Merge pull request #13 from movementlabsxyz/add-pauser

Add pauser role to MOVE OFT Adapter contract

Author: Primata

examples/oft-evm-move-adapters/sources/oft_implementation/move_oft_adapter.move

@@ -8,14 +8,17 @@
 /// because there is not a rebalancing mechanism that can ensure pools maintain sufficient balance.
 module oft::move_oft_adapter {
     use std::coin::Coin;
+    use std::event::emit;
     use std::fungible_asset::{Self, FungibleAsset, Metadata};
     use std::object::{Self, address_to_object, ExtendRef, Object, object_exists};
     use std::option::{Self, Option};
+    use std::vector;
     use std::primary_fungible_store;
     use std::signer::address_of;
+    use aptos_framework::account;
 
     use endpoint_v2_common::bytes32::Bytes32;
-    use oft::oapp_core::{assert_admin, combine_options};
+    use oft::oapp_core::{assert_admin, combine_options, get_admin};
     use oft::oapp_store::OAPP_ADDRESS;
     use oft::oft_core;
     use oft::oft_impl_config::{
@@ -39,6 +42,11 @@ module oft::move_oft_adapter {
         escrow_extend_ref: ExtendRef,
     }
 
+    // =================================================== Pauser Store ==================================================
+
+    /// Separate resource to keep upgrades safe (no change to OftImpl layout)
+    struct PauserStore has key { pausers: vector<address>, paused: bool }
+
     // ================================================= OFT Handlers =================================================
 
     /// The default *credit* behavior for a Adapter OFT is to unlock the amount from escrow and credit the recipient
@@ -47,7 +55,9 @@ module oft::move_oft_adapter {
         amount_ld: u64,
         src_eid: u32,
         lz_receive_value: Option<FungibleAsset>,
-    ): u64 acquires OftImpl {
+    ): u64 acquires OftImpl, PauserStore {
+        // Global inflow pause gate
+        assert!(!is_paused(), EPAUSED);
         // Default implementation does not make special use of LZ Receive Value sent; just deposit to the OFT address
         option::for_each(lz_receive_value, |fa| primary_fungible_store::deposit(@oft_admin, fa));
 
@@ -57,6 +67,9 @@ module oft::move_oft_adapter {
         // unlock the amount from escrow
         let escrow_signer = &object::generate_signer_for_extending(&store().escrow_extend_ref);
 
+        // Create recipient account if it doesn't exist
+        account::create_account_if_does_not_exist(to);
+
         // Deposit the extracted amount to the recipient, or redirect to the admin if the recipient is blocklisted
         primary_fungible_store::transfer(
             escrow_signer,
@@ -76,9 +89,11 @@ module oft::move_oft_adapter {
         fa: &mut FungibleAsset,
         min_amount_ld: u64,
         dst_eid: u32,
-    ): (u64, u64) acquires OftImpl {
+    ): (u64, u64) acquires OftImpl, PauserStore {
         assert_not_blocklisted(sender);
         assert_metadata(fa);
+        // Global outflow pause gate
+        assert!(!is_paused(), EPAUSED);
 
         // Calculate the exact send amount
         let amount_ld = fungible_asset::amount(fa);
@@ -266,6 +281,65 @@ module oft::move_oft_adapter {
         oft_limit::new_oft_limit(0, oft_impl_config::rate_limit_capacity(eid))
     }
 
