docs: note pause freezes limit-order escrow with no force-refund path (#457) #986

Merged

Brouie merged 1 commit from qa/457-pause-escrow-docs into main

2026-06-30 22:02:08 +00:00

Brouie commented

2026-06-30 19:07:39 +00:00

(Migrated from gitlab.com)

Add a note callout: keep pauses short, state in incident comms that open limit
orders are locked (funds safe but not withdrawable), and the pointer that a
governance-callable emergency force-refund would be a separate implementation
issue if the team wants one.

Docs-only; check_emergency_commands_docs.py passes.

Pausing a pair also blocks CancelLimitOrder(s) and ClaimExpiredLimitOrder(s), so users with resting or expiry-parked limit orders cannot retrieve their escrowed funds for the duration of the pause — and governance has no force-refund path (SweepPair only moves excess balance, not a depositor's locked order). The emergency-commands "Pause a pair" section listed the blocked operations but didn't surface this user-protection consequence for an operator pausing under time pressure (SEC-I03 F-03). Add a note callout: keep pauses short, state in incident comms that open limit orders are locked (funds safe but not withdrawable), and the pointer that a governance-callable emergency force-refund would be a separate implementation issue if the team wants one. Docs-only; check_emergency_commands_docs.py passes.

Brouie commented

2026-06-30 19:07:39 +00:00

(Migrated from gitlab.com)

assigned to @Brouie

Brouie commented

2026-06-30 19:08:58 +00:00

(Migrated from gitlab.com)

mentioned in issue #457

PlasticDigits commented

2026-06-30 19:09:22 +00:00

(Migrated from gitlab.com)

Security review — MR !986

Commit reviewed: 62209b1ff21d3d8790050e6bf6f4d9a328b5e0f8
Scope: Docs-only diff — adds a user-escrow consequence callout to docs/runbooks/emergency-commands.md (pause blocks CancelLimitOrder(s) / ClaimExpiredLimitOrder(s); no governance force-refund path; operational guidance for incident comms).

Method: Inspected full MR diff; traced documented claims against existing on-chain pause gates (invariant L6) and contract tests (claim_expired_limit_order_blocked_while_pair_paused_then_succeeds_after_unpause, batch_cancel_while_paused_reverts). No executable code, config, dependency, or secret-handling changes in this diff.

Outcome: FINDINGS: 0 medium+

Details: The MR documents pre-existing pause semantics for operators; it does not introduce new attack surface, auth bypass, injection sinks, SSRF/XSS vectors, or credential exposure. Markdown links are static GitLab/issue URLs. No inline security threads opened.

Security review: no medium+ findings on this diff.

## Security review — MR !986 **Commit reviewed:** `62209b1ff21d3d8790050e6bf6f4d9a328b5e0f8` **Scope:** Docs-only diff — adds a user-escrow consequence callout to `docs/runbooks/emergency-commands.md` (pause blocks `CancelLimitOrder(s)` / `ClaimExpiredLimitOrder(s)`; no governance force-refund path; operational guidance for incident comms). **Method:** Inspected full MR diff; traced documented claims against existing on-chain pause gates (invariant L6) and contract tests (`claim_expired_limit_order_blocked_while_pair_paused_then_succeeds_after_unpause`, `batch_cancel_while_paused_reverts`). No executable code, config, dependency, or secret-handling changes in this diff. **Outcome:** `FINDINGS: 0` medium+ **Details:** The MR documents pre-existing pause semantics for operators; it does not introduce new attack surface, auth bypass, injection sinks, SSRF/XSS vectors, or credential exposure. Markdown links are static GitLab/issue URLs. No inline security threads opened. Security review: no medium+ findings on this diff.

PlasticDigits commented

2026-06-30 22:02:08 +00:00

(Migrated from gitlab.com)

mentioned in commit a1d92b622a

mentioned in commit a1d92b622a9188cafa68a9c1c881b215e6a74f9d