# Pause check bypass on alternate path

Global pause enforced on one entrypoint but missing on a parallel transfer, mint, retry or unwind path

_Area: Smart contract access control and control flow. Seen in 10 disclosed reports; latest 2026-08-20. Updated 2026-10-23._

## How it works
A protocol adds a global pause/freeze/suspension flag to stop state changes during an emergency. The check is placed on the entrypoint the author was thinking about (a router call, a wrapper, a forward path) rather than on the state-mutating action itself. Any other route that reaches the same state — a token-level transfer, a retry/replay handler, a refund path, a post-execution hook, a shared validation helper — runs without the check. The broken assumption is "pausing X stops X"; in reality the guarded action is reachable below or beside the guard.

## Where it shows up
- Pause modifier on an outer wrapper but not on inner handlers reachable via retry/replay [E5](https://bugbountylibrary.com/r/cantina%3Avenus_apr2024%3A3.1.1.md).
- Flag checked in one branch of a multi-branch dispatcher; fall-through branches still emit transactions [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-05.md).
- Pause enforced in post-tx hooks rather than inline in the call path, so lower-level entrypoints skip it [E3](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-26.md).
- Public token methods (transfer) and finalization callbacks unguarded while router entrypoints are paused [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-23.md).
- Asymmetric gating: forward path paused, unwind/refund path also paused (or vice versa) [E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-13.md).
- Shared validation helper reused on the opposite direction (withdraw gated like deposit) [E4](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-07.md).
- Freeze check on most entrypoints but omitted on withdrawal/settlement functions [E8](https://bugbountylibrary.com/r/sherlock%3A2023-11-covalent%3AM-4.md).

## How to review
Enumerate every external/public entrypoint and every callback that can mutate the guarded state, then confirm each routes through the same guarded internal helper. The invariant: if the pause flag is set, no path can change balances, mint, queue, sign, or settle — except paths explicitly required to unwind in-flight state, which must be exempt. For multi-branch code, confirm the flag is checked before any branch that can emit a transaction [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-05.md). For hook-based checks, list entrypoints that reach the action below the hook [E3](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-26.md).

## Variants seen
- Fall-through dispatcher branch ignores flag and coin type [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-05.md).
- Refund path gated while forward path is not, stranding funds [E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-13.md).
- Post-execution hook bypass via crosschain call path [E3](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-26.md).
- Suspension check reused on withdrawal, freezing collateral [E4](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-07.md).
- Nonblocking retry bypasses wrapper pause [E5](https://bugbountylibrary.com/r/cantina%3Avenus_apr2024%3A3.1.1.md).
- Direct token transfer bypasses router pause [E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-23.md).
- Pause skipped on a boundary condition after a prior fix [E7](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.11.md).
- Freeze check missing on unstake withdrawal [E8](https://bugbountylibrary.com/r/sherlock%3A2023-11-covalent%3AM-4.md).

## Why fixes fail
E7 shows a patch that paused only when a non-unwinding position exists; the complementary state (all positions unwinding, full slash) still skipped the pause. Guard conditions tied to incidental state leave boundary cases open.

## Impact and severity
Stolen or stranded funds, frozen collateral, governance actions queued during pause, and containment broken across remediation [E1](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-05.md)[E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-13.md)[E4](https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-07.md)[E5](https://bugbountylibrary.com/r/cantina%3Avenus_apr2024%3A3.1.1.md)[E6](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-23.md). Severity rises when the bypass enables value extraction or blocks refunds during an emergency, when the pause is the last line of defense, and when the alternate path is a routine public function.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-05.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-13.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-26.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-07.md
- E5: https://bugbountylibrary.com/r/cantina%3Avenus_apr2024%3A3.1.1.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-23.md
- E7: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.11.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2023-11-covalent%3AM-4.md