Treasury emergency shutdown option

[rowgraus]

MakerDAO has an emergency shutdown capability which can be triggered by governance. We have discussed the need for such a mechanism. This ticket should organize initial thoughts on how an emergency shutdown should be initiated.

Design considerations:

• Vault owners (capital contributors) must be able to retrieve their net collateral - i.e., excess collateral above their RUN debt position
• RUN owners must be compensated for RUN based on available collateral backing RUN
• Liquidity providers in the AMM can redeem their liquidity
• BLD stakers with outstanding RUN debt are included in the process (pending design)
• To the extent possible, ensure system is robust in adverse circumstances: governance attacks on the chain, severe drop in BLD pricing, failure of core infrastructure such as oracles and/or bridges

Maker's approach is the following:
Step 1: Governance triggers the emergency shutdown module which locks oracle prices and stops additional vault operations among other things
Step 2: Vault owners may withdraw excess collateral from their vaults
Step 3: DAI owners may redeem DAI for pro-rata shares of remaining collateral. If the system is net undercollateralized after Step 2, DAI owners won't receive a full $1 worth of collateral. If there is a remaining surplus from previous Maker operations, DAI owners may receive more than $1 worth of collateral

Challenges with this approach:

• Freezing of oracle prices adds timing urgency to the process. Presumably implemented to improve functioning in adverse scenarios

@dtribble @btulloh for discussion

[Tartuffo]

@rowgraus This does not have an area label that is covered by our weekly tech / planning meetings. Can you assign the proper label? We cover: agd, agoric-cosmos, amm, core economy, cosmic-swingset, endo, getrun, governance, installation-bundling, metering, run-protocol, staking, swingset, swingset-runner, token economy, ui, wallet, zoe, zoe contract

[Tartuffo]

@rowgraus Bump. For proper project planning and tracking, this needs an area label covered by one of our weekly planning meetings. Please pick the appropriate one from: agd, agoric-cli, agoric-cosmos, amm, core economy, cosmic-swingset, endo, ertp, getrun, governance, installation-bundling, metering, oracle, pegasus, run-protocol, ses, staking, swingset, swingset-runner, tc39, token economy, tooling, ui, wallet, xsnap, zoe, zoe contract

[Tartuffo]

@rowgraus @warner Is this issue replaced by the more general work in #4536 or is this dependent by that issue?

[erights]

#4536 is for pausing while we fix something, with the intention that we then resume with minimal disruption.

The description above sounds more like a bankruptcy proceeding as part of permanently terminating operations. Am I misunderstanding?

[rowgraus]

This is replaced by #4536.