Guardian and pause
The guardian is the pause role, held by the monitor: a Kaspa key stored in BridgeMint and in the pool, and an EVM address set in each vault. It can pause the bridge and the pool, and do nothing else. On any alarm, including a failed INV-1, the monitor uses it to pause both vaults, the minter and the pool, and keeps them paused until an operator acknowledges the alarm. It never unpauses.
What the guardian can do
Section titled “What the guardian can do”| Side | Guardian | Mechanism |
|---|---|---|
| BridgeMint (Kaspa) | Pause minting | pause: a transaction signed by the x-only guardian key stored in BridgeMint |
| Each vault (EVM) | Pause the vault | pause() from the vault’s guardian address (the owner can also pause) |
| KasPool (Kaspa) | Pause swaps and new liquidity | pause: a transaction signed by the pool’s guardian key, the same Kaspa key as BridgeMint’s |
Tests check that nobody else can pause, and that on the vault the guardian can do nothing else. In BridgeMint
the guardian key is checked only by pause.
What a pause stops
Section titled “What a pause stops”| Paused | Stops | Keeps working |
|---|---|---|
| BridgeMint | mint |
Governance (govern), including skip_nonce and set_limits |
| Vault | deposit, release, refund |
Every owner function, so a fix can be made before unpausing |
| KasPool | buy, sell, sell_all, add, init |
remove: liquidity providers can always withdraw. collect and the admin’s key changes |
A pause never affects kUSDT itself. Transfers between users and burns keep working, because the KCC-20 token has no pause.
Who resumes
Section titled “Who resumes”| Side | Resume | Quorum |
|---|---|---|
| BridgeMint | unpause through govern |
4 of 5 signers. A bad minting quorum of 3 cannot undo the pause |
| Vault | unpause() |
The owner only; the guardian cannot unpause. On mainnet through the AccessManager’s emergency delay, about 6 hours |
| KasPool | unpause |
The pool admin only |
Replacing the guardian
Section titled “Replacing the guardian”| Side | How |
|---|---|
| BridgeMint | set_signers, which sets the signer set and the guardian together; 4 of 5 signers |
| Vault | setGuardian, by the owner; on mainnet through the AccessManager’s emergency delay, about 6 hours. Queue it with unpause, or a thief with the old key pauses again |
| KasPool | set_keys, by the pool admin |
Two monitors, one guardian
Section titled “Two monitors, one guardian”BridgeMint, the pool and each vault each accept one guardian key, so a second monitor either only alarms
(dryRun, no keys) or holds the same guardian keys. A stolen guardian key can only pause, so sharing it with a second,
independent monitor costs griefing at worst and means one monitor going down no longer means no pause. The mainnet
checklist asks for at least two monitors. Recovering from a stolen guardian key is on
Operations.