OAK-M34 — Pause-by-Default Emergency Pause

Description

Pause-by-default emergency pause is the architectural pattern in which a deployed smart-contract system exposes a guardian-callable kill-switch that halts state-mutating execution paths within a single transaction's worth of latency, paired with a multi-sig-controlled or time-locked unpause path that prevents the same authority from being used to brick the protocol indefinitely. M34 is the response-time mitigation: when a defender detects an in-progress exploit (via M03 bytecode-diff monitoring, M06 mempool telemetry, M11 rate-limit threshold, or external alert), the operational question is whether the protocol can be halted before the attacker drains the residual surface. The historical record is unambiguous: protocols with a credible pause path have routinely truncated active exploitation cohorts to a fraction of the funds-at-risk; protocols without one have observed the full-pool drain in the canonical 2022–2025 incident set. The Saddle Finance April 2022 incident, where a portion of the metapool exposure was preserved by emergency pause after the attacker had drained an initial tranche, is the often-cited reference for the value of fast pause; the inverse cohort — incidents with no pause path or with a pause path that was not activated in time — produced the full-pool-loss outcomes.

The structural distinction from M11 (rate-limiting) is load-bearing: rate-limiting is a throughput-bounding control that runs continuously and limits the per-block exfiltration capacity; emergency pause is a binary kill-switch that halts execution entirely. The two are complementary: rate-limiting buys the defender time to detect-and-decide; pause is the action the defender takes once the decision is made. Without rate-limiting, the exploit-to-decision window may close before pause can be invoked; without pause, the rate-limit only slows the bleed and does not stop it. Mature protocols deploy both.

The pause authority is itself a centralisation vector. A guardian role with single-signer pause capability is a kill-switch for the protocol that can be subverted by any compromise of the guardian's key, by social engineering of the guardian, or by malicious operator action. The mitigation surface here is authority-graph design (cross-reference M05): the pause authority should be enumerable, the trust assumption should be explicit (multi-sig with quorum, threshold-signed, governance-ratified), and the pause-and-unpause asymmetry should match the operational reality — a fast pause path (single-signer or low-quorum, since pause is non-extractive) paired with a slow unpause path (high-quorum or time-locked, since unpause restores attack-surface availability). The OpenZeppelin Pausable pattern, the Safe-module-based pause architecture, and custom guardian-role designs all instantiate this asymmetry; the specific calibration is per-protocol and depends on the operator's threat model.

How it applies

• OAK-T9.001 / T9.002 / T9.003 / T9.004 / T9.005 (smart-contract exploit classes): the canonical M34 response surface. Once an exploit has begun extracting value, the defender's only remaining lever for the residual surface is pause. Reentrancy mid-exploitation, oracle-manipulation post-trigger, flash-loan-enabled extraction in the post-trigger window, governance-attack post-execution, and access-control extraction post-trigger are all cases where pause halts the residual exposure. The Saddle April 2022 case is the worked example for the reentrancy class; analogous "pause halted residual losses" cases exist across the other T9 sub-classes.
• OAK-T10.001 / T10.002 / T10.003 / T10.004 / T10.005 (bridge attack classes): bridge-pause is structurally the highest-stakes M34 deployment because the contract holds concentrated cross-chain capital and the per-block exfiltration capacity is large. Bridge-side pause must coordinate across the validator-set / signer-set surface (T10.001 vector) as well as the contract surface (T10.002 / T10.005 vectors). The post-Nomad and post-Ronin cohort drove substantial expansion of bridge-side pause capability; many newer bridges deploy guardian-multisig pause as a base-layer architectural requirement.
• OAK-T11.003 (in-use multisig smart-contract manipulation): the WazirX-Liminal July 2024 case illustrates the M34 surface at the multisig layer itself. When in-flight contract-modification by partial-multisig compromise is detected, pause at the multisig (freezing modification authority pending out-of-band confirmation) is the correlate of pause at the protocol layer. M34 here is the governance-layer analogue of contract-layer pause and pairs directly with M22 (rotate-on-disclosure) for the post-pause rotation step.

