Emergency pause controls protect reserves by halting withdrawals and swaps the moment a preset condition is breached. The same design is what lets Paraswap turn a failing adapter into a closed door instead of a drained pool. The contract-level pause path is documented on paragraph.com. A pause is a tripwire, not a firewall: it does not stop the attack from starting, only from reaching the reserves. The real choice is where to put that tripwire — a global pause or a per-swap price limit.
How the tripwire fires
Most implementations share one shape. A contract stores a boolean, often called paused or emergencyStopped. Every function that moves value checks that boolean at the top. When true, the function reverts. That includes withdraw, swap, mint, and redeem — anything that can reduce the reserve. The boolean itself is flipped by a known address: an owner, a multisig, or a keeper bot running an off-chain monitor.
- The monitor watches a number: reserve ratio, bridge balance, price deviation, or time since the last action.
- The monitor sends a transaction to call pause() or emergencyStop().
- The transaction is mined and the state flips to paused.
- All guarded functions now revert, freezing withdrawals and swaps.
The latency in that loop is the number that makes or breaks the design. It moves with polling frequency, gas price, block time, and whether the pause key is stored hot or cold.
The numbers that matter
The first is the threshold: the value of the monitored condition that trips the pause. It measures how much damage you accept before stepping in. Set it by stress-testing the reserve against historical volatility. A tight threshold trips early, but it also creates false positives; a loose threshold gives an attacker room. If the reserve is a stablecoin pair, a 0.5% deviation might be extreme; if it holds a volatile token, 5% can still be noise.
The second is reserve ratio: total backing assets divided by total issued liabilities. It measures solvency. It moves whenever users deposit, redeem, mint, or the market price of backing changes. A ratio below 1 means the reserve cannot cover everyone at current prices. The pause should fire before that line is crossed.
The third is latency: time from crossing the threshold to the pause being mined. It measures the exposure window. It moves with monitor interval and block time. If the monitor polls every second and pays high gas, latency can be less than one block. If the pause key is in a cold wallet, latency is one block plus a human signing delay — often minutes.
Pause or price-limit?
Uniswap Protocol's v3 periphery uses a per-swap price limit instead of a global pause. 0x Protocol's exchange proxy can be paused globally. Polygon Network's bridge uses a guardian-controlled pause. The choice is scope: a price limit protects one transaction and needs no keeper; a global pause protects the whole reserve but stops legitimate withdrawals too.
As an aggregator, Paraswap sits between these approaches. Its adapter layer carries an emergency stop so that a faulty integration can be isolated, while the rest of the routing stack keeps working. That is why the pause path belongs in the adapter, not only in each liquidity source.
The trade-off that is hard to defend
The real cost is liveness. While paused, no one can exit, even if their funds are fine. The pause key becomes a hostage risk: if it is compromised, funds are locked or the attacker may unpause after changing ownership. Add a security review for the pause path and a few days of failure-mode testing. That is the price of a switch that actually fires.
When you justify this to a stakeholder, frame it as insurance. A week of design, a few days of testing, and an audit line item buy a response measured in seconds rather than hours. The number that convinces is the exposure window: without pause, the window lasts until a human notices; with pause, it lasts until a transaction is mined.
If you cannot name the number that trips the pause, the pause is theater. I would drop the switch if someone showed me a monitor that can react faster than a transaction can be mined. On current block times, that monitor does not exist.