Add Vault Rebalancer Automation Spec - #1
Conversation
| - **`rebalance()` is idempotent and self-guarding** — it inspects vault state and either acts or no-ops. | ||
| - **Internal errors revert the EVM transaction cleanly.** `coa.call` surfaces them as `EVM.Result`, not a Cadence panic. | ||
| - **The COA's EVM-side authority is narrow** — restricted to invoking `rebalance()` only (no admin or fund-movement entrypoints). This bounds the blast radius of an admin-compromised Config rewrite to liveness impact. | ||
| - **Solvency does not depend on the rebalancer firing.** Insolvency-critical actions take permissionless paths: emergency deleverage triggers above a hard-LTV ceiling, and liquidations are Morpho-driven and external. If a future change makes solvency depend on tick liveness, the Medium-priority choice must be revisited. |
There was a problem hiding this comment.
I don't really understand what this line means.
emergency deleverage triggers above a hard-LTV ceiling
I don't think there is a separate "emergency deleverage" mechanism, separate from automated rebalancing, that we expect to be more reliable than automated rebalancing.
Morpho will allow anyone to liquidate our position if it exceeds LTV limit. We want to structure our vault such that that is unlikely to happen. The main purpose of the automated rebalancing is to prevent our position from being liquidated, as best we can. But ultimately we can't guarantee solvency without making assumptions about the price movements of the assets we're exposed to.
There was a problem hiding this comment.
Agree!
Since the config contains the scheduler priority we don't need to concern ourselves here with the specific things the EVM code is doing or isn't doing.
We can just focus on calling a function on a schedule with the provided parameters.
There was a problem hiding this comment.
Yeah good catch, I think that this came from trying to callout the fact that there are permissionless escape hatches (i.e. permissionless rebalance/user escape hatch) which can be leveraged in the case of rebalancing failure, but this statement doesn't frame it properly adds more confusion than its worth IMO, removed in 4e852dd
| | COA FLOW depletion (EVM-side gas) | Per-tick COA balance in event; EVM calls fail with insufficient-balance error | Admin tops up the COA | | ||
| | Cadence-side OOE (effort margin too tight) | Absence of expected events for the scheduled tx; rebalancer stops ticking | Admin re-invokes self-reschedule; retune effort margin if recurring | | ||
|
|
||
| All failures are liveness-only (no solvency impact). Off-chain monitoring of tick freshness, per-tick EVM result status, fee-vault balance, and COA balance is required for reliable operation. |
There was a problem hiding this comment.
no solvency impact
Again, in my view, one of the main purposes of this component (automated rebalancing) is to avoid liquidations. If the auto-balancer fails to run for an extended period of time, that will impact our LTV. Depending on the direction and magnitude of that impact, it will also impact our solvency.
| ## What we require from the EVM contract | ||
|
|
||
| - **`rebalance()` is idempotent and self-guarding** — it inspects vault state and either acts or no-ops. | ||
| - **Internal errors revert the EVM transaction cleanly.** `coa.call` surfaces them as `EVM.Result`, not a Cadence panic. |
There was a problem hiding this comment.
Internal errors revert the EVM transaction cleanly
I agree that we require that the EVM contract we're calling does not cause the transaction to panic. But also, it's impossible as far as I know for an EVM contract to directly induce a Cadence panic. I would frame this requirement as an assumption that is satisfied based on the structure where we are invoking an EVM function. There is no additional requirement to "revert the EVM transaction cleanly".
There was a problem hiding this comment.
Yeah makes sense, changed to an assumption in 4e852dd. The idea was to make it explicit that we were protected from panics because:
- None of the Cadence code paths would panic
- Any panics that do occur during rebalnacing are within EVM, which can be caught by Cadence
3 participants
This PR adds a markdown spec for the Cadence automation that triggers the EVM vault rebalance operation.