Problem
None of the four contracts (loyalty_token, payment, order, restaurant_registry) have a pause or circuit-breaker mechanism. Soroban contracts cannot be patched after deployment - only migrated. If a critical vulnerability is discovered post-launch, there is no way to halt operations while a fix is deployed. Exploitation continues unimpeded until a full contract migration is complete.
Proposed Solution
Add a pause mechanism to all four contracts following the same pattern:
- Add
Paused variant to each contract's DataKey enum
- Add two admin-only functions to each contract:
pub fn pause_contract(env: Env, caller: Address) {
caller.require_auth();
Self::assert_admin_or_panic(&env, &caller);
env.storage().instance().set(&DataKey::Paused, &true);
env.events().publish((symbol_short!("ctrl"), symbol_short!("pause")), env.ledger().timestamp());
}
- Add a guard at the top of every public state-mutating function - admin can operate when paused, all other callers are rejected with
"contract is paused"
Acceptance Criteria
Problem
None of the four contracts (
loyalty_token,payment,order,restaurant_registry) have a pause or circuit-breaker mechanism. Soroban contracts cannot be patched after deployment - only migrated. If a critical vulnerability is discovered post-launch, there is no way to halt operations while a fix is deployed. Exploitation continues unimpeded until a full contract migration is complete.Proposed Solution
Add a pause mechanism to all four contracts following the same pattern:
Pausedvariant to each contract'sDataKeyenum"contract is paused"Acceptance Criteria
pause_contract()andunpause_contract()"contract is paused"unpause_contract()restores normal operation for all callers