From e21324f3ffeb35cf4895b0c96ae90eaca815dd2b Mon Sep 17 00:00:00 2001
From: zanderbyte-certora <zanderbyte@certora.com>
Date: Wed, 30 Jul 2025 12:03:51 +0300
Subject: [PATCH] add modifier bypass mutations

---
 certora/mutations/020_withdraw_pause_bypass.patch   | 13 +++++++++++++
 certora/mutations/021_deposit_pause_bypass.patch    | 13 +++++++++++++
 certora/mutations/022_transfer_pause_bypass.patch   | 13 +++++++++++++
 certora/mutations/023_flow_pause_bypass.patch       | 13 +++++++++++++
 certora/mutations/024_lock_pause_bypass.patch       | 13 +++++++++++++
 certora/mutations/025_extendLock_pause_bypass.patch | 13 +++++++++++++
 certora/mutations/026_designate_pause_bypass.patch  | 13 +++++++++++++
 .../mutations/027_burnDesignated_pause_bypass.patch | 13 +++++++++++++
 .../mutations/028_burnAccount_pause_bypass.patch    | 13 +++++++++++++
 certora/mutations/029_freezeFund_pause_bypass.patch | 13 +++++++++++++
 ..._missing_whenNotPaused_withdrawByRecipient.patch | 13 +++++++++++++
 .../mutations/031_pause_access_control_bypass.patch | 13 +++++++++++++
 .../032_unpause_access_control_bypass.patch         | 13 +++++++++++++
 13 files changed, 169 insertions(+)
 create mode 100644 certora/mutations/020_withdraw_pause_bypass.patch
 create mode 100644 certora/mutations/021_deposit_pause_bypass.patch
 create mode 100644 certora/mutations/022_transfer_pause_bypass.patch
 create mode 100644 certora/mutations/023_flow_pause_bypass.patch
 create mode 100644 certora/mutations/024_lock_pause_bypass.patch
 create mode 100644 certora/mutations/025_extendLock_pause_bypass.patch
 create mode 100644 certora/mutations/026_designate_pause_bypass.patch
 create mode 100644 certora/mutations/027_burnDesignated_pause_bypass.patch
 create mode 100644 certora/mutations/028_burnAccount_pause_bypass.patch
 create mode 100644 certora/mutations/029_freezeFund_pause_bypass.patch
 create mode 100644 certora/mutations/030_add_missing_whenNotPaused_withdrawByRecipient.patch
 create mode 100644 certora/mutations/031_pause_access_control_bypass.patch
 create mode 100644 certora/mutations/032_unpause_access_control_bypass.patch

diff --git a/certora/mutations/020_withdraw_pause_bypass.patch b/certora/mutations/020_withdraw_pause_bypass.patch
new file mode 100644
index 0000000..1ddf224
--- /dev/null
+++ b/certora/mutations/020_withdraw_pause_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..8397373 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -221,7 +221,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+   /// ⚠️ The account holder can also withdraw itself, so when designing a smart
+   /// contract that controls funds in the vault, don't assume that only this
+   /// smart contract can initiate a withdrawal ⚠️
+-  function withdraw(FundId fund, AccountId accountId) public whenNotPaused {
++  function withdraw(FundId fund, AccountId accountId) public {
+     Controller controller = Controller.wrap(msg.sender);
+     _withdraw(controller, fund, accountId);
+   }
diff --git a/certora/mutations/021_deposit_pause_bypass.patch b/certora/mutations/021_deposit_pause_bypass.patch
new file mode 100644
index 0000000..fa8e898
--- /dev/null
+++ b/certora/mutations/021_deposit_pause_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..ac8b1cd 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -138,7 +138,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+     FundId fundId,
+     AccountId accountId,
+     uint128 amount
+-  ) public whenNotPaused {
++  ) public {
+     Controller controller = Controller.wrap(msg.sender);
+     _deposit(controller, fundId, accountId, amount);
+   }
diff --git a/certora/mutations/022_transfer_pause_bypass.patch b/certora/mutations/022_transfer_pause_bypass.patch
new file mode 100644
index 0000000..670f282
--- /dev/null
+++ b/certora/mutations/022_transfer_pause_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..42a3b9b 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -163,7 +163,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+     AccountId from,
+     AccountId to,
+     uint128 amount
+-  ) public whenNotPaused {
++  ) public {
+     Controller controller = Controller.wrap(msg.sender);
+     _transfer(controller, fundId, from, to, amount);
+   }
diff --git a/certora/mutations/023_flow_pause_bypass.patch b/certora/mutations/023_flow_pause_bypass.patch
new file mode 100644
index 0000000..220852a
--- /dev/null
+++ b/certora/mutations/023_flow_pause_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..52b7db0 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -180,7 +180,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+     AccountId from,
+     AccountId to,
+     TokensPerSecond rate
+-  ) public whenNotPaused {
++  ) public {
+     Controller controller = Controller.wrap(msg.sender);
+     _flow(controller, fundId, from, to, rate);
+   }
diff --git a/certora/mutations/024_lock_pause_bypass.patch b/certora/mutations/024_lock_pause_bypass.patch
new file mode 100644
index 0000000..703594f
--- /dev/null
+++ b/certora/mutations/024_lock_pause_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..26a17b0 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -116,7 +116,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+     FundId fundId,
+     Timestamp expiry,
+     Timestamp maximum
+-  ) public whenNotPaused {
++  ) public {
+     Controller controller = Controller.wrap(msg.sender);
+     _lock(controller, fundId, expiry, maximum);
+   }
diff --git a/certora/mutations/025_extendLock_pause_bypass.patch b/certora/mutations/025_extendLock_pause_bypass.patch
new file mode 100644
index 0000000..7353396
--- /dev/null
+++ b/certora/mutations/025_extendLock_pause_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..f8fcddf 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -125,7 +125,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+   /// the existing expiry, but no later than the maximum timestamp that was
+   /// provided when locking the fund.
