Skip to main content

Goldsky

Onchain circuit breakers

Talk to our team

What it is

An onchain circuit breaker pauses a token, market or payout contract automatically when a rule is breached, such as an outflow above a limit or a price far from its source; engineers also call it an emergency pause, and ERC-7265 proposes a standard for it.

Stablecoin issuers, tokenized-stock venues and DeFi protocols use one so transfers, trades or payouts stop while their team works out what happened, without waiting for someone to notice.

Goldsky Compose checks events against your limits, alerts your team and sends the pause call through a role your contract grants it; the rules and the decision to resume stay with your team.

You can build an onchain circuit breaker two ways: run a Compose task on every event from the contract you protect, or have a Turbo Pipelines pipeline filter events across many contracts and call the task when a rule trips.

Who it’s for

Stablecoin issuers, tokenized-stock venues and DeFi protocols that need a token, market or payout to stop when something goes wrong.

How an onchain circuit breaker trips and pauses a contract

The diagram follows one breach, from the event that looks wrong to your team resuming the contract, and shows who does each step. Your setup may differ.

Your business, step 1: Agree the limitsWhat trips a pause, and who resumes
Blockchains, step 2: Something looks wrongA large outflow or bad price onchain
Goldsky, step 3: ComposeCheck the ruleEach event checked against your limits
Goldsky, step 4: ComposeAlert your teamSent the moment a rule trips
Goldsky, step 5: ComposePause the contractYour contract grants the task a pause role
Your business, step 7: Investigate and resumeYour team unpauses when it’s safe
Blockchains, step 6: Token or market pausedTransfers, trades or payouts stop
  • Goldsky

Ways to build an onchain circuit breaker

An event-triggered task checks each event from one contract in TypeScript and can keep totals between events; a pipeline checks single-event rules in SQL across many contracts or chains and calls the task only on a match.

Usual setupOption 1: Event-triggered task
Best for
A few contracts, with rules that need history
Products
Compose
What you run
Nothing on Goldsky cloud; single-tenant, VPC and on-premises deployments are enterprise options
What you write
TypeScript tasks
Where your data lives
Hosted by Goldsky
How results reach you
Acts onchain or calls your systems
Option 2: Stream events to a task
Best for
Many contracts or chains, with single-event rules
Products
TurboCompose
What you run
The destination: your database, queue or bucket, or a Postgres database Goldsky hosts
What you write
Pipeline YAML and SQL; TypeScript transforms when needed
Where your data lives
In your own database or systems
How results reach you
Pushed to you

Option 1: Build an onchain circuit breaker with an event-triggered task

A TypeScript task that Goldsky hosts runs for each event from the contract you protect and checks it against your limits. When a rule trips, it alerts your team and sends the pause call.

When to trip a circuit breaker from an event-triggered task

You protect a few contracts on EVM chains, and your rules need history between events, such as total outflows over the last hour.

What you’ll need

  • Goldsky Compose
  • A contract with a pause function and a role you can grant to the task’s address
  • Limits your team has agreed, such as the largest outflow allowed
  • An alert channel your team watches, reachable over HTTP
  • A runbook for investigating and resuming

  1. Agree the limits and who can pause

    A breaker trips on rules, so the team has to agree what counts as wrong before anything goes wrong.

    Write each rule as a number events can be checked against, such as the largest single outflow or a price band, and grant the pause role to the breaker’s address alone. A rule nobody signed off on gets argued over in the moment, and a breaker with broad rights is a risk of its own.

  2. Spot the event that looks wrong

    Breaches show up onchain as events: a large transfer out, a mint above plan, a trade far from the market price.

    These events land in blocks like any other. Some are attacks, some are mistakes and some are normal activity that only looks unusual, which is why the rules matter more than the alarm.

  3. Check each event against your rules

    Handled by Goldsky Compose

    The breaker has to look at every relevant event, not a sample.

    Each event is decoded and compared with your limits, and a rule over a period, such as outflows in the last hour, also needs a running total kept between events. Events handled out of order can throw that total off, so keep them in block order unless each one can be judged alone.

    With Goldsky, an onchain_event trigger runs the Compose task for each log from the contract, one at a time in order by default, and a collection holds the running totals your period rules need.

    Trigger a task from contract events (opens in a new tab)

  4. Alert your team

    Handled by Goldsky Compose

    People have to know the moment a rule trips, whether or not the contract pauses.

    The alert should name the rule, the contract and the transaction that tripped it. An alert that only says a breaker fired sends the team digging before they can act.

    The task posts the alert to your alerting endpoint with ctx.fetch, and the request and its response are recorded on the run.

    Call external APIs from a task (opens in a new tab)

  5. Pause the contract

    Handled by Goldsky Compose

    Pausing stops transfers, trades or payouts while the team works out what happened.

    The pause call has to reach the chain even when the network is busy, and stay there. A pause that was sent but dropped looks done in your logs while the contract keeps running.

    Goldsky Compose sends the call from the task’s wallet with writeContract, waits for the confirmations you set and, with onReorg set to replay, sends it again if a reorg removes it.

    Handle confirmations and reorgs (opens in a new tab)

  6. Stop transfers, trades or payouts

    While paused, the contract refuses the actions you chose to stop, which limits the damage while people look.

    Everyone can see the pause onchain. Transactions included before the pause still stand, so the investigation starts from what got through.

  7. Investigate and resume

    Only people can decide the cause is understood and it’s safe to restart.

