The Guardrails

We just watched the Keeper keep the system's pulse steady - fresh prices, fresh risk marks. Now let's walk the perimeter and look at the fences: the guardrails that keep everyone's money protected even when something goes wrong.

The honest way to understand a system like Own isn't to admire what happens when everything behaves. It's to ask, for each thing that could break, "what stops that from becoming a disaster?" So that's how we'll tour the guardrails - each one framed as a worry, then the answer built in. None of this is new machinery; you've met all the pieces. This chapter lines them up so you can see the whole fence at once.

"What if more tokens get minted than the backing can cover?"

This is the foundational one, and Chapter 7 gave you the rule: **net exposure

• whatever the reserves don't cover - may never exceed 65% of the LP collateral pool.** The check runs on the very same path that mints, so there's no gap between "approved" and "counted." A mint that would breach it reverts before a single token exists.

Around that core rule sit the ceilings: a per-asset cap (every asset has a maximum dollar issuance, and an asset with no cap set can't be minted at all) and concentration caps on how much any one collateral vault can count toward the backing.

Notice the fail-safe pattern, because you'll see it repeat all chapter: the default state of everything is "off." An unconfigured asset can't mint. An unarmed force-execution path can't fire. The admin has to deliberately open each gate - forgetting to configure something leaves it safe, not exposed.

"What if a trade settles on a stale or missing price?"

Every risk-increasing action demands freshness: a mint needs the asset's mark pulled within the last hour, a PSM mint needs both legs fresh, an force-execution needs evidence fresh to the minute. No fresh number, no new risk - the trade waits rather than settles wrong. (And as the Keeper chapter promised: exits never wait.)

"What if a signing key leaks?"

Two kinds of keys sign things in this system, and each is fenced separately.

The Oracle's price key is guarded onchain: a new price must come from a registered signer, must be newer than the last one, and can't jump beyond the deviation band from the last accepted price. A stolen price key can nudge the price, briefly - it cannot print Tesla at one dollar. And a compromised signer can be removed instantly.

A maker's quote key is guarded by the market: every quote is single-use, expires in seconds, is bound to this chain and this contract - and, crucially, every settlement must price within the settle band, ±5% of the current mark. A thief with a maker's key can settle a few slightly-off trades against that maker's own wallet; it cannot drain anything past the band, the caps, and the solvency rule.

It's defense in depth: no single key holds the system's safety in its hands.

"What if a wrapper issuer has a corporate action - or just breaks?"

The PSM converts wrapper tokens to eTokens at a ratio derived from two oracle prices, so a wrong wrapper price is a way to mint eTokens too cheap. Three fences stand in the way:

• The ratio-jump guard. If the conversion ratio moves more than a small bound (1.5%) in one step - a stock split landing, an issuer glitch, a bad feed - the PSM freezes that wrapper until a human operator confirms the corporate action and re-arms it. A mispriced oracle can't be laundered through conversions at speed.
• Per-wrapper pauses. Each wrapper can be paused individually - ahead of a known corporate action, or the moment something looks off - without touching the rest of the system. Its fill channel can be darkened separately.
• The netting itself. If a wrapper depegs or its issuer fails outright, the reserve marks down and the uncovered exposure automatically lands on the LP insurance layer - which is sized, by the 65% rule, to carry it.

"What if the dealer takes on risk it can't handle - or just ghosts?"

A market maker that stops performing was Chapter 8's whole story, so here's just the fence-post view: the backing never sits on the maker's balance sheet (the reserve holds it), the LP pool covers the gap window, the redemption waterfall ends in force-execute - and the maker-free PSM lane keeps running throughout, because atomic delivery-versus-payment has nothing to default on.

"What if an asset needs to be stopped - or killed?"

Two levers, deliberately different:

• Trading pause (reversible, per-asset or global): new trades, fills, and even force-executions stop; cancelling orders and LP operations continue. It's the "something looks wrong, freeze the surface" switch.
• Asset halt (permanent): the asset is frozen at a fixed settlement price, forever. Holders redeem at that price from a dedicated halt fund - and the PSM keeps paying out wrapper at the halt price while reserve remains. A halted asset winds down in the open; nobody is stuck holding a token with no exit.

Each collateral vault has its own pair: a vault pause (freezes LP deposits and withdrawals) and a vault halt (emergency wind-down: deposits blocked, LP exits become instant, and the vault's collateral is excluded from the risk pool so the rest of the system stops counting on it).

"What if an LP exit would leave the tokens under-backed?"

The withdrawal queue from Chapter 8 is itself a guardrail: exits wait out their 72 hours, and then only clear if the collateral left behind keeps net exposure inside the 65% cap. LPs aren't trapped - the cushion exists precisely so they can leave - but the system won't let an exit tip everyone else into being under-insured.

"What if a stablecoin issuer freezes an address?"

A niche one, but real: USDC can blocklist addresses, and escrowed refunds could fail. Own refuses to let that brick an order - if returning escrow to a blocklisted user fails, the funds sweep to the treasury and the case is worked out by governance in the open, instead of the order jamming forever.

The whole fence, at a glance

Notice the two patterns across every row. Risk-reducing actions are never blocked - you can always redeem, always exit, always wind down. And every gate fails closed - the unconfigured state of anything is "safe," never "open."

What just happened

• Every mint is checked against the 65% rule, per-asset caps, and concentration caps on the settlement path itself - and everything unconfigured defaults to "can't mint," not "mint freely."
• Freshness gates block stale-price risk; leaked keys are fenced by deviation bands (price key) and single-use quotes inside the settle band (quote key).
• The PSM's ratio-jump guard and per-wrapper pauses contain corporate actions and issuer failures; the netting hands any residual to the insured layer.
• Trading pause is the reversible freeze; asset halt is the permanent, funded wind-down; vaults have their own pause/halt pair.
• LP exits respect the queue and the solvency gate; blocklisted escrow sweeps to the treasury rather than jamming.
• The through-lines: exits are never blocked, and every gate fails closed.