0xMiden / 0xMiden/protocol

AggLayer: Add separate emergency pauser/unpauser roles

オープン
#2,701 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
agglayer
主要言語
Rust
スター
132
フォーク
167
平均マージ
1日 23時間
マージ済み PR(30日)
110

説明

## Description

Beyond the base bridge's simple rollup-manager-controlled emergency state (see [#2696](https://github.com/0xMiden/protocol/issues/2696)), the Solidity sovereign chain extension ([`BridgeL2SovereignChain.sol`](https://github.com/agglayer/agglayer-contracts/blob/main/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol)) introduces dedicated pauser and unpauser roles with granular access control:

- A separate `emergencyBridgePauser` role can activate emergency state via `activateEmergencyState()` (gated by `onlyEmergencyBridgePauser`)
- A separate `emergencyBridgeUnpauser` role can deactivate emergency state via `deactivateEmergencyState()` (gated by `onlyEmergencyBridgeUnpauser`)
- Both roles use two-step transfer (`transferEmergencyBridgePauserRole()` / `acceptEmergencyBridgePauserRole()` and equivalent unpauser functions) to prevent accidental role loss

This separation ensures that pausing and unpausing are controlled by different entities, providing defense-in-depth (e.g., a compromised pauser cannot also unpause).

The Miden bridge currently has no emergency pause mechanism at all (see [#2696](https://github.com/0xMiden/protocol/issues/2696)). The sovereign chain's separation of pauser/unpauser roles is therefore also absent.

## Impact

Even if a basic emergency pause is implemented (per [#2696](https://github.com/0xMiden/protocol/issues/2696)), without role separation a single compromised account could both pause and unpause the bridge, reducing the security benefit. An attacker who compromises the bridge admin could unpause the bridge immediately after a legitimate pause.

## Recommended Action

Depends on [#2696](https://github.com/0xMiden/protocol/issues/2696) being implemented first. Replace the single bridge-admin-gated pause toggle from 001a with separate `activate_emergency_state` and `deactivate_emergency_state` procedures, each gated by a dedicated role (emergency pauser and emergency unpauser respectively). Store these roles using the `Ownable2Step` pattern from `miden-standards` to support two-step role transfers, preventing accidental role loss.

## References

- [`BridgeL2SovereignChain.sol`](https://github.com/agglayer/agglayer-contracts/blob/main/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol)
- [`ownable2step.masm`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-standards/asm/standards/access/ownable2step.masm)
- [`bridge_config.masm`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-agglayer/asm/agglayer/bridge/bridge_config.masm)
- [`bridge.rs`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-agglayer/src/bridge.rs)
- [#2696 - Add emergency pause mechanism](https://github.com/0xMiden/protocol/issues/2696) (prerequisite)

## Classification

This feature is part of the sovereign chain extension (`BridgeL2SovereignChain`), not the base bridge contract.

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。