feat(security): oracle circuit-breaker fails window closed on pause (#22) #40

Merged

PlasticDigits merged 1 commit from fix/issue-22-oracle-circuit-breaker into main

2026-08-08 05:12:29 +00:00

PlasticDigits commented

2026-08-08 04:53:25 +00:00

(Migrated from gitlab.com)

Summary

Implements only the oracle-level pause / circuit-breaker portion of audit C-2 #1 (issue #22):

Oracle State now surfaces paused (from Config) so window readers see the breaker on the query they already use.
Window ensure_oracle_usable rejects deposit and withdraw with OraclePaused before staleness checks (fresh last_update_sec cannot bypass).
Governance-only SetPaused / unpause preserved; UpdateRate still blocked while paused.
Oracle service skips UpdateRate when state.paused.
Docs + INV-ORACLE-PAUSE-001 + agent skill skills/oracle-circuit-breaker.

Not in this MR (explicitly out of scope): emergency rate reset / monotonic bypass; operator TripCircuitBreaker; spot-vs-rate alerter.

Test plan

cargo test -p ust1-oracle --lib (incl. pause ACL + State.paused)
cargo test -p ust1-window --lib (pause→halt→unpause→resume; stale still stale; window pause vs oracle pause)
cargo test -p ust1-integration-tests --lib
Mainnet: migrate oracle then window; governance smoke set_paused:true and confirm window swaps revert immediately
Ops: follow DEPLOYMENT emergency pause runbook

Closes #22

## Summary Implements **only** the oracle-level pause / circuit-breaker portion of audit **C-2 #1** ([issue #22](https://gitlab.com/PlasticDigits/ust1-window/-/issues/22)): - Oracle `State` now surfaces `paused` (from `Config`) so window readers see the breaker on the query they already use. - Window `ensure_oracle_usable` rejects **deposit and withdraw** with `OraclePaused` **before** staleness checks (fresh `last_update_sec` cannot bypass). - Governance-only `SetPaused` / unpause preserved; `UpdateRate` still blocked while paused. - Oracle service skips `UpdateRate` when `state.paused`. - Docs + **INV-ORACLE-PAUSE-001** + agent skill `skills/oracle-circuit-breaker`. **Not in this MR (explicitly out of scope):** emergency rate reset / monotonic bypass; operator `TripCircuitBreaker`; spot-vs-rate alerter. ## Test plan - [x] `cargo test -p ust1-oracle --lib` (incl. pause ACL + `State.paused`) - [x] `cargo test -p ust1-window --lib` (pause→halt→unpause→resume; stale still stale; window pause vs oracle pause) - [x] `cargo test -p ust1-integration-tests --lib` - [ ] Mainnet: migrate **oracle then window**; governance smoke `set_paused:true` and confirm window swaps revert immediately - [ ] Ops: follow DEPLOYMENT emergency pause runbook Closes #22

PlasticDigits commented

2026-08-08 05:10:48 +00:00

(Migrated from gitlab.com)

mentioned in issue #22

PlasticDigits commented

2026-08-08 05:10:50 +00:00

(Migrated from gitlab.com)

mentioned in issue #25

PlasticDigits commented

2026-08-08 05:12:14 +00:00

(Migrated from gitlab.com)

added 3 commits

f312188d...6ffa7324 - 2 commits from branch main
c1d19c73 - feat(security): oracle circuit-breaker fails window closed on pause (#22)

Compare with previous version

added 3 commits <ul><li>f312188d...6ffa7324 - 2 commits from branch <code>main</code></li><li>c1d19c73 - feat(security): oracle circuit-breaker fails window closed on pause (#22)</li></ul> [Compare with previous version](/PlasticDigits/ust1-window/-/merge_requests/7/diffs?diff_id=1950016251&start_sha=f312188dd1f8a7c61dc32de5647a58f3e041293e)

PlasticDigits (Migrated from gitlab.com) scheduled this pull request to auto merge when all checks succeed

2026-08-08 05:12:16 +00:00

PlasticDigits commented

2026-08-08 05:12:29 +00:00

(Migrated from gitlab.com)