[cryptoharry]

Curve StableSwap's capped EMA creates a downside price floor when inverted to price coins[0]. This adds standalone ChainlinkCurveWindDownFeed under src/feeds, using the existing coin-0 pricing formula with permissionless wind-down and RWG-controlled recovery. ChainlinkCurveFeed is unchanged.

Behaviour

• Constructor parameters: 18-decimal base USD feed, Curve pool, reference oracle index, wind-down duration in seconds and RWG multisig address. The priced asset is always coins[0].
• In live mode, EMA >= 1.9e18 immediately sets updatedAt = 0 while preserving the live price, blocking borrowing wherever FiRM's staleness check is enabled before a keeper starts wind-down. Below the threshold, the upstream timestamp is returned again.
• canStartWindDown() checks only that no wind-down is active and EMA >= 1.9e18. There is no persistence window, additional EMA ceiling or USD timestamp restriction.
• Permissionless startWindDown() records the current USD price (at least 100 raw feed units) and activation time. The recorded price decays linearly to 100 raw 18-decimal feed units ($1e-16) over the configured duration, then remains there until RWG resets it.
• While wind-down is active, timestamps and round IDs are zero and neither price source is consulted. Zero timestamps block borrowing where FiRM's borrowing staleness check is enabled.
• Each activation immediately transfers the feed's entire Ethereum mainnet DOLA balance to its caller, including a zero-value transfer when unfunded. WindDownStarted records activation and the reward.

Eligibility does not guarantee transaction success: activation still needs a readable USD starting price of at least 100 raw feed units and a successful DOLA call. Stale USD timestamps are accepted.

• In live mode, a nonpositive calculated USD price returns (0, 0, 0, 0, 0). FiRM's Oracle rejects that invalid price instead of accepting an artificial near-zero valuation. startWindDown() rejects it before recording activation or paying a reward. Upstream calls and arithmetic can still revert.

The 100-unit terminal floor provides a rounding buffer for downstream LP/vault conversions. The LP calculation remains positive at virtual price >= 0.01e18 when the wind-down feed supplies the minimum coin price; any additional vault conversion must be checked separately. Activation below the floor reverts to prevent decay underflow. Live pricing and the documented V12 invalid-price policy are unchanged.

RWG recovery

stopWindDown() is restricted to the nonzero RWG address fixed at deployment. It clears the recorded starting price and time, restores live pricing, and emits WindDownStopped. It can also be called after the terminal price is reached.

• Upstream timestamps return only when EMA < 1.9e18, allowing borrowing again subject to normal market checks. Stale upstream data remains stale.
• If EMA remains >= 1.9e18, updatedAt remains zero and borrowing stays blocked where the staleness check is enabled. Anyone can immediately start another wind-down.
• Previous DOLA rewards are not refunded. A subsequent activation pays the then-current balance. There is no separate rescue function.
• Stopping does not undo completed liquidations or clear FiRM Oracle's recorded daily lows. Those lows can continue depressing collateral valuation after live pricing returns.

Validation

34 local Foundry tests passed, including 512 fuzz cases. Coverage includes normal pricing, pre-activation threshold blocking and recovery, RWG reset above the threshold, invalid-price propagation and Oracle rejection, activation and decay, rewards, RWG authorization, restoration of live data, repeat activation, recorded-low persistence and expiry, activation below and at the terminal floor, and LP/Yearn rounding and timestamp propagation through Oracle and BorrowController.

forge test --match-path test/feeds/ChainlinkCurveWindDownFeed.t.sol --evm-version shanghai -vv

Draft for review; no deployment has been performed.

[cryptoharry]

Superseded by #144, recreated from dev to remove unrelated branch history and merge conflicts. The feed contract is unchanged; two test setup lines were adjusted for the current borrow controller. Please continue review on #144.