> ## Documentation Index
> Fetch the complete documentation index at: https://zyfai.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Emergency Response

If a supported pool shows signs of elevated risk, the Agent is designed to move capital away from that pool and into safer alternatives.

Zyfai uses complementary defense layers to protect user positions during DeFi incidents: autonomous detection and human override for underlying protocol risk, plus an onchain kill switch if the [Session Key](/docs/product/control/session-keys) / executor layer itself is compromised.

## 1. Autonomous Agent Detection

Most DeFi incidents create one of two risk patterns:

* **Collateral depeg**: a collateral asset loses its expected value or backing. This can happen because of excessive token minting, flawed protocol design, compromised keys, or oracle issues.
* **Liquidity trap**: a lending market becomes impossible to exit because borrowers cannot repay debt, liquidity dries up, or the pool enters economic insolvency.

The Agent continuously monitors onchain signals for both patterns. When a depeg or liquidity squeeze is detected, it exits the affected position within minutes, before losses spread further through the market.

## 2. Human-in-the-Loop Override

Zyfai also maintains a human risk override system.

When a major incident occurs, the Zyfai quants team is alerted and can manually flag a pool as **not-live** on the [Risk Dashboard](https://risk.zyf.ai/). Once a pool is flagged, the Agent stops allocating capital to it and begins moving existing user positions away from the affected pool.

**Response workflow:**

1. The Zyfai team is alerted about a DeFi hack, depeg, key compromise, liquidity issue, or collateral backing concern.
2. Impacted pools are identified across all supported protocols.
3. Affected pools are switched from *live* to *not-live*.
4. The Agent exits all positions from flagged pools.
5. Capital is reallocated to safer opportunities or left unallocated when no suitable alternative is available.

## 3. Session Key Kill Switch

Sections 1 and 2 cover incidents in underlying DeFi protocols. If an incident instead affects the Session Key or [Guarded Executor Module](/docs/product/control/proxy) layer, Zyfai can halt delegated execution globally.

The Zyfai **3/5 multisig** owns the Guarded Executor Module and can call `pause()` (`0x8456cb59`) on the module contract. Once paused, all Session Key–driven execution through the module stops immediately: no Agent can move capital via Session Keys until the module is unpaused.

|               |                                                                                                                                                                        |
| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Contract**  | [GuardedExecModule](https://basescan.org/address/0xF659d30D4EB88B06A909F20839D8959Bd77d8790#writeProxyContract) (`0xF659d30D4EB88B06A909F20839D8959Bd77d8790` on Base) |
| **Function**  | `pause()` — selector `0x8456cb59`                                                                                                                                      |
| **Authority** | Zyfai 3/5 multisig                                                                                                                                                     |

User funds remain in their Smart Accounts. Pausing only disables Agent execution via Session Keys; it does not move or seize capital.

## Proven Track Record

The protocol-risk layers above have already protected Zyfai users' capital during real DeFi incidents:

| Incident               | Threat                                                                                                                         | Outcome                                                          | Post-mortem                                             |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------- | ------------------------------------------------------- |
| Stream Finance exploit | Protocol mismanagement leading to bad debt and collateral depeg                                                                | Funds exited before losses affected Zyfai users                  | [Link](https://x.com/Zyfai_/status/1986142087973380410) |
| Resolv exploit         | Operational security failure resulting in compromised protocol key                                                             | Positions were rebalanced to safer pools                         | [Link](https://x.com/Zyfai_/status/2036119040528375853) |
| Aave / Kelp DAO event  | Operational security failure, unbacked token minting created liquidity trap after USDC was borrowed against a hardcoded oracle | The Agent exited impacted pools before the liquidity trap formed | [Link](https://x.com/Zyfai_/status/2046247388403339763) |

In each case, automated monitoring combined with human risk override helped move user capital away from unsafe conditions before losses reached Zyfai users.