Watch

WIP: Draft: feat(security): oracle circuit-breaker fails window closed on pause (#22) #39

Closed

PlasticDigits wants to merge 0 commits from 22-feat-security-c-2-oracle-circuit-breaker-pause-fails-window-closed-on-vfdusd-collapse into main

PlasticDigits commented

2026-08-08 04:52:49 +00:00

(Migrated from gitlab.com)

Summary

Implements only the oracle-level pause / circuit-breaker portion of audit C-2 #1 (issue #22):

Oracle State now surfaces paused (from Config) so window readers see the breaker on the query they already use.
Window ensure_oracle_usable rejects deposit and withdraw with OraclePaused before staleness checks (fresh last_update_sec cannot bypass).
Governance-only SetPaused / unpause preserved; UpdateRate still blocked while paused.
Oracle service skips UpdateRate when state.paused.
Docs + INV-ORACLE-PAUSE-001 + agent skill skills/oracle-circuit-breaker.

Not in this MR (explicitly out of scope): emergency rate reset / monotonic bypass; operator TripCircuitBreaker; spot-vs-rate alerter.

Test plan

cargo test -p ust1-oracle --lib (incl. pause ACL + State.paused)
cargo test -p ust1-window --lib (pause→halt→unpause→resume; stale still stale; window pause vs oracle pause)
cargo test -p ust1-integration-tests --lib
Mainnet: migrate oracle then window; governance smoke set_paused:true and confirm window swaps revert immediately
Ops: follow DEPLOYMENT emergency pause

Closes #22

## Summary Implements **only** the oracle-level pause / circuit-breaker portion of audit **C-2 #1** ([issue #22](https://gitlab.com/PlasticDigits/ust1-window/-/issues/22)): - Oracle `State` now surfaces `paused` (from `Config`) so window readers see the breaker on the query they already use. - Window `ensure_oracle_usable` rejects **deposit and withdraw** with `OraclePaused` **before** staleness checks (fresh `last_update_sec` cannot bypass). - Governance-only `SetPaused` / unpause preserved; `UpdateRate` still blocked while paused. - Oracle service skips `UpdateRate` when `state.paused`. - Docs + **INV-ORACLE-PAUSE-001** + agent skill [`skills/oracle-circuit-breaker`](../skills/oracle-circuit-breaker/SKILL.md). **Not in this MR (explicitly out of scope):** emergency rate reset / monotonic bypass; operator `TripCircuitBreaker`; spot-vs-rate alerter. ## Test plan - [x] `cargo test -p ust1-oracle --lib` (incl. pause ACL + `State.paused`) - [x] `cargo test -p ust1-window --lib` (pause→halt→unpause→resume; stale still stale; window pause vs oracle pause) - [x] `cargo test -p ust1-integration-tests --lib` - [ ] Mainnet: migrate **oracle then window**; governance smoke `set_paused:true` and confirm window swaps revert immediately - [ ] Ops: follow [DEPLOYMENT emergency pause](../docs/DEPLOYMENT.md#emergency-pause-oracle-circuit-breaker-vs-window) Closes #22 Closes #22

PlasticDigits (Migrated from gitlab.com) closed this pull request

2026-08-08 04:53:24 +00:00