> ## Documentation Index
> Fetch the complete documentation index at: https://docs.defiloops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Emergency stops

> What we can switch off on the network when we find a bug, who holds the switch, and what a stop never touches

**In short:** if we find a bug, we can stop the agent, one operation, or the proved path on a network with one transaction. The key that sends it needs a touch on a hardware security key. A stop never blocks you from taking your money out with your own wallet. The same key that stops things can also approve new operations, and it is one key.

## What can be stopped

| stop | what it does | where |
| - | - | - |
| **Revoke the agent** | the agent contract can never act again, for every account that approved it | each network |
| **Suspend one operation** | that operation refuses to run, for every account | each network |
| **Switch off the proved path** | every step of every proved account is refused | each network |
| **Pause one circuit version** | plans proved under that version are refused | Base, Arbitrum and HyperEVM |
| **Block one list** | accounts committed to that list stop running | Base, Arbitrum and HyperEVM |
| **Pause list following** | accounts stop picking up new operations; they fall back to the last good list | Base, Arbitrum and HyperEVM |
| **Stop everything on a network** | the proved path off, and every listed operation suspended | each network |

"Each network" means Ethereum, Base, Arbitrum and HyperEVM. Ethereum has no list and no circuit, so it has only the first three stops. To stop Ethereum fully, we suspend every operation there.

> [!WARNING]
>
> **Revoking the agent is permanent for the accounts that approved it.** They can still withdraw and uninstall with their own key. They can never automate at that address again. We keep it for an agent that must never run again, and fix a bug by upgrading instead.

## What a stop never touches

Your own key keeps full control. You can withdraw, narrow your list, end a plan and stand the agent down while a stop is in force. If a stop leaves a plan unable to run, anyone may settle that plan so it does not hang.

A stop is also built so it cannot strand money. We rehearsed the stops on a copy of the real network.

## Who holds the switch

One key makes every stop. Each use needs a touch on a hardware security key, and a stop works at once.

* **Stopping** is instant. It is narrow and low in privilege on purpose.
* **Resuming** a new stop waits 24 hours between scheduling and running. A stop can cancel a scheduled resume.
* **The registry's own stops** resume at once on the network. Our rule is to wait the same 24 hours unless we are undoing a false alarm.

> [!WARNING]
>
> **That key is a single point.** The key that stops the agent also approves new operations, which take three days to start. It cannot appoint an agent or touch your account. It can add operations to a list that accounts follow, after a 3-day notice. We plan to split stopping from approving by giving the stop its own key. That is not done.

## What the app does too

* The app refuses a plan that names a suspended operation, or that needs the proved path while it is off, before it reaches the network.
* You can press Stop on any run. That ends the run's workflow at once and never fails. Steps not yet sent are never sent.
* Stopping a strategy that rests orders on a venue cancels those orders in the modes that say so.

## Under the hood

For integrators.

* Stops live in the registry, the proof gate and the list contract. A stop reads back from the chain, and a script fails loudly if the flag does not hold.
* The stop tool refuses a stop key that is also the deployer, publisher, upgrader or agent signing key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.