Emergency Response

If a supported pool shows signs of elevated risk, the Agent is designed to move capital away from that pool and into safer alternatives.

Zyfai uses complementary defense layers to protect user positions during DeFi incidents: autonomous detection and human override for underlying protocol risk, plus an onchain kill switch if the Session Key / executor layer itself is compromised.

1. Autonomous Agent Detection

Most DeFi incidents create one of two risk patterns:

• Collateral depeg: a collateral asset loses its expected value or backing. This can happen because of excessive token minting, flawed protocol design, compromised keys, or oracle issues.
• Liquidity trap: a lending market becomes impossible to exit because borrowers cannot repay debt, liquidity dries up, or the pool enters economic insolvency.

The Agent continuously monitors onchain signals for both patterns. When a depeg or liquidity squeeze is detected, it exits the affected position within minutes, before losses spread further through the market.

2. Human-in-the-Loop Override

Zyfai also maintains a human risk override system.

When a major incident occurs, the Zyfai quants team is alerted and can manually flag a pool as not-live on the Risk Dashboard. Once a pool is flagged, the Agent stops allocating capital to it and begins moving existing user positions away from the affected pool.

Response workflow:

1. The Zyfai team is alerted about a DeFi hack, depeg, key compromise, liquidity issue, or collateral backing concern.
2. Impacted pools are identified across all supported protocols.
3. Affected pools are switched from live to not-live.
4. The Agent exits all positions from flagged pools.
5. Capital is reallocated to safer opportunities or left unallocated when no suitable alternative is available.

3. Session Key Kill Switch

Sections 1 and 2 cover incidents in underlying DeFi protocols. If an incident instead affects the Session Key or Guarded Executor Module layer, Zyfai can halt delegated execution globally.

The Zyfai 3/5 multisig owns the Guarded Executor Module and can call pause() (0x8456cb59) on the module contract. Once paused, all Session Key–driven execution through the module stops immediately: no Agent can move capital via Session Keys until the module is unpaused.

Contract	GuardedExecModule (0xF659d30D4EB88B06A909F20839D8959Bd77d8790 on Base)
Function	pause() — selector 0x8456cb59
Authority	Zyfai 3/5 multisig

User funds remain in their Smart Accounts. Pausing only disables Agent execution via Session Keys; it does not move or seize capital.

Proven Track Record

The protocol-risk layers above have already protected Zyfai users’ capital during real DeFi incidents:

Incident	Threat	Outcome	Post-mortem
Stream Finance exploit	Protocol mismanagement leading to bad debt and collateral depeg	Funds exited before losses affected Zyfai users	Link
Resolv exploit	Operational security failure resulting in compromised protocol key	Positions were rebalanced to safer pools	Link
Aave / Kelp DAO event	Operational security failure, unbacked token minting created liquidity trap after USDC was borrowed against a hardcoded oracle	The Agent exited impacted pools before the liquidity trap formed	Link

In each case, automated monitoring combined with human risk override helped move user capital away from unsafe conditions before losses reached Zyfai users.