Transition from GateSeals to CircuitBreaker

TL;DR

It is proposed to replace GateSeals with CircuitBreaker, a permanent emergency pause contract. Unlike GateSeals, CircuitBreaker does not expire, does not require recurring redeployment, and allows committees to prolong their pause authority over assigned contracts by periodically submitting liveness checks ("heartbeats"). The full CircuitBreaker design is specified in LIP-34.

Motivation

During emergencies that require immediate protocol-level changes, the Lido DAO cannot react quickly enough via on-chain governance, as the on-chain governance flow takes several days to enact a decision. To address this operational constraint, GateSeal was introduced as a temporary emergency pause mechanism. GateSeal has proven to be an acceptable solution, enabling fast response without requiring a DAO vote. However, the current GateSeal design does not scale well and introduces significant operational overhead:

• Each GateSeal is configured upon creation with immutable parameters — committee (pauser), pause duration, set of pausable contracts, and expiry — which cannot be changed without redeployment.
• Once a GateSeal is used to pause any contract(s) within its scope, it is fully consumed and can no longer be used to pause the remaining contracts, leaving them unprotected.
• GateSeals expire after a predefined period (up to 1 year) and must be renewed by a DAO vote periodically, even if unused.
• Once triggered, a GateSeal becomes inactive and must be replaced.

As a result, even routine maintenance requires a full technical and governance cycle: new instance deployment, verification, Snapshot vote, and on-chain execution (example). As the number of pausable contracts grows (with Lido V3, Triggerable Withdrawals, and future releases), this overhead compounds.

CircuitBreaker addresses these design constraints by introducing a permanent mechanism that removes the need for recurring redeployment while preserving the existing safeguards.

Mechanism Design

CircuitBreaker is a single, permanent contract that manages all emergency pausing for the Lido protocol. CircuitBreaker maintains a mapping between pausable contracts and multisig committees ("pausers"). Each pausable contract has exactly one assigned pauser, while a single committee may be responsible for multiple contracts. Pausers can be registered, replaced, or removed via an on-chain vote.

Emergency pause. In an emergency, an authorized committee can selectively pause its assigned contract(s) by triggering CircuitBreaker. Once a contract is paused, the committee’s pause authority over that contract is revoked. The committee can still pause other contracts assigned to it. The DAO can restore pausing permissions via an on-chain vote. The pause expires automatically after a parameterized period or may be lifted earlier through an on-chain DAO vote.

Liveness check ("heartbeat"). Each pauser must periodically submit a heartbeat (a drill transaction) to remain authorized to pause assigned contracts. The heartbeat interval is defined by CircuitBreaker parameters. A single heartbeat confirms liveness across all contracts assigned to the pauser. If a heartbeat expires, the pauser loses the ability to pause or refresh its authorization. Authorization can only be restored by the DAO through reassignment of the pauser.

DAO control. The DAO can revoke CircuitBreaker pause permissions via on-chain governance, effectively disabling it if needed. This provides a safeguard in case of vulnerabilities, governance decisions, or migration to a new emergency mechanism.

More details can be found in LIP-34. Audit reports are published on the Research forum.

Parameters

Immutable parameters (set at deployment):

Configurable parameters (may be adjusted via DAO governance after deployment within immutable bounds):

Notes:

• Lido DAO Agent is set as the admin, enabling on-chain governance over CircuitBreaker, including registering, replacing, and removing pausers, as well as updating pause duration and heartbeat interval
• pauseDuration and heartbeatInterval apply globally to all pausable contracts and pausers; updates to heartbeatInterval affect only future heartbeats
• Pause duration bounds are designed to accommodate possible changes in governance timing
• Proposed pauseDuration (21 days) covers worst-case governance flow (14 days) and buffer for coordination (7 days)

Migration scope

It is proposed to migrate from GateSeals to CircuitBreaker as the emergency pause mechanism for all existing and future pausable contracts.

If this proposal is approved, the CircuitBreaker will replace the following currently active GateSeals:

GateSeal: 0x8A854C4E750CDf24f138f34A9061b2f556066912
Pauser: GateSeal Committee
Contracts: WithdrawalQueue

GateSeal: 0xA6BC802fAa064414AA62117B4a53D27fFfF741F1
Pauser: GateSeal Committee
Contracts: ValidatorsExitBusOracle, TriggerableWithdrawalsGateway

GateSeal: 0x881dAd714679A6FeaA636446A0499101375A365c
Pauser: GateSeal Committee
Contracts: VaultHub, PredepositGuarantee

GateSeal: 0xE1686C2E90eb41a48356c1cC7FaA17629af3ADB3
Pauser: CSM Committee
Contracts: CSModule, CSAccounting, CSFeeOracle, CSVerifier, VettedGate, CSEjector

All addresses can be verified in the Lido Docs.

Following this migration, the GateSeal Committee will be renamed to CircuitBreaker Committee.

Next steps

If this proposal is approved:

• An on-chain vote will be conducted to revoke pause roles from existing GateSeals, grant pause permissions to CircuitBreaker, and assign approved pausers to their respective contracts. Following execution, CircuitBreaker will become the primary emergency pause mechanism, and GateSeals will be deprecated.
• The GateSeal committee will be renamed to the CircuitBreaker Committee.