0xMiden / 0xMiden/protocol

AggLayer: Add separate emergency pauser/unpauser roles

Open
#2,701 0 comments 0 reactions 0 assignees View on GitHub
agglayer
Dominant language
Rust
Stars
132
Forks
167
Avg merge
1d 23h
Merged PRs (30d)
110

Description

## Description

Beyond the base bridge's simple rollup-manager-controlled emergency state (see [#2696](https://github.com/0xMiden/protocol/issues/2696)), the Solidity sovereign chain extension ([`BridgeL2SovereignChain.sol`](https://github.com/agglayer/agglayer-contracts/blob/main/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol)) introduces dedicated pauser and unpauser roles with granular access control:

- A separate `emergencyBridgePauser` role can activate emergency state via `activateEmergencyState()` (gated by `onlyEmergencyBridgePauser`)
- A separate `emergencyBridgeUnpauser` role can deactivate emergency state via `deactivateEmergencyState()` (gated by `onlyEmergencyBridgeUnpauser`)
- Both roles use two-step transfer (`transferEmergencyBridgePauserRole()` / `acceptEmergencyBridgePauserRole()` and equivalent unpauser functions) to prevent accidental role loss

This separation ensures that pausing and unpausing are controlled by different entities, providing defense-in-depth (e.g., a compromised pauser cannot also unpause).

The Miden bridge currently has no emergency pause mechanism at all (see [#2696](https://github.com/0xMiden/protocol/issues/2696)). The sovereign chain's separation of pauser/unpauser roles is therefore also absent.

## Impact

Even if a basic emergency pause is implemented (per [#2696](https://github.com/0xMiden/protocol/issues/2696)), without role separation a single compromised account could both pause and unpause the bridge, reducing the security benefit. An attacker who compromises the bridge admin could unpause the bridge immediately after a legitimate pause.

## Recommended Action

Depends on [#2696](https://github.com/0xMiden/protocol/issues/2696) being implemented first. Replace the single bridge-admin-gated pause toggle from 001a with separate `activate_emergency_state` and `deactivate_emergency_state` procedures, each gated by a dedicated role (emergency pauser and emergency unpauser respectively). Store these roles using the `Ownable2Step` pattern from `miden-standards` to support two-step role transfers, preventing accidental role loss.

## References

- [`BridgeL2SovereignChain.sol`](https://github.com/agglayer/agglayer-contracts/blob/main/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol)
- [`ownable2step.masm`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-standards/asm/standards/access/ownable2step.masm)
- [`bridge_config.masm`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-agglayer/asm/agglayer/bridge/bridge_config.masm)
- [`bridge.rs`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-agglayer/src/bridge.rs)
- [#2696 - Add emergency pause mechanism](https://github.com/0xMiden/protocol/issues/2696) (prerequisite)

## Classification

This feature is part of the sovereign chain extension (`BridgeL2SovereignChain`), not the base bridge contract.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.