Contract pausing

contracts/Account.sol

@@ -7,13 +7,15 @@ import "./Managed.sol";
 import "./common/UUPSOwnableUpgradeable.sol";
 import "./common/UsingRegistryUpgradeable.sol";
 import "./interfaces/IAccount.sol";
+import "./Pausable.sol";
+import "./Pauser.sol";
 
 /**
  * @title A contract that facilitates voting on behalf of StakedCelo.sol.
  * @notice This contract depends on the Manager to decide how to distribute votes and how to
  * keep track of ownership of CELO voted via this contract.
  */
-contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, IAccount {
+contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, IAccount, Pausable {
     /**
      * @notice Used to keep track of a pending withdrawal. A similar data structure
      * exists within LockedGold.sol, but it only keeps track of pending withdrawals
@@ -64,6 +66,16 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
      */
     uint256 public totalScheduledWithdrawals;
 
+    /**
+     * @notice Controls whether the contract is paused.
+     */
+    PausedRecord public paused;
+
+    /**
+     * @notice The Pauser contract permissioned to pause/unpause this contract.
+     */
+    Pauser public pauser;
+
     /**
      * @notice Emitted when CELO is scheduled for voting for a given group.
      * @param group The validator group the CELO is intended to vote for.
@@ -225,6 +237,31 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
         }
     }
 
+    /**
+     * @notice Pauses external access to the contract.
+     * @dev Functions with the `onlyWhenNotPaused` modifier will be paused. This
+     * should be all the non-permissioned (i.e. not `onlyOwner` or * `onlyManager`)
+     * external/public functions.
+     */
+    function pause() external onlyPauser(pauser) {
+        _pause(paused);
+    }
+
+    /**
+     * @notice Unpauses the contract if it was previously paused using `pause()`.
+     */
+    function unpause() external onlyPauser(pauser) {
+        _unpause(paused);
+    }
+
+    /**
+     * @notice Sets that address permissioned to pause/unpause this contract.
+     * @param _pauser The address that can pause/unpause this contract.
+     */
+    function setPauser(address _pauser) external {
+        pauser = Pauser(_pauser);
+    }
+
     /**
      * @notice Deposits CELO sent via msg.value as unlocked CELO intended as
      * votes for groups.
@@ -238,6 +275,7 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
         external
         payable
         onlyManager
+        onlyWhenNotPaused(paused)
     {
         if (groups.length != votes.length) {
             revert GroupsAndVotesArrayLengthsMismatch();
@@ -268,7 +306,7 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
         uint256[] calldata fromVotes,
         address[] calldata toGroups,
         uint256[] calldata toVotes
-    ) external onlyManager {
+    ) external onlyManager onlyWhenNotPaused(paused) {
         if (fromGroups.length != fromVotes.length || toGroups.length != toVotes.length) {
             revert GroupsAndVotesArrayLengthsMismatch();
         }
@@ -301,7 +339,7 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
         address beneficiary,
         address[] calldata groups,
         uint256[] calldata withdrawals
-    ) external onlyManager {
+    ) external onlyManager onlyWhenNotPaused(paused) {
         if (groups.length != withdrawals.length) {
             revert GroupsAndVotesArrayLengthsMismatch();
         }
@@ -355,7 +393,7 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
         address lesserAfterActiveRevoke,
         address greaterAfterActiveRevoke,
         uint256 index
-    ) external returns (uint256) {
+    ) external onlyWhenNotPaused(paused) returns (uint256) {
         uint256 withdrawalAmount = scheduledVotes[group].toWithdrawFor[beneficiary];
         if (withdrawalAmount == 0) {
             revert NoScheduledWithdrawal(beneficiary, group);
@@ -431,7 +469,7 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
         address group,
         address voteLesser,
         address voteGreater
-    ) external {
+    ) external onlyWhenNotPaused(paused) {
         IElection election = getElection();
 
         // The amount of unlocked CELO for group that we want to lock and vote with.
@@ -491,7 +529,7 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
         address beneficiary,
         uint256 localPendingWithdrawalIndex,
         uint256 lockedGoldPendingWithdrawalIndex
-    ) external returns (uint256 amount) {
+    ) external onlyWhenNotPaused(paused) returns (uint256 amount) {
         (uint256 value, uint256 timestamp) = validatePendingWithdrawalRequest(
             beneficiary,
             localPendingWithdrawalIndex,
@@ -544,7 +582,7 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
         uint256 yesVotes,
         uint256 noVotes,
         uint256 abstainVotes
-    ) external onlyManager {
+    ) external onlyManager onlyWhenNotPaused(paused) {
         bool voteResult = getGovernance().votePartially(
             proposalId,
             index,
@@ -680,6 +718,14 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
         return scheduledVotes[group].toWithdrawFor[beneficiary];
     }
 
+    /**
+     * @notice Returns the paused status of the contract.
+     * @return `true` if the contract is paused, `false` otherwise.
+     */
+    function isPaused() external view returns (bool) {
+        return _isPaused(paused);
+    }
+
     /**
      * @notice Returns the storage, major, minor, and patch version of the contract.
      * @return Storage version of the contract.
@@ -697,7 +743,7 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
             uint256
         )
     {
-        return (1, 2, 0, 0);
+        return (1, 2, 1, 0);
     }
 
