Sunset
The terminal mode — how it starts, what it changes, the ninety-day clock, and why nobody can block an exit.
Sunset is the protocol's end of life, designed on day one and working without anybody. It is a global, one-way state that stops new issuance, opens every exit, removes every fee from the USDG gate, and sends 100% of remaining interest to the Stability Pools.
Most protocols discover they need this after they need it. Lybra spent eighteen months voting on a USDC vault; Prisma ended at 1.45 USD. Fyber's version is a formula with two triggers and no vote (principle P10).
Triggers
function flagSunset() external; // permissionless when the condition holds
function enterSunset() external; // permissionless at least one hour later, if the condition still holds
function sunsetAt() external view returns (uint64);Two mechanical conditions, either sufficient (Rule R-6.9.7):
- At least two activated branches are in shutdown. Two independent branch failures is the point at which the remaining branches are carrying a risk the design did not assume.
- The aggregate TCR is below 130%. Measured across activated branches, and required to hold for at least an hour between the flag and the entry.
Plus one discretionary route while the Closer lives: shutdownAll() produces the same state immediately and without condition (Rule R-12.5.1).
Guarantee
A protocol with no users but sound collateral stays open indefinitely. There is no inactivity trigger, no expiry date on the contracts, no mechanism that winds the system down because it is small. Only insolvency or repeated branch failure starts a Sunset (Rule R-6.9.7).
The one-hour delay between flag and entry exists so that a momentary reading cannot trigger a terminal state. There is no fourteen-day timelock, because a timelock on a wind-down is a fourteen-day window during which everybody knows the exit is coming and the exit is not yet open.
Immediate effects
At sunsetAt (Rule R-12.5.2):
| Component | Change |
|---|---|
| Every branch | borrow and open disabled |
| PSM | feeIn = 0, feeOut = 0, capShare = 100%, any Closer intake freeze lifted |
InterestRouter | Sunset regime: 100% to the Stability Pools, 0 to treasury, backstop and incentives |
| Redemptions | urgentRedeem open on every branch that is not shut, at the current oracle price with a 2% bonus and zero fee, whenever the branch is not in FROZEN; at lastGood on shut branches |
| Stability Pools | Withdrawals immediate — as they always were |
| Dormant branches | Activation becomes permanently impossible |
| Market states and liquidations | Unchanged and still active |
That last row is deliberate. Suspending liquidations during a wind-down would create ninety days of positions nobody can liquidate against a market that keeps moving. The states, the thresholds, the buckets and the bonuses all keep working exactly as before (Rule R-12.5.3).
What each participant does
Borrowers. Repay in fyUSD, or in USDG through repayWithUSDG at par with no fee, and close. Nothing forces them out. Interest keeps accruing at their chosen rate for ninety days, then stops entirely.
fyUSD holders. Two exits. Either PSM.swapOut for USDG at par with no fee, limited by the reserve; or urgentRedeem against any position of their choosing on any non-shut branch, receiving collateral worth 102% of the fyUSD burned. The 2% bonus is what makes holders leave before borrowers have to, which is the ordering that keeps the wind-down orderly.
Stability Pool depositors. Withdraw, which was never blocked, and claim any collateral. The yield rises briefly — 100% of interest instead of 90% — and then falls with the debt.
Wrapper holders. sfyUSD.redeem for fyUSD, redeemInKind for the exact pro-rata mix, or Router.withdrawToUSDG which converts what the reserve allows and hands back the rest in fyUSD.
The ninety-day clock
How it is calculated
At sunsetAt + 90 days, a final accrual runs and the interest clock of every branch freezes
permanently. This is equivalent to forcing every borrower's rate to zero (Rule R-12.5.4).
Ninety days is long enough for a borrower who is not watching to notice and act, and short enough that the residue is not left accruing interest against a protocol nobody is running. After that date a position simply sits there: debt fixed, collateral fixed, repayable and closable forever.
Terminal equilibrium
The state the system converges to (Rule R-12.5.5):
- Debt goes to zero as borrowers repay and holders redeem.
reserve == minted[PSM], which is the standing PSM invariant and means every remaining PSM-minted fyUSD can still be exchanged for USDG one for one.- Residual collateral sits in
collSurplusand stays claimable, with no time limit and no expiry. - The contracts stay deployed forever.
Guarantee
No role can block an exit at any point of a Sunset. repay, close, claimSurplus, pool
withdrawal, claimCollateral, swapOut, sfyUSD.redeem and urgentRedeem are on the list of
operations that no state and no key can prevent, and Sunset is one-way, so the Closer cannot
reverse it either (Rule R-4.4.1, Rule R-12.5.1).
Branch shutdown compared to Sunset
They are different scopes with related mechanics:
| Branch shutdown | Sunset | |
|---|---|---|
| Scope | One branch | The whole protocol |
| Triggers | TCR below SCR for an hour; degraded state beyond 7 days; the Closer; an unresolved upgrade freeze at 28 days | Two shut branches; aggregate TCR below 130% for an hour; shutdownAll() |
| Price used | lastGood, frozen | Current oracle price on branches that are not shut |
| Minting | Stopped on that branch | Stopped everywhere |
| Liquidations | Stopped on that branch, replaced by settlement | Continue normally |
| Interest | Frozen at shutdown | Continues 90 days, then frozen |
| PSM | Unchanged | Fees zero, cap 100% |
| Reversible | No | No |
A branch shutdown that leaves only one activated branch running does not by itself start a Sunset; two shut branches do.
Post-shutdown settlement
Thirty days after urgent redemptions open on a shut branch, any remaining position can be settled by anyone (Rule R-6.9.8):
function settleAfterShutdown(address user) external; // permissionlessThe debt is absorbed by that branch's Stability Pool at lastGood, with zero bonus and zero keeper share, up to the pool's deposits; any remainder may be paid by the caller in fyUSD, again at zero bonus; unconsumed collateral goes to collSurplus[user]; a residual debt with no collateral becomes bad debt; the position closes.
This is what makes a shut branch converge instead of holding open positions indefinitely against a frozen price. The owner's surplus remains claimable forever.
What Sunset does not do
It does not sell anybody's collateral. It does not force any position closed before the settlement window. It does not transfer any asset to any address chosen by anybody. It does not change a single risk parameter — the ratios, bonuses, buckets and caps in force at sunsetAt are the ones in force at the end.
Last reviewed: 2026-09-07 · Spec v0.4