Skip to content

Circuit-breaker pause for stealth-sender and wraith-names #100

Description

@truthixify

Extra labels: security, feature
Tier: L (5-7 days) | Type: feature + security

Context. Only stealth-announcer has a pause guard today. If a live vuln is disclosed against stealth-sender or wraith-names, the only mitigation is a full upgrade (hours, multi-sig). Withdrawals must remain enabled while paused so users can always exit.

Scope.

  • Add Paused storage + pause / unpause / is_paused gated by Admin.
  • Guard every state-mutating entrypoint EXCEPT withdrawal / reveal / lookup with require_not_paused().
  • Emit Paused / Unpaused events matching the topic pattern in stealth-announcer.
  • Extend PAUSE.md + MULTISIG.md.

Acceptance.

  • cargo test --workspace covers pause / unpause / paused-call rejection for both contracts
  • Withdrawal on stealth-sender and reveal / lookup on wraith-names remain callable while paused (dedicated tests)
  • SAC Smoke and Futurenet Integration still green
  • PAUSE.md updated with the guarded surface per contract

Files. stealth-announcer/src/pause.rs (reference), stealth-sender/src/lib.rs, wraith-names/src/lib.rs, PAUSE.md, EVENT_TOPIC_DESIGN.md.

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programdripsFunded via Drips NetworkfeatureNew feature workhelp wantedExtra attention is neededsecuritySecurity-sensitive workstellarTouches Stellar / Soroban code

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions