|
| 1 | +# Emergency Mode |
| 2 | + |
| 3 | +## Table Of Contents |
| 4 | + |
| 5 | +- [Overview](#overview) |
| 6 | +- [Key Characteristics](#key-characteristics) |
| 7 | + - [One-Way Activation](#one-way-activation) |
| 8 | + - [Bypasses All Lock-Ups](#bypasses-all-lock-ups) |
| 9 | + - [Minimal Accounting Updates](#minimal-accounting-updates) |
| 10 | + - [Restricted Operations](#restricted-operations) |
| 11 | +- [When Emergency Mode Is Used](#when-emergency-mode-is-used) |
| 12 | +- [Relationship with Leave Mechanism](#relationship-with-leave-mechanism) |
| 13 | + |
| 14 | +## Overview |
| 15 | + |
| 16 | +Emergency mode is a critical safety mechanism built into the staking system that allows users to immediately exit and |
| 17 | +recover their funds in exceptional circumstances. When enabled, it bypasses normal operational constraints including |
| 18 | +lock-up periods, providing an unconditional exit path for all stakers. |
| 19 | + |
| 20 | +This mechanism exists as a last-resort protection against catastrophic scenarios such as security vulnerabilities, |
| 21 | +malicious contract upgrades, or critical system failures. |
| 22 | + |
| 23 | +## Key Characteristics |
| 24 | + |
| 25 | +### One-Way Activation |
| 26 | + |
| 27 | +Emergency mode is **irreversible**. Once enabled by an admin or guardian, it cannot be disabled. This ensures that if |
| 28 | +the system is compromised, malicious actors cannot prevent users from exiting by toggling emergency mode off. |
| 29 | + |
| 30 | +### Bypasses All Lock-Ups |
| 31 | + |
| 32 | +Unlike the user's capablity to [leave](leave-mechanism.md) the system, which respects lock-up periods, emergency exit |
| 33 | +allows users to withdraw their funds immediately regardless of when their lock period expires. This ensures that users |
| 34 | +can always access their funds in a true emergency. |
| 35 | + |
| 36 | +### Minimal Accounting Updates |
| 37 | + |
| 38 | +When users perform an emergency exit, the StakeManager's internal accounting is **not updated**. This design choice |
| 39 | +ensures that: |
| 40 | + |
| 41 | +- Users can exit even if the StakeManager is broken or malicious |
| 42 | +- Exits cannot be blocked by reverting transactions |
| 43 | +- The function remains simple and reliable under all circumstances |
| 44 | + |
| 45 | +The trade-off is that the StakeManager's state becomes stale, but this is acceptable since emergency mode is terminal |
| 46 | +for the contract. |
| 47 | + |
| 48 | +### Restricted Operations |
| 49 | + |
| 50 | +Once emergency mode is enabled, most staking operations are blocked to prevent further interactions with a potentially |
| 51 | +compromised system. The allowed operations are [formally verified](../../PROPERTIES.md) to ensure user safety. |
| 52 | + |
| 53 | +## When Emergency Mode Is Used |
| 54 | + |
| 55 | +- If a critical security vulnerability is discovered that puts user funds at risk, emergency mode provides an immediate |
| 56 | + exit path before the vulnerability can be exploited. |
| 57 | +- If the StakeManager is upgraded to a malicious or broken implementation, guardians can enable emergency mode to allow |
| 58 | + users to exit before interacting with the compromised contract. |
| 59 | +- If the staking system experiences a failure that makes normal operations unsafe or impossible, emergency mode ensures |
| 60 | + users can still recover their funds. |
| 61 | + |
| 62 | +## Relationship with Leave Mechanism |
| 63 | + |
| 64 | +Emergency mode is distinct from the normal [leave mechanism](leave-mechanism.md): |
| 65 | + |
| 66 | +| Feature | Leave | Emergency Exit | |
| 67 | +| ------------------ | ------------------------------- | -------------------------------- | |
| 68 | +| Respects locks | Yes, locked funds stay in vault | No, bypasses all locks | |
| 69 | +| Updates accounting | Yes, full accounting update | No, accounting not updated | |
| 70 | +| Claims rewards | Yes, transfers accrued rewards | No, only staking tokens | |
| 71 | +| When available | Always | Only when emergency mode enabled | |
| 72 | +| Purpose | Graceful exit from system | Emergency fund recovery | |
| 73 | + |
| 74 | +Users should use `leave()` for normal exits (or unstake) and `emergencyExit()` only when emergency mode has been |
| 75 | +enabled. |
0 commit comments