0xMiden / 0xMiden/protocol

AggLayer: Add separate emergency pauser/unpauser roles

未关闭
#2,701 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
agglayer
主要语言
Rust
星标
132
派生
167
平均合并
1 天 23 小时
30 天内合并 PR
110

描述

## Description

Beyond the base bridge's simple rollup-manager-controlled emergency state (see [#2696](https://github.com/0xMiden/protocol/issues/2696)), the Solidity sovereign chain extension ([`BridgeL2SovereignChain.sol`](https://github.com/agglayer/agglayer-contracts/blob/main/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol)) introduces dedicated pauser and unpauser roles with granular access control:

- A separate `emergencyBridgePauser` role can activate emergency state via `activateEmergencyState()` (gated by `onlyEmergencyBridgePauser`)
- A separate `emergencyBridgeUnpauser` role can deactivate emergency state via `deactivateEmergencyState()` (gated by `onlyEmergencyBridgeUnpauser`)
- Both roles use two-step transfer (`transferEmergencyBridgePauserRole()` / `acceptEmergencyBridgePauserRole()` and equivalent unpauser functions) to prevent accidental role loss

This separation ensures that pausing and unpausing are controlled by different entities, providing defense-in-depth (e.g., a compromised pauser cannot also unpause).

The Miden bridge currently has no emergency pause mechanism at all (see [#2696](https://github.com/0xMiden/protocol/issues/2696)). The sovereign chain's separation of pauser/unpauser roles is therefore also absent.

## Impact

Even if a basic emergency pause is implemented (per [#2696](https://github.com/0xMiden/protocol/issues/2696)), without role separation a single compromised account could both pause and unpause the bridge, reducing the security benefit. An attacker who compromises the bridge admin could unpause the bridge immediately after a legitimate pause.

## Recommended Action

Depends on [#2696](https://github.com/0xMiden/protocol/issues/2696) being implemented first. Replace the single bridge-admin-gated pause toggle from 001a with separate `activate_emergency_state` and `deactivate_emergency_state` procedures, each gated by a dedicated role (emergency pauser and emergency unpauser respectively). Store these roles using the `Ownable2Step` pattern from `miden-standards` to support two-step role transfers, preventing accidental role loss.

## References

- [`BridgeL2SovereignChain.sol`](https://github.com/agglayer/agglayer-contracts/blob/main/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol)
- [`ownable2step.masm`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-standards/asm/standards/access/ownable2step.masm)
- [`bridge_config.masm`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-agglayer/asm/agglayer/bridge/bridge_config.masm)
- [`bridge.rs`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-agglayer/src/bridge.rs)
- [#2696 - Add emergency pause mechanism](https://github.com/0xMiden/protocol/issues/2696) (prerequisite)

## Classification

This feature is part of the sovereign chain extension (`BridgeL2SovereignChain`), not the base bridge contract.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。