[CRITICAL] No pause/circuit-breaker mechanism — cannot halt system in emergency

[grantfox-oss]

Summary

None of the four contracts (prediction_market, pulse_token, referral_registry, leaderboard) implement an emergency pause or circuit-breaker. If a vulnerability is discovered or a dependency is compromised, there is no way to halt risk-creating operations until a code fix is deployed.

Impact

• During an active exploit, new bets, mints, and referrals continue to flow in, amplifying losses.
• Users cannot exit safely — cancel_refund and claim may depend on compromised state.
• The only mitigation is an upgrade, which itself requires an admin key (see issue: arbitrary WASM replacement).

Fix

• Add a Pausable trait to every contract with a set_paused(bool) admin entry point.
• Block all state-mutating entry points while paused: place_bet, create_market, resolve_market, cancel_market, mint, transfer, burn, register_referral, credit.
• Keep read-only and recovery paths open: balance, total_supply, get_payout, claim (so users can still exit).
• Emit a Paused / Unpaused event for off-chain monitoring.

[Killerjunior]

Hi maintainer, I have read and understood the issue requirements and checked the necessary documentation. I’m confident I can work on this task effectively and deliver a proper solution.

[Samaro1]

Gm gm boss. I would like to take this one on. I can add a Pausable trait with a set_paused admin entry point to each of the four contracts, block the listed state-mutating entrypoints while paused while keeping balance, total_supply, get_payout, and claim open so users can still exit, and emit the Paused/Unpaused events for off-chain monitoring. Please assign it to me.

[grantfox-oss]

🦊 GrantFox — @Killerjunior has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #171)
2. Your PR will be reviewed by the SPulse-Org maintainers

Good luck! Track your progress on GrantFox.