A circuit breaker is a flag that pauses vulnerable functions while recovery functions stay available. It limits damage while you fix a bug. Design it with a narrow scope, a different key from routine admin, and monitoring that tells someone to use it.
What the guidance says
ethereum.org's security page describes emergency stops as a global flag that can pause vulnerable functions while keeping recovery functions available. It recommends decentralizing who can trigger it, for example through a multisig, voting, or a timelock. OpenZeppelin's utilities describe Pausable as a common emergency response mechanism that can pause functionality while a remediation is pending.
Design choices
Scope. Pause deposits and trades, but keep withdrawals and recovery working where you can. A pause that traps user funds creates its own incident.
Who can pause. Pausing is a low regret action, so it can use a faster path than upgrades. Give it its own role rather than reusing the top admin key. See Ownable or AccessControl.
Who can unpause. Unpausing is riskier, since it resumes exposure. Consider requiring a stronger approval than pausing.
Automatic triggers. Some designs pause themselves when a value leaves a band, such as a price jump. Automatic pauses can be abused to freeze a protocol on purpose, so test that path as an attacker would.
Detection comes first
A switch nobody presses does nothing. ethereum.org advises emitting events for safety critical actions and monitoring them offchain with alerts on unusual activity. Decide in advance:
- Which events and thresholds raise an alert.
- Who is paged, and who is the backup.
- What authority the on call person has to pause without waiting for approval.
Tension with timelocks
A timelock slows changes on purpose. That is good for upgrades and bad for emergencies. The ethereum.org upgrade guide says outright that timelocks slow emergency patches. The pause path is how you keep a fast response without weakening the delay on everything else.
Rehearse it
- Run a drill on a testnet or fork: detect, pause, investigate, fix, unpause.
- Time each step and note who was unreachable.
- Check that recovery functions still work while paused.
- Record the runbook where the on call person can find it.
Try it yourself
Open the continuous monitoring demo. Click through how a change in the environment surfaces as an alert, and look at what information the alert carries.
Click through it at your own pace, or open it full screen.
Safeguard offers continuous monitoring for dependencies and a free scan at gold.safeguard.sh/scan. It does not watch onchain events.
Quick check
Should the pause key be the same as the admin key?
Usually not. Pausing should be fast and low risk, so a separate role makes sense, while admin and upgrade powers sit behind stronger controls.
Can a pause switch itself be a risk?
Yes. If it can be triggered too easily or traps funds, it can be abused or cause harm of its own.
Sources
- ethereum.org: smart contract security
- ethereum.org: upgrading smart contracts
- OpenZeppelin: utilities API
Last reviewed: 19 October 2026.
