निर्णय रिकॉर्ड · ADR-012
ADR-012: Forced transfers bypass pause and eligibility but still run hooks
A forced transfer works while the token is paused and against ineligible or frozen accounts, but it still passes through the hooks with OP_FORCED_TRANSFER, so a hook can require an order reference.
- दस्तावेज़ आईडी
- ADR-012
- तिथि
- 2026-09-21
- स्रोत
- docs/adr/ADR-012.md
| Field | Value |
|---|---|
| ID | ADR-012 |
| Subject area | Enforcement |
| Status | Accepted |
| Date | 2026-09-21 |
| Owners | A-REX Contributors |
| Related requirements | FR-06, NFR-03 (SDD §3) |
| Supersedes / superseded by | — |
Context
A court order, a pledge enforcement or a sanctions freeze must be executable at the worst moment: during an incident when the token is paused, against an account that is itself sanctioned, on units that are frozen. At the same time some rules legitimately govern enforcement, for example requiring a reference to the court order in the transfer data.
Issue
Should enforcement actions be subject to the same rules as ordinary transfers?
Assumptions
- A lawful order must be executable during an incident and against ineligible accounts.
- Some rules exist precisely to govern enforcement.
Constraints
- Enforcement must stay auditable (events, hooks).
Alternatives considered
| Alternative | For | Against | Outcome |
|---|---|---|---|
| Forced transfers bypass everything | Always executable | No rule can require an order reference; no observer hooks | Rejected |
| Forced transfers obey every rule | Uniform | Expiry, sanctions or pause would block seizures | Rejected |
Bypass pause, eligibility and the frozen check; run hooks with OP_FORCED_TRANSFER | Executable and still governable | Hook authors must handle the op explicitly | Accepted |
Decision
forcedTransfer (ENFORCER_ROLE) skips pause, canSend/canReceive and the frozen-balance check, lowers the frozen amount so that it never exceeds the remaining balance, and runs every hook with OP_FORCED_TRANSFER. Every reference hook returns OK for that op.
Argument
Bypassing the checks that would block a seizure, while keeping the hook pipeline, preserves both enforceability and the possibility of rules about enforcement itself.
Consequences
Positive
- Seizures, pledges and recalls are executable during incidents.
- Observers (traceability) record enforcement like any other operation.
Negative
ENFORCER_ROLEcan move any holder's units; it is a powerful key.
Obligations it creates
- Hook authors return OK for
OP_FORCED_TRANSFERunless the rule governs enforcement. ENFORCER_ROLEsits behind a multisig with a documented procedure.
Implementation and evidence
| What | Where |
|---|---|
| Implementation | ARexToken.forcedTransfer, _update |
| Tests | test/standard/ARexToken.test.js: forcedTransfer moves frozen units, unfreezes as needed, bypasses eligibility and works while paused, ExpiryHook blocks transfers of expired batches, allows burn and forced transfer |