+    // ==================================================== Pauser Logic ===================================================
+
+    #[view]
+    public fun is_paused(): bool acquires PauserStore {
+        let admin_addr = get_admin();
+        if (!exists<PauserStore>(admin_addr)) { return false };
+        borrow_global<PauserStore>(admin_addr).paused
+    }
+
+    /// Add a pauser address (admin-only). Creates the store at current admin address if missing.
+    public entry fun set_pauser(admin: &signer, pauser: address) acquires PauserStore {
+        let admin_addr = address_of(admin);
+        assert_admin(admin_addr);
+        if (exists<PauserStore>(admin_addr)) {
+            let store_mut = borrow_global_mut<PauserStore>(admin_addr);
+            if (!vector::contains(&store_mut.pausers, &pauser)) {
+                vector::push_back(&mut store_mut.pausers, pauser);
+            };
+        } else {
+            move_to<PauserStore>(admin, PauserStore { pausers: vector[pauser], paused: false });
+        }
+    }
+
+    /// Remove a pauser address (admin-only). No-op if the address is not present.
+    public entry fun remove_pauser(admin: &signer, pauser: address) acquires PauserStore {
+        let admin_addr = address_of(admin);
+        assert_admin(admin_addr);
+        assert!(exists<PauserStore>(admin_addr), ENOT_INITIALIZED);
+        let store_mut = borrow_global_mut<PauserStore>(admin_addr);
+        let i = 0u64;
+        let n = vector::length(&store_mut.pausers);
+        while (i < n) {
+            if (*vector::borrow(&store_mut.pausers, i) == pauser) {
+                vector::remove(&mut store_mut.pausers, i);
+                return
+            };
+            i = i + 1;
+        };
+    }
+
+    /// Toggle pause (pauser or admin can call)
+    public entry fun set_paused(caller: &signer, paused: bool) acquires PauserStore {
+        let admin_addr = get_admin();
+        assert!(exists<PauserStore>(admin_addr), ENOT_INITIALIZED);
+        let caller_addr = address_of(caller);
+        let store_mut = borrow_global_mut<PauserStore>(admin_addr);
+        assert!(caller_addr == admin_addr || vector::contains(&store_mut.pausers, &caller_addr), EUNAUTHORIZED);
+        assert!(store_mut.paused != paused, ENO_CHANGE);
+        store_mut.paused = paused;
+        emit(PauseSet { paused });
+    }
+
+    #[view]
+    public fun is_pauser(addr: address): bool acquires PauserStore {
+        let admin_addr = get_admin();
+        if (!exists<PauserStore>(admin_addr)) { return false };
+        vector::contains(&borrow_global<PauserStore>(admin_addr).pausers, &addr)
+    }
+
     #[view]
     /// Total value locked in the contract
     public fun tvl(): u64 acquires OftImpl {
@@ -313,6 +387,10 @@ module oft::move_oft_adapter {
         init_module(&std::account::create_signer_for_test(OAPP_ADDRESS()));
     }
 
+    // ================================================ Tests Helpers =================================================
+    #[test_only]
+    public fun pause_set_event(paused: bool): PauseSet { PauseSet { paused } }
+
     // ================================================ Storage Helpers ===============================================
 
     #[view]
@@ -333,4 +411,13 @@ module oft::move_oft_adapter {
     const EINVALID_METADATA_ADDRESS: u64 = 1;
     const ENOT_IMPLEMENTED: u64 = 2;
     const EWRONG_FA_METADATA: u64 = 3;
+    const EPAUSED: u64 = 4;
+    const EUNAUTHORIZED: u64 = 5;
+    const ENO_CHANGE: u64 = 6;
+    const ENOT_INITIALIZED: u64 = 7;
+
+    // ==================================================== Events ====================================================
+
+    #[event]
+    struct PauseSet has store, drop { paused: bool }
 }

examples/oft-evm-move-adapters/tests/implementations/move_oft_adapter_tests.move

@@ -22,9 +22,15 @@ module oft::move_oft_adapter_tests {
     use oft::move_oft_adapter::{
         Self,
         escrow_address,
+        credit,
+        debit_fungible_asset,
         fee_bps,
         fee_deposit_address,
+        is_paused,
         is_blocklisted,
+        set_paused,
+        set_pauser,
+        remove_pauser,
         set_fee_bps,
         set_fee_deposit_address,
     };
@@ -59,6 +65,140 @@ module oft::move_oft_adapter_tests {
         mint_ref
     }
 
