SAFE Engine
1. Summary
The SAFEEngine
stores Vaults and tracks all debt and collateral balances. This contract is the most important system component and thus, in order to minimize the possibility of bugs, it does not have any external dependencies.
2. Contract Variables & Functions
Variables
debtBalance[user: address]
- unbacked coins (system debt, not belonging to anycdp
).collateralTypes[collateralType: bytes32]
- a mapping ofCollateralType
s.safes[collateralType: bytes32
,safeHandler: address]
- a mapping ofSAFE
types.tokenCollateral[user: address]
- collateral token balances.coinBalance[user: address]
- how many coins an account has. This number is not reflected in the external ERC20 token contract.globalDebt
- total amount of debt currently issued.globalDebtCeiling
- the limit on total amount of debt that can be issued.globalUnbackedDebt
- amount of bad debt in the system.authorizedAccounts[usr: address]
- stores addresses that are able tomodifyParameters
, disable the contract,modifyCollateralBalance
s,createUnbackedDebt
andconfiscateSAFECollateralAndDebt
.contractEnabled
- global settlement flag.
Data Structures
CollateralType
:debtAmount
- total normalized system coin debt.accumulatedRate
- system coin debt multiplier (accumulated stability fees).safetyPrice
- collateral price with safety margin. Used to limit the amount of debt that can be generated per one unit of collateral.debtCeiling
- the total amount of debt that can be generated using this collateral type.debtFloor
- the minimum amount of debt that must be generated by a Vault with this collateral type.liquidationPrice
- collateral price with safety margin. Used only inLiquidationEngine
when a Vault is liquidated.
SAFE
:lockedCollateral
- Vault collateral balance.generatedDebt
- normalized outstanding system coin debt.
Modifiers
canModifySAFE
- modifier that checks whether an address is allowed to modify another address's collateral or system coin balance.isAuthorized
**** - checks whether an address is part ofauthorizedAddresses
.
Functions
disableContract()
- disable the SAFEEngine.modifyParameters(parameter: bytes32
,data: uint256)
- modify generaluint256
parameters.modifyParameters(collateralType: bytes32
,parameter: bytes32
,data: uint256)
- modify collateral typeuint256
parameters.initializeCollateralType(collateralType: bytes32)
- create a new collateral type.modifyCollateralBalance(parameter: bytes32
,usr: address
,wad: int256)
- modify a user's collateral balance.transferCollateral(collateralType: bytes32
,src: address
,dst: address
,wad: uint256)
- transfer collateral between users.transferInternalCoins(src: address
,dst: address
,rad: uint256)
- transfer system coins between users. This action does not transfer coins between users in the ERC20 contract but only in the CDPEngine.confiscateSAFECollateralAndDebt(collateralType: bytes32
,cdp: address
,collateralCounterparty: address
,debtCounterparty: address
,deltaCollateral: int256
,deltaDebt: int256)
- called by theLiquidationEngine
when auctioning collateral to cover bad debt.settleDebt(rad: uint256)
- destroy equal quantities of system coins and system debt (globalUnbackedDebt
).updateAccumulatedRate(collateralType: bytes32
,surplusDst: address
,rateMultiplier: int256)
- modify a collateral's accumulated interest rates, creating / destroying corresponding debt.createUnbackedDebt(debtDestination: address
,coinDestination: address
,rad: uint256)
- mint unbacked system coins (accounted for withglobalUnbackedDebt
).modifySAFECollateralization(collateralType: bytes32
,cdp: address
,collateralSource: address
,debtDestination: address
,deltaCollateral: int256
,deltaDebt: int256)
- modify a Vault's CRatio **** by locking/unlocking collateral and/or generating/paying back debt.transferSAFECollateralAndDebt(collateralType: bytes32
,src: address
,dst: address
,deltaCollateral: int256
,deltaDebt: int256)
- splitting/merging Vaults by transferring collateral and/or debt between them.approveSAFEModification(account: address)
- enablecanModifySAFE
for a pair of addresses.denySAFEModification(account: address)
- disablecanModifySAFE
for a pair of addresses.