Limitations

• Pause authority is a centralisation vector requiring careful authority-graph design. A protocol that can be paused by a single guardian is a protocol that can be bricked by any compromise of that guardian. Multi-sig pause introduces quorum-coordination latency that may be incompatible with sub-block-time exploit decisions; threshold-signed pause reduces latency but introduces signer-host-compromise correlation. The trade-off must be designed explicitly; pause-authority concentration is the M34 cost. See M05 (authority-graph enumeration) and M15 (threshold-signing operator separation) for the supporting controls.
• Decision latency is the binding constraint, not pause-transaction latency. Pause itself is a single-transaction mechanism; the limiting step is deciding to pause. Detection-to-decision latency in production incidents has historically run from minutes to hours, sometimes longer than the actual exploit window. M34 only succeeds where M03 / M06 / M11 produce a credible alert fast enough for the on-call decision-maker to act; the human-in-the-loop step is the binding latency.
• False-positive pause has its own cost. Pausing the protocol stops legitimate user operations alongside the exploit; if the alert was a false positive, the protocol absorbs operational-availability loss and reputational cost. Mature operators define the alert-to-pause decision criteria explicitly (which alerts are pause-immediately, which are escalate-to-on-call) to bound the false-pause cost.
• Pause does not unwind already-extracted value. M34 stops further extraction; it does not recover what has been taken. The composition with M35 (whitehat-rescue coordination) and M22 (rotate-on-disclosure) handles the recovery and rotation legs respectively. M34 alone is the bleed-stop, not the recovery.
• Some contracts cannot be paused. Immutable contracts, contracts deployed without Pausable / OpenZeppelin-pattern instrumentation, and contracts whose pause path was renounced as a credible-decentralisation gesture admit no pause action. The defender's posture here is M22 / M35 only; M34 is structurally unavailable. Several major exploits in the cohort affected non-pausable contracts where the absence of pause was a known design choice.
• Pause-authority coordination across multi-contract systems. A protocol may have many deployed contracts (factory, router, treasury, governor, peripheral); pause at one contract may not stop the exploit if the attacker can still reach the residual surface through an unpaused adjacent contract. Coordinated pause across the full deployment graph requires explicit design; ad-hoc pause at the visibly-affected contract is the partial-response failure mode at the architectural layer (analogous to the M22 partial-rotation failure at the operational layer).

Reference implementations

• OpenZeppelin Pausable contract: the canonical reference pattern. Single inherited contract exposing _pause() / _unpause() callable from a whenNotPaused guard; widely deployed across the OpenZeppelin-derived contract ecosystem. The pattern is well-audited, well-understood, and present in most OpenZeppelin-based protocols.
• Safe (Gnosis Safe) module-based pause: Safe modules can act as pause-callers, with the module's authorisation policy designed to fit the operator's threat model. This pattern is the institutional-grade analogue of the Pausable pattern, suitable for treasury-operating multi-sigs that want pause as a delegated capability.
• Custom guardian-role designs: many protocols implement a Guardian role distinct from the Owner / Admin role, with the Guardian capable of pause-only and the Owner capable of unpause / parameter-change. This separation reduces the centralisation surface of pause itself: a compromised guardian can only halt the protocol, not modify it. Aave, Compound, MakerDAO, and others run variations of this pattern.
• Bridge-side pause patterns: post-Nomad / post-Ronin reference architectures include guardian-multisig pause at the bridge contract, with quorum sized to the operator's threat-model trade-off. LayerZero, Wormhole, and the major contemporary bridges all deploy variations of this.
• Authority-graph integration: the mature-form M34 deployment is paired with M05 enumeration: every contract in the deployed system is annotated with its pause-authority graph entry, and the protocol's incident-response runbook lists pause targets in priority order. This converts pause from "the on-call has to figure out what to call" to "the on-call executes the pre-defined sequence".

Citations

• [saddleincidentreport2022] — Saddle Finance April 2022; canonical reference for M34 success — pause activated mid-exploit and preserved residual metapool exposure that would otherwise have been drained.
• [blocksecsaddle2022] — independent forensic analysis of the Saddle incident, framing the pause-and-recovery sequence at the function-level.
• [chainalysiseuler2023] — Euler March 2023; the canonical case where pause was not the recovery vector but where the post-incident negotiation and rescue coordination (M35) handled the recovery layer; the M34-vs-M35 boundary.
• [crystalwazirx2024] — WazirX July 2024; the multisig-layer M34 surface where pause of contract-modification authority would have bounded the post-disclosure exposure.
• [zhou2023sok] — academic taxonomy of failure modes M34 is the architectural response to.
• [openzeppelinupgradesstorage] — OpenZeppelin upgrade-safety guidance; the substrate documentation behind the Pausable pattern's widespread deployment.