x/circuit is a global circuit breaker for the chain. It exposes a system_available flag and a whitelist of accounts authorized to toggle it. Whitelist management is governance-controlled.

​
Core logic

  • system_available is a single boolean stored in module state.
  • Only whitelisted accounts can submit MsgUpdateCircuit.
  • Repeating the current system_available value succeeds without rewriting state.
  • An empty whitelist is allowed while system_available=true.
  • An empty whitelist is rejected while system_available=false, so at least one operator remains able to restore availability.
  • MsgUpdateParams updates the whitelist and requires the governance authority address.
  • gRPC query handlers reject nil request objects explicitly.

​
Enforcement scope

  • The circuit gate is enforced in ante for native Cosmos SDK transactions and EVM extension transactions.
  • eth_sendRawTransaction submissions become MsgEthereumTx and pass through ante checks, so they are also gated.
  • When system_available=false, only transactions containing MsgUpdateCircuit messages are allowed through the circuit gate.
  • Any transaction containing non-MsgUpdateCircuit messages is rejected with ErrUnauthorized and system unavailable.

​
Default genesis

{
  "circuit": {
    "params": {
      "whitelist": []
    },
    "state": {
      "system_available": true
    }
  }
}

​
Exposed methods

​
Cosmos SDK messages

  • MsgUpdateCircuit(signer, system_available)
  • MsgUpdateParams(authority, params)

​
Queries

  • Query/SystemAvailable
  • Query/Whitelist

​
CLI

ctmd query circuit system-available
ctmd query circuit whitelist
ctmd tx circuit update-circuit <true|false>

​
Test coverage

The source test set covers CLI flow, governance whitelist updates, no-op state-write behavior, keeper nil-request checks, empty whitelist recovery guard, native and EVM ante gate behavior, JSON-RPC route behavior, and query correctness.