From d1c344df830e88cfe1586167307c21eb49d0caf6 Mon Sep 17 00:00:00 2001
From: Sertug17 <104278804+Sertug17@users.noreply.github.com>
Date: Sat, 1 Aug 2026 21:25:18 +0300
Subject: [PATCH 1/2] fix(SuperchainConfig): extend() should check paused() to
 prevent re-activating expired pauses

extend() was checking pauseTimestamps[id] == 0 which only catches the
never-paused case. An expired pause (timestamp != 0, paused() == false)
bypassed this check, allowing the guardian to re-activate it without the
required unpause -> pause cycle (Stage 1 Decentralization requirement).

Fix: use paused() which returns false for both unpaused and expired.

Fixes #391
---
 src/L1/SuperchainConfig.sol | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/L1/SuperchainConfig.sol b/src/L1/SuperchainConfig.sol
index b0f5e476d..e0653d167 100644
--- a/src/L1/SuperchainConfig.sol
+++ b/src/L1/SuperchainConfig.sol
@@ -120,7 +120,7 @@ contract SuperchainConfig is ProxyAdminOwnedBase, ISemver {
         _assertOnlyGuardian();
 
         // Cannot extend the pause if not already paused.
-        if (pauseTimestamps[_identifier] == 0) {
+        if (!paused(_identifier)) {
             revert SuperchainConfig_NotAlreadyPaused(_identifier);
         }
 

From 0b2bcdd0476cc8511444d664d07af3b13e51fd09 Mon Sep 17 00:00:00 2001
From: Sertug17 <104278804+Sertug17@users.noreply.github.com>
Date: Tue, 4 Aug 2026 22:59:49 +0300
Subject: [PATCH 2/2] test(SuperchainConfig): add
 testFuzz_extend_expiredPause_reverts

---
 test/L1/SuperchainConfig.t.sol | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/test/L1/SuperchainConfig.t.sol b/test/L1/SuperchainConfig.t.sol
index 95f5b1bcc..5fd544e07 100644
--- a/test/L1/SuperchainConfig.t.sol
+++ b/test/L1/SuperchainConfig.t.sol
@@ -221,6 +221,19 @@ contract SuperchainConfig_Extend_Test is SuperchainConfig_TestInit {
         );
         superchainConfig.extend(_identifier);
     }
+
+    /// @notice Tests that `extend` reverts when the pause has already expired.
+    /// @param _identifier The identifier to test.
+    function testFuzz_extend_expiredPause_reverts(address _identifier) external {
+        _pauseAsGuardian(_identifier);
+        vm.warp(block.timestamp + PAUSE_EXPIRY + 1);
+        assertFalse(superchainConfig.paused(_identifier));
+        vm.prank(superchainConfig.guardian());
+        vm.expectRevert(
+            abi.encodeWithSelector(ISuperchainConfig.SuperchainConfig_NotAlreadyPaused.selector, _identifier)
+        );
+        superchainConfig.extend(_identifier);
+    }
 }
 
 /// @title SuperchainConfig_Pausable_Test