Pausing the bridge

The OptimismPortal (opens in a new tab) is the low-level L1 message passing contract present on all standard OP Stack chains. This contract handles the L1 side of the communication channel between an OP Stack chain and its L1 parent chain.

As a safety mechanism, the OptimismPortal contract can be configured to be pausable by a specific GUARDIAN address. When paused, the OptimismPortal contract will prevent L2-to-L1 transactions from being executed. This is a backup safety mechanism that can be used to help mitigate potential active security concerns.

Pause functionality and two-step withdrawals (opens in a new tab) were introduced to the OP Stack to mitigate the risk of withdrawal bugs that have led to exploits in other bridging systems.

Pause functionality

The OptimismPortal can be configured to allow a GUARDIAN address to pause and unpause L2-to-L1 transactions from being executed. L2-to-L1 transactions allow users and smart contracts on the OP Stack chain to send messages to the L1 parent chain. Pause functionality allows a GUARDIAN to halt L2-to-L1 transaction execution for the OP Stack chain in question. L1-to-L2 transactions are not affected by pause functionality.

Pauses by the GUARDIAN impact all L2-to-L1 transactions for the OP Stack chain in question and cannot be targeted to specific users, smart contracts, or transactions. Pauses are designed to be a backup safety mechanism and are expected to be used only in the event of an active pressing security concern.

Pause and unpause functions

The GUARDIAN can pause and unpause L2-to-L1 transactions at any time by calling the pause (opens in a new tab) and unpause (opens in a new tab) functions on the OptimismPortal contract. Additional controls on the GUARDIAN address can be implemented by configuring the GUARDIAN as a smart contract.

Guardian address

The GUARDIAN address is initially configured when the OP Stack chain is deployed and can be modified by the network's administrative address or smart contract. A chain can choose to remove the GUARDIAN role by configuring the GUARDIAN to be an inaccessible address such as the zero address (opens in a new tab).

The GUARDIAN address is set as an immutable variable inside of the OptimismPortal contract. To change the GUARDIAN address, the OptimismPortal proxy contract must be upgraded to a new implementation contract that has a different GUARDIAN address.