Problem Statement / Feature Objective
In the event of a security incident (exploit, compromised admin key, critical bug), there is currently no way to halt contract operations across the entire protocol. Each contract must be paused individually by its admin, which is slow and inconsistent. A global emergency pause mechanism must be implemented using a circuit-breaker contract that, when triggered by a governance multisig (5-of-7), propagates a pause signal to all registered contracts. Each contract checks the circuit-breaker's state before executing any state-modifying operation and reverts with ContractPaused if the system is paused.
Technical Invariants & Bounds
- Circuit-breaker contract: stores
(paused: bool, paused_by: Address, paused_at: u64, unpause_ledger_delay: u32).
- Governance multisig: 5-of-7 authorized pausers; each pauser is a known contract address.
- Pause propagation: circuit-breaker emits
SystemPaused(pauser) event; all contracts poll circuit-breaker's is_paused() before mutating state.
- Gas cost of pause check: < 100 gas per contract call (single data entry read).
- Unpause: delayed by
UNPAUSE_LEDGER_DELAY = 10 ledgers after unpause transaction is submitted; this gives token holders time to exit if they disagree.
- Emergency mode: when paused, only
withdraw() and query() operations are permitted; all mint(), burn(), upgrade(), settle() operations revert.
- Per-contract whitelist: each contract can declare certain entry points as
#[pause_immune] (e.g., balance_of(), is_revoked()) that work even during pause.
Codebase Navigation Guide
contracts/circuit-breaker/src/lib.rs — new circuit-breaker contract.contracts/circuit-breaker/src/governance.rs — multisig pauser management.contracts/*/src/pause.rs — each contract adds pause-check guard macro.contracts/*/src/lib.rs — annotate entry points with #[pauseable] or #[pause_immune].
Problem Statement / Feature Objective
In the event of a security incident (exploit, compromised admin key, critical bug), there is currently no way to halt contract operations across the entire protocol. Each contract must be paused individually by its admin, which is slow and inconsistent. A global emergency pause mechanism must be implemented using a
circuit-breakercontract that, when triggered by a governance multisig (5-of-7), propagates a pause signal to all registered contracts. Each contract checks the circuit-breaker's state before executing any state-modifying operation and reverts withContractPausedif the system is paused.Technical Invariants & Bounds
(paused: bool, paused_by: Address, paused_at: u64, unpause_ledger_delay: u32).SystemPaused(pauser)event; all contracts poll circuit-breaker'sis_paused()before mutating state.UNPAUSE_LEDGER_DELAY = 10ledgers after unpause transaction is submitted; this gives token holders time to exit if they disagree.withdraw()andquery()operations are permitted; allmint(),burn(),upgrade(),settle()operations revert.#[pause_immune](e.g.,balance_of(),is_revoked()) that work even during pause.Codebase Navigation Guide
contracts/circuit-breaker/src/lib.rs— new circuit-breaker contract.contracts/circuit-breaker/src/governance.rs— multisig pauser management.contracts/*/src/pause.rs— each contract adds pause-check guard macro.contracts/*/src/lib.rs— annotate entry points with#[pauseable]or#[pause_immune].