A circuit breaker is code that halts or throttles a protocol when activity crosses a defined threshold. It exists because contract exploits usually drain funds far faster than humans can respond.
Why speed forces automation
An exploit that works once can usually be repeated in the same block or the next one. The window between the first suspicious transaction and total loss is often measured in seconds.
Human governance cannot operate at that speed. A vote takes days, and even an emergency multisignature wallet needs signers to be awake, informed and in agreement.
Breakers close the gap by encoding a response in advance. The protocol reacts to a condition without waiting for anyone to interpret what is happening.
What the conditions usually measure
The most common trigger is an outflow rate: how much of a pool leaves within a rolling window. Normal usage stays well under the limit while a drain crosses it immediately.
Others watch price inputs, halting borrowing when an oracle moves more than a set amount in a short period or when feeds disagree beyond a tolerance.
Some track invariants directly, such as whether total shares still correspond to total assets. A violated invariant is strong evidence that something is wrong regardless of the cause.
Pausing is not the only response
A full pause stops everything, including liquidations and repayments. That can convert a solvency problem into a worse one if collateral keeps falling while the system is frozen.
Rate limiting is gentler. Withdrawals continue but are capped per window, so an attacker extracts a small fraction while ordinary users experience a delay rather than a lockout.
Selective pauses are common in practice: new borrowing is disabled while repayment and liquidation stay open, preserving the mechanisms that reduce risk.
Every breaker creates a control point
A contract that can be paused has an address authorized to pause it. That authority is a permission, and permissions can be misused, lost or captured.
Protocols narrow the surface by separating the ability to pause from the ability to resume or upgrade. A guardian may halt the system while only governance can restart it.
Time delays are added for the same reason. A pause that expires automatically after a fixed period cannot be used to strand funds indefinitely.
False positives carry their own cost
Volatile markets produce large legitimate outflows, and a breaker calibrated tightly will fire during ordinary stress rather than during an attack.
A pause during a sell-off blocks users from repaying loans or adding collateral, which can push otherwise healthy positions into liquidation once trading resumes.
Calibration is therefore a judgment about which failure is worse, and the thresholds a protocol publishes reveal how its designers answered that question.