Pause and resume controls
Introduction
Equillar uses OpenZeppelin's Stellar Pausable contract to provide a general-purpose safety switch. When the contract is paused, virtually all state-changing functions are blocked, protecting the contract while an incident (a suspected bug, unexpected behavior, etc.) is investigated.
Guard behavior by function
| Function | Behavior when paused |
|---|---|
invest | Blocked |
enable_investment_liquidations | Blocked |
disable_investment_liquidations | Blocked |
check_investment_liquidations | Allowed (read-only) |
process_investor_payment | Blocked |
refund_investor | Blocked |
get_contract_balance | Allowed (read-only) |
grant_operator / revoke_operator | Blocked |
grant_company / revoke_company | Blocked |
grant_manager / revoke_manager | Blocked |
transfer_admin_role / accept_admin_transfer_role | Blocked |
withdrawn | Blocked |
withdrawn_commissions | Blocked |
withdrawn_all | Blocked |
add_company_transfer | Blocked |
activate_emergency_close | Blocked |
emergency_pay_investor | Blocked |
add_collateral | Blocked |
pay_with_collateral | Blocked |
return_collateral_to_company | Blocked |
upgrade | Only allowed while paused |
As a general rule, every function that moves funds, changes roles, or alters the contract's configuration is blocked while paused. The only exceptions are read-only functions (get_contract_balance, check_investment_liquidations), which remain available so the contract's state can still be inspected during an incident, and upgrade, which can only be called while the contract is paused — ensuring the contract's code cannot change mid-transaction or while other operations might still be in flight.
Why nothing is exempted
Unlike emergency close — which is a targeted, terminal wind-down mechanism scoped to settling outstanding obligations — pause is meant to be a full stop covering every fund-moving operation, including investor-facing ones like refund_investor. This is intentional: if the reason for pausing is a suspected issue with the contract's logic or accounting, leaving any single fund-moving function active would undermine the safety guarantee the pause is meant to provide. Once the contract is confirmed safe, the admin can resume normal operation, and any pending refunds, payments, or other operations can proceed as usual.