fix

packages/protocol/contracts/bridge/Bridge.sol

@@ -3,6 +3,7 @@ pragma solidity 0.8.24;
 
 import "../common/EssentialContract.sol";
 import "../libs/LibAddress.sol";
+import "../libs/LibMath.sol";
 import "../signal/ISignalService.sol";
 import "./IBridge.sol";
 
@@ -13,6 +14,7 @@ import "./IBridge.sol";
 /// @custom:security-contact [email protected]
 contract Bridge is EssentialContract, IBridge {
     using Address for address;
+    using LibMath for uint256;
     using LibAddress for address;
     using LibAddress for address payable;
 
@@ -207,7 +209,7 @@ contract Bridge is EssentialContract, IBridge {
             }
         }
 
-        if (block.timestamp >= invocationDelay + receivedAt) {
+        if (_isPostInvocationDelay(receivedAt, invocationDelay)) {
             delete proofReceipt[msgHash];
             messageStatus[msgHash] = Status.RECALLED;
 
@@ -279,7 +281,7 @@ contract Bridge is EssentialContract, IBridge {
             }
         }
 
-        if (block.timestamp >= invocationDelay + receivedAt) {
+        if (_isPostInvocationDelay(receivedAt, invocationDelay)) {
             // If the gas limit is set to zero, only the owner can process the message.
             if (_message.gasLimit == 0 && msg.sender != _message.destOwner) {
                 revert B_PERMISSION_DENIED();
@@ -598,4 +600,15 @@ contract Bridge is EssentialContract, IBridge {
             return false;
         }
     }
+
+    function _isPostInvocationDelay(
+        uint256 _receivedAt,
+        uint256 _invocationDelay
+    )
+        private
+        view
+        returns (bool)
+    {
+        return block.timestamp >= _receivedAt.max(lastUnpausedAt) + _invocationDelay;
+    }
 }

packages/protocol/contracts/common/EssentialContract.sol

@@ -23,6 +23,8 @@ abstract contract EssentialContract is UUPSUpgradeable, Ownable2StepUpgradeable,
 
     uint8 private __paused;
 
+    uint64 public lastUnpausedAt;
+
     uint256[49] private __gap;
 
     /// @notice Emitted when the contract is paused.
@@ -78,6 +80,7 @@ abstract contract EssentialContract is UUPSUpgradeable, Ownable2StepUpgradeable,
     /// @notice Unpauses the contract.
     function unpause() public virtual whenPaused {
         __paused = _FALSE;
+        lastUnpausedAt = uint64(block.timestamp);
         emit Unpaused(msg.sender);
         // We call the authorize function here to avoid:
         // Warning (5740): Unreachable code.

packages/protocol/contracts/team/TimelockTokenPool.sol

@@ -163,14 +163,14 @@ contract TimelockTokenPool is EssentialContract, EIP712Upgradeable {
     }
 
     /// @notice Withdraws all withdrawable tokens.
-    function withdraw() external nonReentrant {
+    function withdraw() external nonReentrant whenNotPaused {
         _withdraw(msg.sender, msg.sender);
     }
 
     /// @notice Withdraws all withdrawable tokens to a designated address.
     /// @param _to The address where the granted and unlocked tokens shall be sent to.
     /// @param _sig Signature provided by the grant recipient.
-    function withdraw(address _to, bytes memory _sig) external nonReentrant {
+    function withdraw(address _to, bytes memory _sig) external whenNotPaused nonReentrant {
         if (_to == address(0)) revert INVALID_PARAM();
         address recipient = ECDSA.recover(getWithdrawalHash(_to), _sig);
         _withdraw(recipient, _to);