Permanently pauses all verification through this wrapper.
Only the guardian (contract owner) can call this. Once activated, all
subsequent verify() and verify_integrity() calls will revert.
Requires owner.require_auth().
Panics if the caller is not the owner.
fn estop(env: soroban_sdk::Env)
Pauses verification. Only the owner (guardian) can call this.
Panics with [EmergencyStopError::Unauthorized] if caller is not
the owner.
fn pause(env: soroban_sdk::Env, caller: soroban_sdk::Address)
Returns whether the emergency stop is currently activated.
fn paused(env: soroban_sdk::Env) -> bool
Forwards verification to the underlying verifier.
Reverts if the contract is paused (emergency stop activated).
fn verify(
env: soroban_sdk::Env,
seal: soroban_sdk::Bytes,
image_id: soroban_sdk::BytesN<32>,
journal: soroban_sdk::BytesN<32>,
) -> Result<(), VerifierError>
Always panics -- unpausing is permanently disallowed.
Always panics with [EmergencyStopError::UnpauseNotAllowed].
fn unpause(env: soroban_sdk::Env, caller: soroban_sdk::Address)
Returns Some(Address) if ownership is set, or None if ownership has
been renounced.
e - Access to the Soroban environment.fn get_owner(env: soroban_sdk::Env) -> Option
Returns the address of the underlying verifier being wrapped.
fn get_verifier(env: soroban_sdk::Env) -> soroban_sdk::Address
Initializes the emergency stop wrapper.
verifier -- address of the underlying verifier contract to wrap
(e.g., a Groth16 verifier)owner -- address of the guardian who can trigger the emergency stopfn __constructor(
env: soroban_sdk::Env,
verifier: soroban_sdk::Address,
owner: soroban_sdk::Address,
)
Accepts a pending ownership transfer.
e - Access to the Soroban environment.crate::role_transfer::RoleTransferError::NoPendingTransfer] - If
there is no pending transfer to accept.["ownership_transfer_completed"][new_owner: Address]fn accept_ownership(env: soroban_sdk::Env)
Forwards receipt integrity verification to the underlying verifier.
Reverts if the contract is paused (emergency stop activated).
fn verify_integrity(
env: soroban_sdk::Env,
receipt: Receipt,
) -> Result<(), VerifierError>
Permanently pauses verification by submitting a proof of exploit.
Anyone can call this if they can produce a valid receipt whose
claim_digest is the zero digest (all zeros). Such a receipt
indicates a vulnerability in the verifier because a zero claim
digest should never be provable.
receipt.claim_digest == [0u8; 32]EmergencyStopError::InvalidProofOfExploit] if the
receipt's claim digest is not the zero digest.fn estop_with_receipt(env: soroban_sdk::Env, receipt: Receipt)
Renounces ownership of the contract.
Permanently removes the owner, disabling all functions gated by
#[only_owner].
e - Access to the Soroban environment.OwnableError::TransferInProgress] - If there is a pending ownership
transfer.OwnableError::OwnerNotSet] - If the owner is not set.fn renounce_ownership(env: soroban_sdk::Env)
Initiates a 2-step ownership transfer to a new address.
Requires authorization from the current owner. The new owner must later
call accept_ownership() to complete the transfer.
e - Access to the Soroban environment.new_owner - The proposed new owner.live_until_ledger - Ledger number until which the new owner can
accept. A value of 0 cancels any pending transfer.OwnableError::OwnerNotSet] - If the owner is not set.crate::role_transfer::RoleTransferError::NoPendingTransfer] - If
trying to cancel a transfer that doesn't exist.crate::role_transfer::RoleTransferError::InvalidLiveUntilLedger] -
If the specified ledger is in the past.crate::role_transfer::RoleTransferError::InvalidPendingAccount] -
If the specified pending account is not the same as the provided new
address.fn transfer_ownership(
env: soroban_sdk::Env,
new_owner: soroban_sdk::Address,
live_until_ledger: u32,
)