AggLayer: Add separate emergency pauser/unpauser roles
- 主要語言
- Rust
- 星號
- 132
- 分支
- 167
- 平均合併
- 1 天 23 小時
- 30 天內合併 PR
- 110
描述
## Description
Beyond the base bridge's simple rollup-manager-controlled emergency state (see [#2696](https://github.com/0xMiden/protocol/issues/2696)), the Solidity sovereign chain extension ([`BridgeL2SovereignChain.sol`](https://github.com/agglayer/agglayer-contracts/blob/main/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol)) introduces dedicated pauser and unpauser roles with granular access control:
- A separate `emergencyBridgePauser` role can activate emergency state via `activateEmergencyState()` (gated by `onlyEmergencyBridgePauser`)
- A separate `emergencyBridgeUnpauser` role can deactivate emergency state via `deactivateEmergencyState()` (gated by `onlyEmergencyBridgeUnpauser`)
- Both roles use two-step transfer (`transferEmergencyBridgePauserRole()` / `acceptEmergencyBridgePauserRole()` and equivalent unpauser functions) to prevent accidental role loss
This separation ensures that pausing and unpausing are controlled by different entities, providing defense-in-depth (e.g., a compromised pauser cannot also unpause).
The Miden bridge currently has no emergency pause mechanism at all (see [#2696](https://github.com/0xMiden/protocol/issues/2696)). The sovereign chain's separation of pauser/unpauser roles is therefore also absent.
## Impact
Even if a basic emergency pause is implemented (per [#2696](https://github.com/0xMiden/protocol/issues/2696)), without role separation a single compromised account could both pause and unpause the bridge, reducing the security benefit. An attacker who compromises the bridge admin could unpause the bridge immediately after a legitimate pause.
## Recommended Action
Depends on [#2696](https://github.com/0xMiden/protocol/issues/2696) being implemented first. Replace the single bridge-admin-gated pause toggle from 001a with separate `activate_emergency_state` and `deactivate_emergency_state` procedures, each gated by a dedicated role (emergency pauser and emergency unpauser respectively). Store these roles using the `Ownable2Step` pattern from `miden-standards` to support two-step role transfers, preventing accidental role loss.
## References
- [`BridgeL2SovereignChain.sol`](https://github.com/agglayer/agglayer-contracts/blob/main/contracts/v2/sovereignChains/BridgeL2SovereignChain.sol)
- [`ownable2step.masm`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-standards/asm/standards/access/ownable2step.masm)
- [`bridge_config.masm`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-agglayer/asm/agglayer/bridge/bridge_config.masm)
- [`bridge.rs`](https://github.com/0xMiden/miden-base/blob/next/crates/miden-agglayer/src/bridge.rs)
- [#2696 - Add emergency pause mechanism](https://github.com/0xMiden/protocol/issues/2696) (prerequisite)
## Classification
This feature is part of the sovereign chain extension (`BridgeL2SovereignChain`), not the base bridge contract.
貢獻指南
評估
這個 Issue 還沒有評估資料。