ADR-012: Forced transfers bypass pause and eligibility but still run hooks

Context

A court order, a pledge enforcement or a sanctions freeze must be executable at the worst moment: during an incident when the token is paused, against an account that is itself sanctioned, on units that are frozen. At the same time some rules legitimately govern enforcement, for example requiring a reference to the court order in the transfer data.

Issue

Should enforcement actions be subject to the same rules as ordinary transfers?

Assumptions

• A lawful order must be executable during an incident and against ineligible accounts.
• Some rules exist precisely to govern enforcement.

Constraints

• Enforcement must stay auditable (events, hooks).

Alternatives considered

Decision

forcedTransfer (ENFORCER_ROLE) skips pause, canSend/canReceive and the frozen-balance check, lowers the frozen amount so that it never exceeds the remaining balance, and runs every hook with OP_FORCED_TRANSFER. Every reference hook returns OK for that op.

Argument

Bypassing the checks that would block a seizure, while keeping the hook pipeline, preserves both enforceability and the possibility of rules about enforcement itself.

Consequences

Positive

• Seizures, pledges and recalls are executable during incidents.
• Observers (traceability) record enforcement like any other operation.

Negative

• ENFORCER_ROLE can move any holder's units; it is a powerful key.

Obligations it creates

• Hook authors return OK for OP_FORCED_TRANSFER unless the rule governs enforcement.
• ENFORCER_ROLE sits behind a multisig with a documented procedure.

Implementation and evidence

Related decisions

• ADR-003: Adopt ERC-7943 (multi-token variant) verbatim for enforcement
• ADR-004: One hook interface, flags cached at registration, ordered evaluation
• ADR-010: Authority comes from roles, never from balances; RETIRED is terminal