yash/feat/pausable-until

[0xpanicError]

Note

High Risk
Touches pausing and role-gated control paths across many core contracts (deposits/withdrawals/redemptions/rate limiting), so miswiring _requireNotPaused or role assignments can halt protocol operations or weaken emergency controls.

Overview
Adds a new PausableUntil utility (namespaced storage, 1-day max duration + per-pauser cooldown) and integrates it into multiple contracts so whenNotPaused checks also block during a timed pause.

Exposes pauseContractUntil() / unpauseContractUntil() across LiquidityPool, Liquifier, EtherFiNodesManager, EtherFiRateLimiter, EtherFiRedemptionManager, PriorityWithdrawalQueue, WithdrawRequestNFT, WeETHWithdrawAdapter, and CumulativeMerkleRewardsDistributor, with new RoleRegistry roles PAUSE_UNTIL_ROLE and UNPAUSE_UNTIL_ROLE and interface updates.

Refactors Liquifier access control away from local admins/pausers mappings to RoleRegistry roles (LIQUIFIER_ADMIN_ROLE, LIQUIFIER_SENDER_ROLE, PROTOCOL_PAUSER/UNPAUSER), and removes the scan-completion gate from WithdrawRequestNFT.unPauseContract(); adds extensive tests for timed pause behavior and role requirements (including a new PausableUntil.t.sol and adapter tests).

^{Reviewed by Cursor Bugbot for commit de8e044. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pankajjagtapp]

lgtm

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit de8e044. Configure here.}

[cursor]

Override blocks full-pause escalation during timed pause

Medium Severity

The _requireNotPaused override routes through _requireNotPausedUntil(), which also gates OZ's internal _pause() (since it carries a whenNotPaused modifier). This means pauseContract() reverts while pause-until is active, preventing the PROTOCOL_PAUSER from escalating a time-limited pause to a full indefinite pause. Contracts with custom pause implementations (e.g., LiquidityPool, PriorityWithdrawalQueue) don't have this limitation because their pauseContract() sets paused = true directly. This creates inconsistent emergency-pause behavior across the protocol.

Additional Locations (2)

• src/EtherFiRedemptionManager.sol#L430-L434
• src/EtherFiRateLimiter.sol#L46-L50

 

^{Reviewed by Cursor Bugbot for commit de8e044. Configure here.}