Events
AddAuthorization
- emitted when anaddAuthorization(address)
is successfully executed. Contains:account
- the account that is authorized
RemoveAuthorization
- emitted when aremoveAuthorization(address)
is successfully executed. Contains:account
- the account that is de-authorized
ApproveSAFEModification
- emitted when someone successfully approves another address to modify their Vault. Contains:sender
- the transaction's msg.senderaccount
- the account that is being approved
DenySAFEModification
- emitted when someone successfully denies another address to modify theirVault
. Contains:sender
- the transaction's msg.senderaccount
- the account that is being denied the permission to modify a Vault
InitializeCollateralType
- emitted when a new collateral type is initialized. Contains:collateralType
- the collateral type identifier (name)
ModifyParameters
- emitted when a parameter is successfully updatedDisableContract
- emitted when theSAFEEngine
is disabledModifyCollateralBalance
- emitted when a user's collateral balance is modified (add new collateral/remove collateral). Contains:collateralType
- the collateral's identifieraccount
- the account that's being credited/debited collateralwad
- delta collateral amount
TransferCollateral
- emitted when someone transfers collateral from one account to another. Contains:collateralType
- the collateral's identifiersrc
- the source from which collateral is transferreddst
- the destination where collateral arriveswad
- the amount of collateral transferred
TransferInternalCoins
- emitted when someone transfers system coins internally. Contains:src
- the source of the system coinsdst
- the destination of the system coinsrad
- amount of internal coins to transfer
ModifySAFECollateralization
- emitted when someone modifies the collateralization ration of theirVault
(add/remove collateral and/or generate/repay debt). Contains:collateralType
- the collateral type added/withdrawn from the SAFEsafe
- the target VaultcollateralSource
- the source from which collateral is taken and deposited in the VaultdebtDestination
- the destination of the system coins generateddeltaCollateral
- the amount of collateral added/withdrawndeltaDebt
- the amount of system coins borrowed/repaidlockedCollateral
- the total amount of collateral locked in the VaultgeneratedDebt
- the total amount of debt currently generated by the VaultglobalDebt
- the amount of global debt after the Vault's collateralization ratio is modified
TransferSAFECollateralAndDebt
- emitted when someone transfers collateral and/or debt from one Vault to another. Contains:collateralType
- the identifier of the collateral stored in both the source and the destination Vaultssrc
- the source Vaultdst
- the destination VaultdeltaCollateral
- the amount of collateral added to/withdrawn fromsrc
and added to/withdrawn fromdst
deltaDebt
- the amount of debt added to/withdrawn fromsrc
and added to/withdrawn fromdst
srcLockedCollateral
- total amount of collateral locked in the source VaultsrcGeneratedDebt
- total amount of debt generated by the source VaultdstLockedCollateral
- total amount of collateral locked in the destination VaultdstGeneratedDebt
- total amount of debt generated by the destination Vault
ConfiscateSAFECollateralAndDebt
- emitted when an authed address confiscates collateral and/or debt from a Vault. Contains:collateralType
- the identifier of the collateral deposited in the target Vaultsafe
- the Vault from which to confiscate collateral/debtcollateralCounterparty
- the address that will receive the confiscated collateraldebtCounterparty
- the address that will receive the confiscated debtdeltaCollateral
- the amount of collateral to confiscatedeltaDebt
- the amount of debt to confiscateglobalUnbackedDebt
- the total amount of global bad debt
SettleDebt
- emitted when the contract settles bad debt with an equal amount of coins (surplus). Contains:rad
- the amount of bad debt to settledebtBalance
- the resulting debt balance ofmsg.sender
coinBalance
- the resulting coin balance ofmsg.sender
globalUnbackedDebt
- the resulting amount of global bad debtglobalDebt
- the resulting amount of total global debt
CreateUnbackedDebt
- emitted after creating debt out of thin air. Contains:debtDestination
- the address that will receive debtcoinDestination
- the address that will receive the corresponding amount of coinsrad
- the amount of debt to issuedebtDstBalance
- the resulting amount of debt that the debt destination hascoinDstBalance
- the resulting amount of coins that the coin destination hasglobalUnbackedDebt
- the resulting amount of global bad debtglobalDebt
- the resulting amount of total global debt
UpdateAccumulatedRate
- emitted after updating the total accrued interest rate for a specific collateral type. Contains:collateralType
- the identifier of the collateral type that had its rate accumulatedsurplusDst
- the destination of the surplus accrued as a result of the rate being accumulatedrateMultiplier
- amount to be accumulateddstCoinBalance
- coin balance of the address that received surplusglobalDebt
- total amount of global debt
Notes
globalDebt
equalsglobalUnbackedDebt
plus the sum ofCollateralType.debtAmount * CollateralType.accumulatedRates
across allcollateralTypes
.globalUnbackedDebt
is the sum of alldebtBalance
s (the total quantity of system debt).CollateralType.debtAmount
the sum of allgeneratedDebt
in thevault
s for thatCollateralType
.
