https://github.com/makerdao/esm

Emergency Shutdown Module
https://github.com/makerdao/esm

Last synced: 3 months ago
JSON representation

Emergency Shutdown Module

• Host: GitHub
• URL: https://github.com/makerdao/esm
• Owner: makerdao
• License: agpl-3.0
• Created: 2019-05-08T15:46:44.000Z (over 5 years ago)
• Default Branch: master
• Last Pushed: 2023-03-08T02:57:14.000Z (almost 2 years ago)
• Last Synced: 2023-04-05T23:40:53.016Z (almost 2 years ago)
• Language: Solidity
• Size: 76.2 KB
• Stars: 16
• Watchers: 16
• Forks: 25
• Open Issues: 3
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# ESM

![Build Status](https://github.com/makerdao/esm/actions/workflows/.github/workflows/tests.yaml/badge.svg?branch=master)

Emergency Shutdown Module

## Description

The ESM is a contract with the ability to call `end.cage()`, i.e. trigger an

Emergency Shutdown (aka Global Settlement).

MKR holders `join` their funds, which are then immediately burnt. When the ESM's

internal `sum` balance is equal to or greater than the `min` threshold, the ESM

can be `fire`d.

It is meant to be used by an MKR minority to thwart two types of attack:

* malicious governance (if an address to de-authorize is supplied in the constructor)

* critical bug

In the former case, the pledgers will have no expectation of recovering the

funds (as that would require a malicious majority to pass the required vote),

and their only option is to set up an alternative fork in which the majority's

funds are slashed. An ESM configured to protect against malicious governance can also

be used to protect against most critical bugs, unless there is a bug in the shutdown

process that requires governance intervention to work around.

In the latter case, governance can choose to refund the ESM pledgers by minting new

tokens.

If governance wants to disarm the ESM, it can do so by removing all of it's authorizations in the system and then by by calling `cage()` on this contract.

## Invariants

* `fire` can be called by anyone

* `fire` can be called only once (enforced by `end` module)

* `fire` requires `sum` to be >= `min`

* `join` can only be called before `fire` (enforced by `end` module)

* gems are burnt using the extra function `burn` after `join`ing