     /**
@@ -728,7 +774,7 @@ contract Account is UUPSOwnableUpgradeable, UsingRegistryUpgradeable, Managed, I
         address lesserAfterActiveRevoke,
         address greaterAfterActiveRevoke,
         uint256 index
-    ) public {
+    ) public onlyWhenNotPaused(paused) {
         (, uint256 revokeAmount) = getAndUpdateToVoteAndToRevoke(group, 0, 0);
 
         if (revokeAmount == 0) {

contracts/Pausable.sol

@@ -0,0 +1,91 @@
+//SPDX-License-Identifier: LGPL-3.0-only
+pragma solidity 0.8.11;
+
+import "./interfaces/IPausable.sol";
+import "./Pauser.sol";
+
+/**
+ * @title A helper contract to add pasuing functionality to a contract.
+ * @notice Used to prevent/mitigate damage in case an exploit is found in the
+ * extending contract.
+ */
+abstract contract Pausable is IPausable {
+    /**
+     * @notice Struct wrapping a bool that determines whether the contract
+     * should be paused.
+     * @dev We can't store the flag in this contract itself, since that would
+     * mangle storage of inheriting contracts. Instead, we provide a
+     * struct-wrapped bool type, to leverage the typechecker to help ensure the
+     * correct value is used.
+     */
+    struct PausedRecord {
+        bool paused;
+    }
+
+    /**
+     * @notice Used when an `onlyWhenNotPaused` function is called while the
+     * contract is paused.
+     */
+    error Paused();
+
+    /**
+     * @notice Used when an `onlyPauser` function is called with a different
+     * address.
+     */
+    error OnlyPauser();
+
+    /**
+     * @notice Reverts if the contract is paused.
+     * @param paused The `PausedRecord` struct containing the flag.
+     */
+    modifier onlyWhenNotPaused(PausedRecord storage paused) {
+        if (paused.paused) {
+            revert Paused();
+        }
+
+        _;
+    }
+
+    /**
+     * @notice Reverts if the caller is not the given address.
+     * @param pauser The address permissioned to pause/unpause.
+     * @dev We use the Pauser contract type rather than just `address` to
+     * leverage the typechecker to help ensure the correct value is used.
+     */
+    modifier onlyPauser(Pauser pauser) {
+        if (msg.sender != address(pauser)) {
+            revert OnlyPauser();
+        }
+
+        _;
+    }
+
+    /**
+     * @notice Pauses the contract by setting the wrapped bool to `true`.
+     * @param paused The PausedRecord to modify.
+     * @dev The implementing contract should likely wrap this function in a
+     * permissioned (e.g. `onlyOwner`) `pause()` function.
+     */
+    function _pause(PausedRecord storage paused) internal {
+        paused.paused = true;
+    }
+
+    /**
+     * @notice Unpauses the contract by setting the wrapped bool to `false`.
+     * @param paused The PausedRecord to modify.
+     * @dev The implementing contract should likely wrap this function in a
+     * permissioned (e.g. `onlyOwner`) `unpause()` function.
+     */
+    function _unpause(PausedRecord storage paused) internal {
+        paused.paused = false;
+    }
+
+    /**
+     * @notice Returns whether or not the contract is paused.
+     * @param paused The PauseRecord to check.
+     * @return `true` if the contract is paused, `false` otherwise.
+     */
+    function _isPaused(PausedRecord storage paused) internal view returns (bool) {
+        return paused.paused;
+    }
+}

contracts/Pauser.sol

@@ -0,0 +1,46 @@
+//SPDX-License-Identifier: LGPL-3.0-only
+pragma solidity 0.8.11;
+
+import "./common/UUPSOwnableUpgradeable.sol";
+import "./interfaces/IPausable.sol";
+
+/**
+ * @title The contract that is permissioned to pause StakedCelo protocol
+ * contracts.
+ * @notice Used to prevent/mitigate damage in case an exploit is found in the
+ * StakedCelo protocol.
+ * @dev This contract should be owned by the StakedCelo MultiSig, and it should
+ * be set as the `pauser` of other protocol contracts inheriting from
+ * Pausable.sol, permissioned to call the `pause` and `unpause` functions.
+ */
+contract Pauser is UUPSOwnableUpgradeable {
+    /**
+     * @notice Empty constructor for proxy implementation, `initializer` modifer ensures the
+     * implementation gets initialized.
+     */
+    // solhint-disable-next-line no-empty-blocks
+    constructor() initializer {}
+
+    /**
+     * @param _owner The address of the contract owner.
+     */
+    function initialize(address _owner) external initializer {
+        _transferOwnership(_owner);
+    }
+
+    /**
+     * @notice Pauses the given contract.
+     * @param contr The contract to pause.
+     */
+    function pause(address contr) external onlyOwner {
+        IPausable(contr).pause();
+    }
+
+    /**
+     * @notice Unpauses the given contract.
+     * @param contr The contract to unpause.
+     */
+    function unpause(address contr) external onlyOwner {
+        IPausable(contr).unpause();
+    }
+}