Pausable Contract Design: Roles, Scope and Who Can Unpause

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Pause narrowly, unpause slowly. Let a small on-call role pause specific functions or markets, keep repayments and exits open where you can, decide liquidations deliberately, and put unpausing behind a multisig or timelock.

Watch: Pausable Contract Design: Roles, Scope and Who Can Unpause 1:44

Video transcript

Seneca could not call its pause functions. Arcadia's was locked in a cooldown. A pause is code, and it fails like code.

Pause narrowly and unpause slowly. Stop specific functions or markets, keep exits open where you can, and put unpausing behind a multisig or timelock.

Aave version three has two levels. A freeze blocks new risk but keeps repay, withdraw and liquidation open. A pause stops everything.

A pause should stop the attacker without trapping users. Keep repayments and revokes open, and withdrawals where possible. Liquidations are the hardest call.

Make pausing fast and unpausing slow. A narrow on-call role pauses, and nothing more. A multisig or timelock unpauses once the root cause is fixed.

Limits on the pauser cut both ways. Rekt reports Arcadia's cooldown blocked a second pause when a 3.6 million dollar exploit began.

Automation helps, with guardrails. Let it pause but never unpause, scope it to the affected market, and page a person every time.

Guardian's public audits show how pauses fail: no way to pause, no way to unpause, and second routes that skip the guard.

Test before launch and after every upgrade. List every function that moves value, hunt second routes, check open paths while paused, and time your signers.

Read the full article for every finding and the testing checklist, or talk to Guardian at guardian.security.

A pause is the containment step many incident plans rely on. It is also code, and it fails like code.

Seneca could not call its pause functions. Arcadia's pause was locked in a cooldown. Balancer's older pools had outlived their pause windows.

Resolv's pause needed its governance Safe, and Rekt reports that gathering the signatures took about three hours.

Here is how to design one that works, with findings from Guardian's public audit reports.

What to Pause

Most protocols need more than one of these:

Global: one flag stops everything. Fast, but it also stops actions that reduce risk.
Per function: separate flags for deposits, borrows, withdrawals and liquidations.
Per market or asset: isolate one pool, pair or collateral while the rest keeps running.

Compound v2 mixes them. Its pause guardian can stop minting and borrowing per market, and transfers and seizures globally.

Aave v3 gives each asset two levels. Its validation code treats them like this:

Action	Frozen asset	Paused asset
Supply and borrow	Blocked	Blocked
Repay	Allowed	Blocked
Withdraw	Allowed	Blocked
Liquidation	Allowed	Blocked

A freeze stops new risk; a pause stops everything. Give operators both, clearly named.

Names matter. In Papertrade I-11, a global "trading pause" only blocked new positions. Closes, liquidations and withdrawals kept running.

Paths That Must Stay Open

A pause should stop the attacker without trapping users. Decide each path on purpose.

Path	Default	Tradeoff
Repay and add collateral	Keep open	Paused repayments turn into liquidations and defaults
Withdraw and finish exits	Keep open where possible	The exploit may run through the exit path
Liquidations	Decide per protocol	Paused, bad debt grows. Open, users who cannot repay get liquidated
Cancel and revoke	Keep open	Users need to pull approvals during an incident
Admin recovery	Exempt from the pause	Otherwise you must unpause to rescue funds

Compound v2 shows the default. Its code never checks a pause flag for redeems or repayments.

At Magnify Cash (M-03), a pause stopped loan repayments, so borrowers could be forced to default and lose their NFTs.

At Veranta (M-04), one breaker trip paused the router for every pair. Keeper liquidations stopped while bad debt could build.

Liquidations are the hardest call. In Ethereal I-10, Guardian advised keeping them pausable, since a suspected exploit may run through them, and documenting the tradeoff.

Aave v3.1 softens the restart. When an asset is unpaused, an emergency or pool admin can set a liquidation grace period of up to four hours.

Who Pauses and Who Unpauses

Make pausing fast and unpausing slow.

Pause: a narrow role held by a small on-call multisig, a dedicated key or automation. The worst case is downtime.
Unpause: the main multisig or a timelock, after the root cause is fixed. The worst case is reopening the exploit.

Compound v2 does this. Its pause guardian or admin can pause, but the code reverts with "only admin can unpause" for anyone else.

Keep the pauser's power to pausing. A key that can also upgrade or move funds is an admin key. See Ownable vs AccessControl vs AccessManager.

Test the role logic too. At Aria (M-02), an inverted check meant only an account holding both roles could change the pause state.

At DollarStore (I-02), relisting an asset silently cleared a pauser's deposit pause, bypassing the unpauser.

