Gate roll, claimCred, and topUpPodiumPools on pause (#349) #520

2026-06-25T22:05:44Z

PlasticDigits commented

2026-06-25 22:05:44 +00:00

(Migrated from gitlab.com)

Summary

GitLab #349 — During incident pause, settlement and claims must not move value or advance epochs.

Add _requireLive() to rollPodiumEpoch, claimCred, and topUpPodiumPools in TimeArena.sol.
Extend pause matrix with test_pause_blocks_rollPodiumEpoch, test_pause_blocks_claimCred, and test_pause_blocks_topUpPodiumPools.
Update ops docs (pause-and-final-signoff.md, final-signoff-and-value-movement.md), invariants (INV-TIME-ARENA-PAUSE-MUTATING, INV-DOCS-320-PAUSE-OPS), product docs, and play-active-time-arena skill.
Autoroll on buy/WarBow remains blocked while paused because _requireLiveAndAutoroll checks _requireLive() first (documented in ops runbook).
No change to ReferralRegistry.registerCode (always live).

Acceptance checklist

Criterion	Command / step	Result
All three functions revert when `paused == true`	`cd contracts && forge test --match-test pause`	PASS
Forge pause matrix extended; `forge test` PASS	`cd contracts && forge test --match-contract TimeArenaTest`	PASS
Ops doc and invariants updated	Review `docs/operations/pause-and-final-signoff.md`, `docs/testing/invariants-and-business-logic.md`	PASS
No change to `ReferralRegistry.registerCode`	No edits under `ReferralRegistry.sol`	PASS
`test_pause_blocks_rollPodiumEpoch` PASS	Included in pause match above	PASS
`pause-and-final-signoff.md` table matches on-chain gates	Manual doc review vs `TimeArena.sol` `_requireLive()` call sites	PASS
Permissionless roll cannot bypass pause	`test_pause_blocks_rollPodiumEpoch`	PASS
Owner `setPaused(true)` blocks rolls without upgrade	Same test (no proxy upgrade)	PASS

Full forge test (non-TimeArena): 6 pre-existing failures without gitignored airdrop/doub.csv and Warbow benchmark env — unrelated to this MR (SKIP for #349 scope).

Verification for third parties

cd contracts && forge test --match-test pause — expect 9 PASS (6 existing + 3 new).
cd contracts && forge test --match-contract TimeArenaTest — expect 129 PASS.
Grep TimeArena.sol for _requireLive() at start of rollPodiumEpoch, claimCred, topUpPodiumPools.
Confirm docs/operations/pause-and-final-signoff.md gated-surfaces table lists roll / claim / top-up as paused gated.
Confirm ReferralRegistry.registerCode unchanged.

Related: #342 (parent gap analysis), #316 (existing pause matrix).

