EmergencyStopLib
Title: EmergencyStop Library
Authors: David Dada <daveproxy80@gmail.com> (https://github.com/dadadave80), Modified from OpenZeppelin (https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Pausable.sol)
Library implementing a multi-guardian emergency stop for Diamond facets.
Any address holding the EMERGENCY_GUARDIAN_ROLE can activate the stop.
Only an address holding DEFAULT_ADMIN_ROLE can resume operations.
Guardian management (add/remove) is also restricted to the admin.
The guardian roster is stored in the AccessControl role mapping — no
separate storage is required in this module.
Functions
emergencyStopStorage
Returns the storage struct for EmergencyStop at its ERC-7201 slot.
function emergencyStopStorage() internal pure returns (EmergencyStopStorage storage $);Returns
| Name | Type | Description |
|---|---|---|
| $ | EmergencyStopStorage |
registerInterface
Registers support for the IEmergencyStop interface via ERC-165.
Writes true to the precomputed ERC-165 map slot.
function registerInterface() internal;__EmergencyStop_init
Initializes the EmergencyStop module.
Must be called inside an initializer-guarded function (see Initializable).
Registers the IEmergencyStop interface ID for ERC-165 discovery.
function __EmergencyStop_init() internal;emergencyStop
Activates the emergency stop.
Reverts with EmergencyStopUnauthorizedGuardian if caller lacks guardian role.
Reverts with EmergencyStopActive if the stop is already active.
Emits EmergencyStopped.
function emergencyStop(string calldata reason) internal;Parameters
| Name | Type | Description |
|---|---|---|
| reason | string | A human-readable description of why the stop is triggered. |
emergencyResume
Resumes operations after an emergency stop.
Requires DEFAULT_ADMIN_ROLE. Reverts with EmergencyStopNotActive if not stopped.
Emits EmergencyResumed.
function emergencyResume() internal;addGuardian
Grants the guardian role to guardian.
Requires DEFAULT_ADMIN_ROLE. Emits GuardianAdded only if the role was not already held.
Note: when a new guardian is successfully added, both IAccessControl.RoleGranted
(from AccessControlLib._grantRole) and IEmergencyStop.GuardianAdded are emitted.
Off-chain systems that track guardians should follow exactly one of these events
to avoid double-counting.
function addGuardian(address guardian) internal;Parameters
| Name | Type | Description |
|---|---|---|
| guardian | address | The address to grant guardian status. |
removeGuardian
Revokes the guardian role from guardian.
Requires DEFAULT_ADMIN_ROLE. Emits GuardianRemoved only if the address held the role.
Note: on successful removal both IAccessControl.RoleRevoked and
IEmergencyStop.GuardianRemoved are emitted — follow exactly one for off-chain indexing.
function removeGuardian(address guardian) internal;Parameters
| Name | Type | Description |
|---|---|---|
| guardian | address | The address to revoke guardian status from. |
isRecoverySelector
Returns whether selector is one the admin needs to recover from a stop: emergencyResume,
removeGuardian or IAccessControl.revokeRole.
The removal-only emergency cuts refuse these. Every governed cut path calls checkNotStopped
and re-adding a removed selector takes a cut, so a guardian that trips the stop and then
removes emergencyResume would stop the diamond forever, and one that removes both
revocation paths could re-stop after every resume.
function isRecoverySelector(bytes4 selector) internal pure returns (bool);Parameters
| Name | Type | Description |
|---|---|---|
| selector | bytes4 | The function selector to classify. |
Returns
| Name | Type | Description |
|---|---|---|
| <none> | bool | bool True if selector is part of the admin's stop-recovery path. |
checkNotStopped
Reverts with EmergencyStopActive if the emergency stop is active.
Consumer modules call this to gate protected operations.
function checkNotStopped() internal view;isStopped
Returns whether the emergency stop is currently active.
function isStopped() internal view returns (bool);Returns
| Name | Type | Description |
|---|---|---|
| <none> | bool | bool True if the system is stopped, false otherwise. |
isGuardian
Returns whether account holds the guardian role.
function isGuardian(address account) internal view returns (bool);Parameters
| Name | Type | Description |
|---|---|---|
| account | address | The address to query. |
Returns
| Name | Type | Description |
|---|---|---|
| <none> | bool | bool True if the account is a guardian. |
stoppedReason
Returns the reason string recorded when the stop was last triggered.
function stoppedReason() internal view returns (string memory);Returns
| Name | Type | Description |
|---|---|---|
| <none> | string | string The reason for the last emergency stop (empty if never stopped/cleared). |
_emergencyStop
Internal — sets stopped flag and reason, emits EmergencyStopped.
function _emergencyStop(string calldata reason, address guardian) internal;Parameters
| Name | Type | Description |
|---|---|---|
| reason | string | |
| guardian | address |
_emergencyResume
Internal — clears stopped flag and reason, emits EmergencyResumed.
function _emergencyResume() internal;