Limit abuse, carefully

A pauser can also freeze user funds. Arcadia's lending pool guardian limits that power in two ways:

The guardian can pause again only 1,441 minutes after the last pause.
After 1,440 minutes, anyone can reopen repayments, withdrawals and liquidations.

That protects users from a rogue guardian. In July 2025, a cooldown locked Arcadia's own team out.

Rekt reports that Arcadia's automated circuit breakers paused the protocol and the team unpaused after review. The cooldown then blocked a second pause when the $3.6 million exploit began.

Expiry and Automated Triggers

Some pauses expire by design. Balancer V2's TemporarilyPausable allows pausing only during a window that starts at deployment.

A contract still paused when the window closes stays paused through a buffer period, then unpauses for good.

That caps the trust placed in the pauser, but leaves old contracts without brakes.

In Balancer's November 2025 exploit, Rekt reports that Composable Stable v5 pools "had expired pause windows".

If you use expiry, track every contract's end date.

Circuit breakers and ERC-7265

ERC-7265 proposed a standard circuit breaker. It rate-limits token outflows and, past a threshold, either reverts or holds withdrawals for users to claim later.

Its pull request was closed unmerged in October 2023, when EIPs and ERCs moved to separate repositories.

It has no page on eips.ethereum.org, so treat it as a design reference, not a standard.

Wiring monitoring to the pause

Detection helps only if it reaches whoever can pause. At Balancer, Rekt reports, Hypernative's emergency controls fired across every affected network within 20 minutes of the first alert.

Automation needs guardrails of its own:

Let automation pause, never unpause.
Scope automated pauses to the affected market or function.
Make sure a false alarm cannot use up the humans' next pause.
Page a person on every automated pause.

For what to watch, see What Is Onchain Monitoring?

Common Audit Findings

Each of these, from Guardian's public reports, shows a different way a pause fails.

Failure	Finding	What happened
No way to pause	Gamma H-01	Pausable inherited, but no external pause or unpause function
No way to unpause	Animecoin C-01	Unpause required a check that always fails while paused
Second route skips the guard	Synthetix H-05	`migrateOnBehalf` ignored the pause that `migrate` enforced
Wrapper bypasses the pause	Peapods H-11	Leverage and repay helpers borrowed and repaid while paused
Chains out of step	Orderly H-05	Source chain took stakes the paused destination never completed
Pause blocks settlement	RAAC M-01	A paused state update reverted the only liquidation path
Offchain service ignores it	Synthetix H-05 (withdrawals)	A listener stalled on token-specific withdrawal pauses

Seneca hit the first row live. Rekt reports its pause functions were internal, so nobody could call them while more than $6.4 million was taken in February 2024.

Testing the Pause

Run these checks before launch and after every upgrade or role change:

List every function that moves value. Each one is guarded, exempt on purpose, or documented.
Look for second routes: on-behalf variants, batch calls, hooks and leverage helpers.
Pause and unpause from every state, including the deployment state.
While paused, confirm each "keep open" path still works.
On cross-chain systems, pause one side and send a message from the other.
Check that keepers, relayers and indexers handle every pause event.
Simulate the pause transaction on a mainnet fork and time how long signers take.

Write the results into your DeFi incident response plan.

How Guardian Helps

Guardian's smart contract audit runs three passes: a design review, an invariant suite, then senior researchers attacking what is left.

Guardian's Managed Security monitors contracts on every block: privileged calls, role and ownership changes, upgrades, multisig transactions and large fund movements.

When something fires, a Guardian engineer responds, and exploit contracts can be caught and paused onchain.

Frequently Asked Questions

What is a pausable contract?

It is a contract with an emergency stop that an authorized account can trigger. In OpenZeppelin's Pausable, a function stops only once you add the whenNotPaused modifier, and you write the access-controlled pause and unpause functions yourself.

Should a protocol pause liquidations in an emergency?

It depends on the exploit path. Paused liquidations let bad debt grow, while open liquidations can hit users who cannot repay. Keep repayments open and consider a grace period after unpausing; Aave v3.1 allows up to four hours.

Who should be able to unpause a protocol?

A slower, more trusted party than the one who pauses: the main multisig or a timelock, after the root cause is fixed. In Compound v2, the pause guardian can pause, but only the admin can unpause.

Is ERC-7265 an Ethereum standard?

No. ERC-7265 proposed a circuit breaker that rate-limits token outflows. Its pull request was closed unmerged in October 2023 and it has no page on eips.ethereum.org, so treat it as a design reference.

Sources

Test your pause before you need it

Have Guardian review your pause scope, roles and open paths before an incident tests them.

Talk to Guardian Explore smart contract audits