3. Walkthrough
The core Vault, Coin, and collateral state is kept in the SafeEngine
. The SafeEngine
contract has no external dependencies and maintains the central "Accounting Invariants" of Coin. The core principles that apply to the SafeEngine
are as follows:
- Coin cannot exist without collateral:
- A
collateralType
is a particular type of collateral. - Collateral
collateral
is assigned to users withmodifyCollateralBalance
. - Collateral
collateral
is transferred between users withtransferCollateral
.
2. The Vault data structure is the SAFE
:
- has
safeCollateral
- encumbered collateral - has
safeDebt
- encumbered, normalized debt
3. Similarly, a collateral is an collateralType
:
- has
debtAmount
- encumbered, normalized debt - has
accumulatedRate
- debt scaling factor (discussed further below) - has
safetyPrice
- price with safety margin - has
debtCeiling
- debt ceiling - has
debtFloor
- debt floor
Note: Above, when using the term "encumbered", this refers to being "locked in a Vault".
1. Vault Management
- Anyone can manage a Vault via
modifySAFECollateralization
, which modifies the Vault at addresssafe
, usingtokenCollateral
from usercollateralSource
and modifyingcoinBalance
for userdebtDestination
. confiscateSAFECollateralAndDebt
is usually called byLiquidationEngine
and transfers debt from the Vault to another address'debtBalance
.debtBalance
represents bad debt and can be canceled out with an equal quantity of system coins usingsettleDebt(uint rad)
wheremsg.sender
is used as the address for thecoinBalance
anddebtBalance
.
2. Stability Fee Accrual
The accumulatedRates
helps convert normalized debt (generatedDebt
) drawn against a collateralType
to the present value of that debt (actual debt issued + interest). The rate is updated using updateAccumulatedRate
(called by the TaxCollector
). After every update, the newly accrued stability fees are added to the coinBalance
of surplusDst
.
4. Gotchas
The methods in the SafeEngine
are written to be as generic as possible and as such have interfaces that can be quite verbose. Care should be taken that you have not mixed the order of parameters.
Any module that is auth
ed against the SafeEngine
has full root access, and can therefore steal all collateral in the system. This means that the addition of a new collateral type (and associated adapter) carries considerable risk.
5. Failure Modes
Coding Error
A bug in the SafeEngine
could be catastrophic and could lead to the loss (or locking) of all Coin and Collateral in the system. It could become impossible to modify Vault's or to transfer Coin. Auctions could cease to function. Shutdown could fail.
Feeds
The SafeEngine
relies upon a set of trusted oracles to provide price data. Should these price feeds fail, it would become possible for unbacked Coin to be minted, or Vaults could be unfairly liquidated.
Governance
Governance can authorize new modules against the SafeEngine
. This allows them to steal collateral (modifyCollateralBalance
) or mint unbacked Coin (createUnbackedDebt
/ addition of worthless collateral types). Should the cryptoeconomic protections that make doing so prohibitively expensive fail, the system may be vulnerable and left open for bad actors to drain collateral.
Adapters
The SafeEngine
relies on external Adapter contracts to ensure that the collateral balances in the SafeEngine
represent real external collateral balances. Adapter contracts are authorized to make arbitrary modifications to all collateral balances. A faulty collateral adapter could result in the loss of all collateral in the system.