0xMiden / 0xMiden/protocol

AggLayer: Add separate emergency pauser/unpauser roles

Đang mở
#2,701 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
agglayer
Ngôn ngữ chính
Rust
Star
132
Fork
167
Merge trung bình
1 ngày 23 giờ
Pull request đã merge (30 ngày)
110

Mô tả

## Description

Beyond the base bridge's simple rollup-manager-controlled emergency state (see [#2696](https://github.com/0xMiden/protocol/issues/2696)), the Solidity sovereign chain extension ([`BridgeL2SovereignChain.sol`](https://github.com/agglayer/agglayer-contracts/blob/main/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol)) introduces dedicated pauser and unpauser roles with granular access control:

- A separate `emergencyBridgePauser` role can activate emergency state via `activateEmergencyState()` (gated by `onlyEmergencyBridgePauser`)
- A separate `emergencyBridgeUnpauser` role can deactivate emergency state via `deactivateEmergencyState()` (gated by `onlyEmergencyBridgeUnpauser`)
- Both roles use two-step transfer (`transferEmergencyBridgePauserRole()` / `acceptEmergencyBridgePauserRole()` and equivalent unpauser functions) to prevent accidental role loss

This separation ensures that pausing and unpausing are controlled by different entities, providing defense-in-depth (e.g., a compromised pauser cannot also unpause).

The Miden bridge currently has no emergency pause mechanism at all (see [#2696](https://github.com/0xMiden/protocol/issues/2696)). The sovereign chain's separation of pauser/unpauser roles is therefore also absent.

## Impact

Even if a basic emergency pause is implemented (per [#2696](https://github.com/0xMiden/protocol/issues/2696)), without role separation a single compromised account could both pause and unpause the bridge, reducing the security benefit. An attacker who compromises the bridge admin could unpause the bridge immediately after a legitimate pause.

## Recommended Action

Depends on [#2696](https://github.com/0xMiden/protocol/issues/2696) being implemented first. Replace the single bridge-admin-gated pause toggle from 001a with separate `activate_emergency_state` and `deactivate_emergency_state` procedures, each gated by a dedicated role (emergency pauser and emergency unpauser respectively). Store these roles using the `Ownable2Step` pattern from `miden-standards` to support two-step role transfers, preventing accidental role loss.

## References

- [`BridgeL2SovereignChain.sol`](https://github.com/agglayer/agglayer-contracts/blob/main/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol)
- [`ownable2step.masm`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-standards/asm/standards/access/ownable2step.masm)
- [`bridge_config.masm`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-agglayer/asm/agglayer/bridge/bridge_config.masm)
- [`bridge.rs`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-agglayer/src/bridge.rs)
- [#2696 - Add emergency pause mechanism](https://github.com/0xMiden/protocol/issues/2696) (prerequisite)

## Classification

This feature is part of the sovereign chain extension (`BridgeL2SovereignChain`), not the base bridge contract.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.