    Your team checks what tripped the rule, fixes the cause if there was one and unpauses from an address that holds the unpause role. If the breaker could unpause itself, anyone able to trip it on and off would control the timing.

What to know about event-triggered circuit breakers

  • Rules run in TypeScript, so they can use totals from earlier events kept in a collection.
  • A task takes one onchain trigger, set on one contract address, so protecting many contracts means a task for each.
  • Events arrive one at a time in block order by default, which keeps running totals right.
  • The task only pauses; deciding to resume stays with your team.

Option 2: Build an onchain circuit breaker by streaming events to a task

Goldsky runs a pipeline that decodes events from every contract you watch and keeps only the rows that break a rule. Each match goes to a task that alerts your team and pauses the contract.

When to stream events to a circuit-breaker task

Your rule spans many contracts or a high volume of events, or the events come from a non-EVM chain, and each breach can be judged from a single event.

What you’ll need

  • Goldsky Turbo
  • Goldsky Compose
  • A contract with a pause function and a role you can grant to the task’s address
  • Limits your team has agreed, each one checkable on a single event
  • An alert channel your team watches, reachable over HTTP
  • A runbook for investigating and resuming

  1. Agree the limits and who can pause

    A breaker trips on rules, so the team has to agree what counts as wrong before anything goes wrong.

    Write each rule as a number events can be checked against, such as the largest single outflow or a price band, and grant the pause role to the breaker’s address alone. A rule nobody signed off on gets argued over in the moment, and a breaker with broad rights is a risk of its own.

  2. Spot the event that looks wrong

    Breaches show up onchain as events: a large transfer out, a mint above plan, a trade far from the market price.

    These events land in blocks like any other. Some are attacks, some are mistakes and some are normal activity that only looks unusual, which is why the rules matter more than the alarm.

  3. Decode events from every watched contract

    Handled by Goldsky Turbo

    A breaker watching many contracts needs their events in one stream, in a form it can check.

    Each contract’s events have to become rows with the fields your rules use. A contract left out of the source is a contract nobody is watching.

    A Turbo Pipelines source can read raw logs from many contracts at once, and a SQL transform decodes them with _gs_log_decode.

    Decode event logs in SQL (opens in a new tab)

  4. Keep only the events that break a rule

    Handled by Goldsky Compose

    Most events are normal, so the breaker should wake only for the ones that aren’t.

    Each rule has to be expressible on one event, such as a transfer above a limit. A rule that needs history, like total outflows over an hour, can’t be checked this way and moves to the task.

    With Goldsky, each rule is a WHERE clause in a Turbo Pipelines SQL transform, and a compose_task sink in the task’s trigger sends every matching row to the task.

    Feed a task from a pipeline (opens in a new tab)

  5. Alert your team

    Handled by Goldsky Compose

    People have to know the moment a rule trips, whether or not the contract pauses.

    The alert should name the rule, the contract and the transaction that tripped it. An alert that only says a breaker fired sends the team digging before they can act.

    The task posts the alert to your alerting endpoint with ctx.fetch, and the request and its response are recorded on the run.

    Call external APIs from a task (opens in a new tab)

  6. Pause the contract once per breach

    Handled by Goldsky Compose

    Pausing stops transfers, trades or payouts while the team works out what happened.

    A match can be delivered more than once, so the task checks whether it already acted on this event before sending anything. The pause itself has to reach the chain and stay there, even when the network is busy.

    The task can record each event id it acted on in a collection and skip repeats. The pause is a writeContract that waits for confirmations and is replayed if a reorg removes it.

    Keep state in collections (opens in a new tab)

  7. Stop transfers, trades or payouts

    While paused, the contract refuses the actions you chose to stop, which limits the damage while people look.

    Everyone can see the pause onchain. Transactions included before the pause still stand, so the investigation starts from what got through.

  8. Investigate and resume

    Only people can decide the cause is understood and it’s safe to restart.

    Your team checks what tripped the rule, fixes the cause if there was one and unpauses from an address that holds the unpause role. If the breaker could unpause itself, anyone able to trip it on and off would control the timing.

What to know about streaming events to a circuit breaker

  • The pipeline’s SQL checks one row at a time, so rules about totals over a period, or about something that didn’t happen, belong in the task or your own systems.
  • Matches are delivered at least once, so the task skips a breach it has already acted on.
  • The pipeline can read sources a simple contract trigger can’t, including many contracts and non-EVM chains.
  • Matches reach the task when they’re detected, so a reorg can remove an event that already tripped the breaker. Holding them for confirmations needs parallel_processing: true on the trigger, which gives up block order.

What you control

Your team
  • Agree the limits and who can pause
  • Investigate and resume

Questions and answers

What is ERC-7265?

ERC-7265 is a proposed Ethereum standard for a circuit breaker that halts or delays token outflows from a protocol when they pass a set threshold. It works inside the protocol’s own contracts, tracking outflows as they happen. A breaker that runs outside the contracts does a related job: it checks events against your rules and calls the contract’s pause function, so it works with any contract that already has one.

Security and deployment

  • SOC 2 Type IIIndependently audited security controls.
  • Dedicated infrastructureSingle-tenant options for production workloads.
  • Data residencyCloud, on-premises or co-located.

More use cases that run protocol automation

Use cases built the same way

Build an onchain circuit breaker with Goldsky

We’ll map it to your systems and show you what Goldsky runs, so your team builds the product, not the pipelines underneath it.

Talk to our team

© Endless Sky Inc. All rights reserved.

PrivacyTermsSecurity

System status