Skip to content

[CO-10] Implement emergency pause mechanism across all four contracts #288

Description

@Leothosine

Problem

None of the four contracts (loyalty_token, payment, order, restaurant_registry) have a pause or circuit-breaker mechanism. Soroban contracts cannot be patched after deployment - only migrated. If a critical vulnerability is discovered post-launch, there is no way to halt operations while a fix is deployed. Exploitation continues unimpeded until a full contract migration is complete.

Proposed Solution

Add a pause mechanism to all four contracts following the same pattern:

  1. Add Paused variant to each contract's DataKey enum
  2. Add two admin-only functions to each contract:
pub fn pause_contract(env: Env, caller: Address) {
    caller.require_auth();
    Self::assert_admin_or_panic(&env, &caller);
    env.storage().instance().set(&DataKey::Paused, &true);
    env.events().publish((symbol_short!("ctrl"), symbol_short!("pause")), env.ledger().timestamp());
}
  1. Add a guard at the top of every public state-mutating function - admin can operate when paused, all other callers are rejected with "contract is paused"

Acceptance Criteria

  • All four contracts have pause_contract() and unpause_contract()
  • Non-admin callers on a paused contract receive a panic with "contract is paused"
  • Admin can call state-mutating functions even when the contract is paused
  • unpause_contract() restores normal operation for all callers
  • Each contract emits a timestamped pause/unpause event
  • Unit test per contract: pause ? user call panics ? admin call succeeds ? unpause ? user call succeeds

Metadata

Metadata

Assignees

Labels

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions