trigger the ESM, it is better off first coordinating with others either off-chain or ideally via a trustless smart contract.. If a smart contract is used, it would be best if it employed zero-knowledge cryptography and other privacy-preserving techniques (such as transaction relayers) to obscure information such as the current amount of ABM committed and the addresses of those in support.
If an entity thinks others will join in before governance can react (e.g. if the delay for governance actions is very long), it is still possible that directly sending insufficient ABM to the ESM may work, but it carries a high degree of risk. Governance could even collude with miners to prevent
cage calls, etc if they suspect an ESM triggering is being organized and wish to prevent it.The ESM itself does not have an isolated failure mode, but if the other parts of the system do not have proper authorization configurations (e.g. the End contract does not authorize the ESM to call
cage()), then the ESM's fire() method may be unable to trigger the Shutdown process even if sufficient ABM has been committed to the contract.