+   /// Only allowed when the lock has not unlocked yet.
+-  function extendLock(FundId fundId, Timestamp expiry) public whenNotPaused {
++  function extendLock(FundId fundId, Timestamp expiry) public {
+     Controller controller = Controller.wrap(msg.sender);
+     _extendLock(controller, fundId, expiry);
+   }
diff --git a/certora/mutations/026_designate_pause_bypass.patch b/certora/mutations/026_designate_pause_bypass.patch
new file mode 100644
index 0000000..1bca334
--- /dev/null
+++ b/certora/mutations/026_designate_pause_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..15af8af 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -151,7 +151,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+     FundId fundId,
+     AccountId accountId,
+     uint128 amount
+-  ) public whenNotPaused {
++  ) public {
+     Controller controller = Controller.wrap(msg.sender);
+     _designate(controller, fundId, accountId, amount);
+   }
diff --git a/certora/mutations/027_burnDesignated_pause_bypass.patch b/certora/mutations/027_burnDesignated_pause_bypass.patch
new file mode 100644
index 0000000..3c4c696
--- /dev/null
+++ b/certora/mutations/027_burnDesignated_pause_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..c9b39f2 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -191,7 +191,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+     FundId fundId,
+     AccountId accountId,
+     uint128 amount
+-  ) public whenNotPaused {
++  ) public {
+     Controller controller = Controller.wrap(msg.sender);
+     _burnDesignated(controller, fundId, accountId, amount);
+   }
diff --git a/certora/mutations/028_burnAccount_pause_bypass.patch b/certora/mutations/028_burnAccount_pause_bypass.patch
new file mode 100644
index 0000000..383484e
--- /dev/null
+++ b/certora/mutations/028_burnAccount_pause_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..de9c8d2 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -202,7 +202,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+   function burnAccount(
+     FundId fundId,
+     AccountId accountId
+-  ) public whenNotPaused {
++  ) public {
+     Controller controller = Controller.wrap(msg.sender);
+     _burnAccount(controller, fundId, accountId);
+   }
diff --git a/certora/mutations/029_freezeFund_pause_bypass.patch b/certora/mutations/029_freezeFund_pause_bypass.patch
new file mode 100644
index 0000000..99d1815
--- /dev/null
+++ b/certora/mutations/029_freezeFund_pause_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..4037209 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -210,7 +210,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+   /// Freezes a fund. Stops all tokens flows and disallows any operations on the
+   /// fund until it unlocks.
+   /// Only allowed when the fund is locked.
+-  function freezeFund(FundId fundId) public whenNotPaused {
++  function freezeFund(FundId fundId) public {
+     Controller controller = Controller.wrap(msg.sender);
+     _freezeFund(controller, fundId);
+   }
diff --git a/certora/mutations/030_add_missing_whenNotPaused_withdrawByRecipient.patch b/certora/mutations/030_add_missing_whenNotPaused_withdrawByRecipient.patch
new file mode 100644
index 0000000..73b3ba9
--- /dev/null
+++ b/certora/mutations/030_add_missing_whenNotPaused_withdrawByRecipient.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..0d76718 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -234,7 +234,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+     Controller controller,
+     FundId fund,
+     AccountId accountId
+-  ) public {
++  ) public whenNotPaused {
+     (address holder, ) = Accounts.decodeId(accountId);
+     require(msg.sender == holder, VaultOnlyAccountHolder());
+     _withdraw(controller, fund, accountId);
diff --git a/certora/mutations/031_pause_access_control_bypass.patch b/certora/mutations/031_pause_access_control_bypass.patch
new file mode 100644
index 0000000..bde7261
--- /dev/null
+++ b/certora/mutations/031_pause_access_control_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..c98627e 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -240,7 +240,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+     _withdraw(controller, fund, accountId);
+   }
+ 
+-  function pause() public onlyOwner {
++  function pause() public {
+     _pause();
+   }
+ 
diff --git a/certora/mutations/032_unpause_access_control_bypass.patch b/certora/mutations/032_unpause_access_control_bypass.patch
new file mode 100644
index 0000000..9f9fed8
--- /dev/null
+++ b/certora/mutations/032_unpause_access_control_bypass.patch
@@ -0,0 +1,13 @@
+diff --git a/contracts/Vault.sol b/contracts/Vault.sol
+index 8433a08..6b80271 100644
+--- a/contracts/Vault.sol
++++ b/contracts/Vault.sol
+@@ -244,7 +244,7 @@ contract Vault is VaultBase, Pausable, Ownable {
+     _pause();
+   }
+ 
+-  function unpause() public onlyOwner {
++  function unpause() public {
+     _unpause();
+   }
+