IEmergencyCut
Title: IEmergencyCut
Author: David Dada <daveproxy80@gmail.com> (https://github.com/dadadave80)
Emergency escape-hatch surface for the GovernedDiamondCut facet: a zero-delay,
REMOVAL-ONLY diamond cut a guardian can fire to instantly unbind a compromised or buggy
facet — even while the normal governed cut path is halted by EmergencyStop. It is
deliberately constrained: a guardian may only Remove selectors (never Add/Replace,
which still require a full governance round), may never remove the module's own cut
entrypoint or the admin's stop-recovery selectors (even when unfrozen), and may never remove
a frozen selector. Any other unfrozen selector is removable, so the guardian is trusted not
to strand the path that reaches the cut entrypoint (e.g. Governor/Timelock execution) until
governance freezes it.
This interface is intentionally SEPARATE from IGovernedDiamondCut: that interface exposes
only diamondCut, so type(IGovernedDiamondCut).interfaceId == 0x1f931c1c (identical to
IDiamondCut), which is load-bearing — the governed facet must occupy the canonical cut
selector. The emergency-removal surface therefore lives here so it cannot perturb that pinned
id. emergencyRemoveCut is a plain facet admin function and is NOT advertised as a distinct
ERC-165 interface, so no new ERC-165 map slot is registered for it. Emergency removals are
recorded in the same append-only IUpgradeRegistry as governed cuts, so they appear in cut
history, and additionally emit EmergencyCutExecuted so they are auditable as panic actions.
Functions
emergencyRemoveCut
Zero-delay, removal-only emergency cut: instantly unbinds the supplied selectors from
the diamond. Callable ONLY by an EMERGENCY_GUARDIAN_ROLE holder, and — unlike the
governed diamondCut — it INTENTIONALLY works while EmergencyStop is engaged (it is the
panic button). Every FacetCut must use action Remove (revert
EmergencyCutMustBeRemoveOnly otherwise); none may target the cut entrypoint (revert
EmergencyCutEntrypointProtected), a stop-recovery selector (same revert) or a frozen
selector (revert IFrozenSelectors.FrozenSelectorProtected); no init delegatecall is
permitted (nothing to initialize on a pure removal). The removal is recorded in the IUpgradeRegistry and
emits EmergencyCutExecuted.
function emergencyRemoveCut(FacetCut[] calldata cuts) external;Parameters
| Name | Type | Description |
|---|---|---|
| cuts | FacetCut[] | The facet cuts to apply; every entry MUST be a Remove (facetAddress == address(0)). |
Events
EmergencyCutExecuted
Emitted after a guardian successfully applies an emergency removal-only cut. Complements IUpgradeRegistry.CutRecorded (which anchors the immutable registry entry): this flags that the cut traveled the EMERGENCY path (guardian-gated, EmergencyStop-bypassing, removal-only) rather than the full governance path.
event EmergencyCutExecuted(uint256 indexed version, address indexed guardian, uint256 selectorCount);Parameters
| Name | Type | Description |
|---|---|---|
| version | uint256 | The monotonic registry version assigned to this emergency cut (1-indexed), shared with the governed-cut registry so emergency removals appear in cut history. |
| guardian | address | The EMERGENCY_GUARDIAN_ROLE holder that fired the emergency removal. |
| selectorCount | uint256 | The total number of function selectors removed across all FacetCut entries. |
Errors
EmergencyCutMustBeRemoveOnly
Thrown when an emergency cut contains a FacetCut whose action is not Remove. The
emergency path is removal-only; any Add (0) or Replace (1) is rejected with the
offending action so a rogue or mistaken guardian can never add or replace code.
error EmergencyCutMustBeRemoveOnly(uint8 action);Parameters
| Name | Type | Description |
|---|---|---|
| action | uint8 | The offending FacetCutAction (0 == Add, 1 == Replace) that was not Remove (2). |
EmergencyCutEntrypointProtected
Thrown when an emergency cut tries to remove the module's own cut entrypoint (diamondCut in
GovernedDiamondCut and SafeDiamondCut; scheduleCut/executeCut in
GovernedSafeDiamondCut) or a selector the admin needs to recover from an emergency stop
(emergencyResume, removeGuardian, revokeRole). These are refused even while the frozen
set is empty, so the guardian cannot remove the entrypoint or stop the diamond and then strip
the admin's way to resume it. It can still remove other unfrozen selectors on the path to the
entrypoint (see the Governor/Timelock note above).
error EmergencyCutEntrypointProtected(bytes4 selector);Parameters
| Name | Type | Description |
|---|---|---|
| selector | bytes4 | The protected selector the emergency cut attempted to remove. |