> For the complete documentation index, see [llms.txt](https://city-protocol.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://city-protocol.gitbook.io/docs/security/security-and-risk/risk-isolation-and-emergency-controls.md).

# Risk isolation and emergency controls

How failures stay contained, where liquidation and unwinding can occur, and how the system pauses.

## Risk isolation

Each part of the system is isolated so that a failure stays within the unit where it occurs.

* **Per-vault isolation:** Each Curated Vault is a separate set of contracts with its own mandate, access policy, limits, strategy manager, debt caps and oracle.
* **Bounded strategies:** Strategy execution is restricted to allowlisted strategies, approved targets and approved actions, with debt caps and balance-delta verification; a failed check reverts the whole transaction.
* **Protected balances:** Unsettled deposits and assets reserved for redemption claims are excluded from strategy allocation.
* **Per-account portfolios:** OTP assets sit in each participant's own smart account, so every portfolio is isolated from every other.
* **Controlled composition:** Products hold only whitelisted components, and component status propagates to every product that holds it.
* **Role separation:** Operating duties are split across vault creators, strategy managers, NAV signers, guardians and operators, so moving user assets requires approval from more than one role.

## Liquidation and unwind logic

Participant positions in Curated Vaults and OTPs carry no margin requirement, so the protocol has no liquidation path for a participant's position. Liquidation and unwinding occur at three other points, each governed by rules set in advance.

* **Collateral inside credit strategies:** A vault that finances loans or receivables sets a target and a minimum collateralization ratio in its mandate, such as the 150% target and 120% minimum of the RWA-backed lending template; coverage below the minimum triggers the vault's circuit breakers and the mandate's liquidation policy.
* **Leverage and drawdown inside trading strategies:** Mandates cap leverage and set a drawdown threshold, and a breach triggers circuit breakers that can pause deposits, withdrawals, allocation or strategy execution.
* **Redemptions and wind-down:** An epoch redemption locks its price at epoch close, the strategy manager returns the required capital on the redemption schedule, and claims become payable only when the settlement assets are present. A vault wind-down strikes a final NAV, liquidates components and opens claims. A retired OTP leaves every asset with its participants.

## Emergency controls

Pause controls are layered across the vault, deposits, redemptions, share transfers, strategy allocation and strategy execution, and pause and unpause are separate roles, so emergency response is fast and resumption requires review.

<figure><img src="https://3297077862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJxNp2waFk6hg1G4lEQZu%2Fuploads%2FpEKWxEzpFOe4B27VOVmL%2Ffig-emergency.png?alt=media" alt="Circuit-breaker triggers pause vault functions, while OTP exit stays open"><figcaption><p>Circuit breakers pause the affected functions. On the OTP side, participant exit stays open because the participant alone executes it.</p></figcaption></figure>

Automated circuit breakers pause the affected functions on any of the following:

* NAV deviation beyond policy;
* collateralization below the minimum;
* stale oracle data;
* unauthorized strategy debt;
* allocation above quota;
* abnormal withdrawal pressure;
* signer quorum failure;
* suspicious transaction patterns.

On the OTP side, a pause halts new subscriptions and published list changes, while participant exit stays open because the participant alone executes it.