+    // ============================= Pauser Tests (moved from source) =============================
+
+    #[test]
+    fun test_pauser_toggle() {
+        setup();
+
+        let admin = &create_signer_for_test(@oft_admin);
+        let p = @0x1234;
+        set_pauser(admin, p);
+        assert!(!is_paused(), 0);
+
+        let ps = &create_signer_for_test(p);
+        set_paused(ps, true);
+        assert!(is_paused(), 1);
+
+        set_paused(admin, false);
+        assert!(!is_paused(), 2);
+    }
+
+    #[test]
+    #[expected_failure(abort_code = 5)] // EUNAUTHORIZED
+    fun test_only_pauser_or_admin_can_toggle() {
+        setup();
+
+        let admin = &create_signer_for_test(@oft_admin);
+        let p = @0x1111;
+        let rando = &create_signer_for_test(@0x2222);
+        set_pauser(admin, p);
+        set_paused(rando, true);
+    }
+
+    #[test]
+    #[expected_failure(abort_code = 4)] // EPAUSED
+    fun test_paused_blocks_debit() {
+        let mint_ref = setup();
+        let admin = &create_signer_for_test(@oft_admin);
+        let p = @0xABCD;
+        set_pauser(admin, p);
+        let ps = &create_signer_for_test(p);
+        set_paused(ps, true);
+
+        let fa = mint(&mint_ref, 1000);
+        let (_s, _r) = debit_fungible_asset(@0x4444, &mut fa, 0, 101);
+        // Consume FA to satisfy linear types even though test aborts
+        burn_token_for_test(fa);
+    }
+
+    #[test]
+    fun test_unpause_restores_debit() {
+        let mint_ref = setup();
+        let admin = &create_signer_for_test(@oft_admin);
+        let p = @0xBEEF;
+        set_pauser(admin, p);
+        let ps = &create_signer_for_test(p);
+        set_paused(ps, true);
+        set_paused(admin, false);
+
+        let fa = mint(&mint_ref, 2000);
+        let (sent, received) = debit_fungible_asset(@0x5555, &mut fa, 0, 101);
+        assert!(sent == 2000, 0);
+        assert!(received == 2000, 1);
+        assert!(fungible_asset::amount(&fa) == 0, 2);
+        burn_token_for_test(fa);
+    }
+
+    #[test]
+    fun test_additional_pauser_can_toggle() {
+        setup();
+
+        let admin = &create_signer_for_test(@oft_admin);
+        let p1 = @0xAAA1;
+        let p2 = @0xAAA2;
+        set_pauser(admin, p1);
+        set_pauser(admin, p2);
+
+        let ps1 = &create_signer_for_test(p1);
+        set_paused(ps1, true);
+        assert!(is_paused(), 0);
+        let ps2 = &create_signer_for_test(p2);
+        set_paused(ps2, false);
+        assert!(!is_paused(), 1);
+    }
+
+    #[test]
+    #[expected_failure(abort_code = 5)] // EUNAUTHORIZED
+    fun test_non_pauser_still_unauthorized() {
+        setup();
+        let admin = &create_signer_for_test(@oft_admin);
+        let p = @0xAAA2;
+        set_pauser(admin, p);
+        let r = &create_signer_for_test(@0xCAFE);
+        set_paused(r, true);
+    }
+
+    #[test]
+    #[expected_failure(abort_code = 4)] // EPAUSED
+    fun test_credit_blocked_when_paused() {
+        let mint_ref = setup();
+        let amount_ld = 500u64;
+
+        // Prepare escrow balance
+        let deposit = mint(&mint_ref, amount_ld);
+        let src_eid = 101u32;
+        let (_s2, _r2) = debit_fungible_asset(@0x444, &mut deposit, 0, src_eid);
+        burn_token_for_test(deposit);
+
+        let admin = &create_signer_for_test(@oft_admin);
+        let p = @0xD00D;
+        set_pauser(admin, p);
+        let ps = &create_signer_for_test(p);
+        set_paused(ps, true);
+
+        let _ = credit(@0x7777, amount_ld, src_eid, option::none());
+    }
+
+    #[test]
+    #[expected_failure(abort_code = 5)] // EUNAUTHORIZED
+    fun test_removed_pauser_loses_ability() {
+        setup();
+
+        let admin = &create_signer_for_test(@oft_admin);
+        let p1 = @0x111;
+        let p2 = @0x222;
+        set_pauser(admin, p1);
+        set_pauser(admin, p2);
+
+        // Remove p1
+        remove_pauser(admin, p1);
+
+        // p1 should no longer be authorized
+        let ps1 = &create_signer_for_test(p1);
+        set_paused(ps1, true);
+    }
+
     #[test]
     fun test_debit() {
         let mint_ref = setup();