Skip to content

Emergency Flow

This document details the emergency and disaster recovery mechanisms within King's Vault V2.

It applies to Ethereum Network Lending, AAVE GHO Saving, and the V2 HLP vault. The separate per-user V3 GHO Staking product is hidden from the public mainnet frontend; these Guardian, pause, and shutdown mechanisms must not be assumed to apply to it.

Pause And Unpause

The Guardian can halt normal vault operations once the pause transaction is confirmed on-chain. Pausing the vault does not itself unwind external positions or recover cross-chain assets.

Function Effect
vault.pause() Blocks all deposit and withdrawal flows.
vault.unpause() Reopens deposit and withdrawal flows if the vault is not permanently shutdown.

Shutdown

In severe scenarios, the Guardian can permanently disable the vault. This action is irreversible.

  1. The Guardian calls vault.shutdown().
  2. The Vault sets _shutdownTime = block.timestamp.
  3. The Vault calls Controller.fundExitOnlyForVault(address(this)).
  4. The Controller invokes the registered strategies' exit paths with the force = true flag. The result depends on each strategy's supported exit behavior.
  5. Normal deposit/withdraw flows are disabled permanently.
  6. Investors can now only call emergencyRedeem(receiver).

Remote Recovery Limitations

HyperStrategy.exit() transfers local Ethereum asset balances only; it does not unwind remote HyperEVM or HLP assets. Shutdown is therefore not confirmation that all HLP capital has returned to the vault. A successful shutdown transaction also does not guarantee full principal recovery from any external strategy.

An engineering-approved HLP recovery runbook is required before treating these mechanisms as an operational recovery procedure. It must address remote positions, assets in flight, pending and executed user requests, the effect of strategy removal on accounting, and verification of recovered funds. This page does not establish a safe transaction ordering for those unresolved cases.

Emergency Redemption

Emergency redemption uses only idle vault assets. It burns all caller shares and transfers a pro-rata share of the currently held idle assets:

userAssets = userShares * idleAssets / totalSupply

Remote or otherwise unrecovered strategy assets are not included in this idle-asset payout. Burning shares for an emergency payout must not be described as a guarantee of later recovery of the full position; handling any subsequent recoveries requires the approved recovery procedure.

In KingsVaultV2Async, emergencyRedeem() first handles any existing async requests:

Request State Behavior
Executed request Claims reserved assets first.
Pending request Returns the escrowed shares to the user.
No request Continues to the base emergency redeem logic.

Harvest Lock

The harvestOnlyForController(token, recipient) function prevents harvesting the native vault asset or the vault share token while the vault is active, or within 7 days after shutdown.

After 7 days from the shutdown() call, the native asset protection expires. This is a privileged sweep capability, not evidence that every remaining balance is dust or that all users have been paid. Operators must reconcile outstanding claims and recovered funds under the approved recovery procedure before treating balances as sweepable.