papers/lux-credit-protocol-spec/sections/06-failure-behavior.tex

\section{Failure Behavior}

\label{sec:failures}

\subsection{MPC Liveness Failure}
\label{sec:mpc-halt}

\begin{requirement}[MPC Halt Policy]
The protocol \textsc{must} select exactly one mode:

\noindent\textbf{Mode~A: MPC-gated releases.} Mint disabled. Release queue accumulates. No liveness guarantee until $\geq t$ signers recover.

\noindent\textbf{Mode~B: User-executable fallback.} After timeout $T$, users self-relay with burn proof from source chain. Recommended for institutional deployments.
\end{requirement}

\subsection{Stale Backing Report}
\label{sec:stale}

\begin{requirement}[Backing Staleness]
Define $\tau_{\max} = \texttt{maxBackingReportAge}[\texttt{assetId}]$. If no valid \texttt{BACKING\_V1} received within $\tau_{\max}$: mint disabled, burn/release allowed against last confirmed backing, emit \texttt{BackingStale} event.
\end{requirement}

\subsection{Strategy Loss Waterfall}

\begin{requirement}[Loss Absorption]
\begin{enumerate}[nosep]
  \item Loss reduces surplus $E$.
  \item $E \leq 0$: Restricted Mint.
  \item $B < L$: Emergency.
  \item New strategy deployments halted until recapitalization.
\end{enumerate}
\end{requirement}

\subsection{Chain Reorg and Finality}
\label{sec:finality}

\begin{requirement}[Per-Chain Finality]
For each chain $c$: $f_c = \texttt{minFinalityConfirmations}[c]$. Mint and release only after $\geq f_c$ confirmations. A single global constant is \textbf{prohibited}.
\end{requirement}

\subsection{Oracle and Valuation Failure}

\begin{requirement}[Oracle Failure]
Freeze mint for affected asset. Allow only like-for-like redemption. Disable cross-asset accounting on stale prices.
\end{requirement}