## Summary GitLab #349 — During incident pause, settlement and claims must not move value or advance epochs. - Add `_requireLive()` to `rollPodiumEpoch`, `claimCred`, and `topUpPodiumPools` in `TimeArena.sol`. - Extend pause matrix with `test_pause_blocks_rollPodiumEpoch`, `test_pause_blocks_claimCred`, and `test_pause_blocks_topUpPodiumPools`. - Update ops docs (`pause-and-final-signoff.md`, `final-signoff-and-value-movement.md`), invariants (`INV-TIME-ARENA-PAUSE-MUTATING`, `INV-DOCS-320-PAUSE-OPS`), product docs, and `play-active-time-arena` skill. - Autoroll on buy/WarBow remains blocked while paused because `_requireLiveAndAutoroll` checks `_requireLive()` first (documented in ops runbook). - No change to `ReferralRegistry.registerCode` (always live). ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | All three functions revert when `paused == true` | `cd contracts && forge test --match-test pause` | PASS | | Forge pause matrix extended; `forge test` PASS | `cd contracts && forge test --match-contract TimeArenaTest` | PASS | | Ops doc and invariants updated | Review `docs/operations/pause-and-final-signoff.md`, `docs/testing/invariants-and-business-logic.md` | PASS | | No change to `ReferralRegistry.registerCode` | No edits under `ReferralRegistry.sol` | PASS | | `test_pause_blocks_rollPodiumEpoch` PASS | Included in pause match above | PASS | | `pause-and-final-signoff.md` table matches on-chain gates | Manual doc review vs `TimeArena.sol` `_requireLive()` call sites | PASS | | Permissionless roll cannot bypass pause | `test_pause_blocks_rollPodiumEpoch` | PASS | | Owner `setPaused(true)` blocks rolls without upgrade | Same test (no proxy upgrade) | PASS | Full `forge test` (non-TimeArena): 6 pre-existing failures without gitignored `airdrop/doub.csv` and Warbow benchmark env — unrelated to this MR (SKIP for #349 scope). ## Verification for third parties 1. `cd contracts && forge test --match-test pause` — expect 9 PASS (6 existing + 3 new). 2. `cd contracts && forge test --match-contract TimeArenaTest` — expect 129 PASS. 3. Grep `TimeArena.sol` for `_requireLive()` at start of `rollPodiumEpoch`, `claimCred`, `topUpPodiumPools`. 4. Confirm `docs/operations/pause-and-final-signoff.md` gated-surfaces table lists roll / claim / top-up as **`paused`** gated. 5. Confirm `ReferralRegistry.registerCode` unchanged. Related: #342 (parent gap analysis), #316 (existing pause matrix).

PlasticDigits commented

2026-06-25 22:07:46 +00:00

(Migrated from gitlab.com)

Security review summary

SHA reviewed: 81fdb595c8dac9a76e620343064d2252a06f05db (MR !520, GitLab #349)

Scope: TimeArena.sol — add _requireLive() to rollPodiumEpoch, claimCred, and topUpPodiumPools; pause-matrix tests; ops/product/invariant doc updates.

Method: Traced attacker-controlled entry points to value sinks (payPodiumWinners, playCred.mint, DOUB pull/route). Verified _requireLive() ordering, nonReentrant coverage, and that internal _rollPodiumEpoch / _autorollExpiredPodiums remain reachable only via _requireLiveAndAutoroll() (buys/WarBow), which already calls _requireLive() before autoroll. PodiumVaults payout paths remain msg.sender == arena only.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff. This change closes a pre-existing pause bypass (permissionless roll, CRED claim, and pool top-up could proceed while paused == true) without introducing new reentrancy, access-control, or autoroll bypass paths.

Inline threads: none (no findings).

## Security review summary **SHA reviewed:** `81fdb595c8dac9a76e620343064d2252a06f05db` (MR !520, GitLab #349) **Scope:** `TimeArena.sol` — add `_requireLive()` to `rollPodiumEpoch`, `claimCred`, and `topUpPodiumPools`; pause-matrix tests; ops/product/invariant doc updates. **Method:** Traced attacker-controlled entry points to value sinks (`payPodiumWinners`, `playCred.mint`, DOUB pull/route). Verified `_requireLive()` ordering, `nonReentrant` coverage, and that internal `_rollPodiumEpoch` / `_autorollExpiredPodiums` remain reachable only via `_requireLiveAndAutoroll()` (buys/WarBow), which already calls `_requireLive()` before autoroll. `PodiumVaults` payout paths remain `msg.sender == arena` only. **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. This change closes a pre-existing pause bypass (permissionless roll, CRED claim, and pool top-up could proceed while `paused == true`) without introducing new reentrancy, access-control, or autoroll bypass paths. **Inline threads:** none (no findings).

PlasticDigits commented

2026-06-25 22:23:32 +00:00

(Migrated from gitlab.com)

mentioned in commit df186aa483

mentioned in commit df186aa483bddb7944e32c150a2d586d07e1696a

PlasticDigits (Migrated from gitlab.com) merged commit df186aa483 into main

2026-06-25 22:23:33 +00:00

Sign in to join this conversation.

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!520

Rows
Columns