Flag reference

Flag bit assignments are defined once, in SentinelFlags.sol, and vendored byte-identically by integrators. Bits 0–7 are per-token; bits 8–15 are global and apply to every token via statusOf. Assignments are append-only: a bit, once assigned, is never reused.

A status word of 0 means fully operational.

Per-token flags (bits 0–7)

Bit	Hex	Flag	Class	Source signal	Cleared by
0	0x01	TOKEN_PAUSED	level	paused() / tokenPaused() on the Stock token; Paused() / Unpaused() events	watcher, when the pause lifts
1	0x02	ORACLE_PAUSED	level	oraclePaused() — issuer pauses pricing during corporate-action processing. Advisory per official docs: the feed may still return values, so staleness checks stay primary	watcher, when unpause is observed
2	0x04	FEED_STALE	level	Chainlink latestRoundData().updatedAt older than the session-aware threshold (26h default in session — push feeds update on deviation or ~24h heartbeat; grows across weekends)	watcher, on the next fresh update
3	0x08	MULTIPLIER_PENDING	level	newUIMultiplier() scheduled with a future effectiveAt() — a split or dividend reinvestment is queued	watcher, once effective or cancelled
4	0x10	ADMIN_ACTION	latching	any burn Transfer whose outer tx is contract-mediated (multisig, relayer, multicall) or carries the adminBurn(address,uint256) selector; UIMultiplierUpdated events; pause blips between polls; unfetchable burn txs flag anyway — fail toward review	operator CLI, after review
5	0x20	NOT_MONITORED	synthesized	token absent from the owner-managed monitored set (setMonitored). The registry synthesizes this bit in statusOf; updaters cannot write it, and no recommended tolerated mask includes it — unknown tokens fail closed	owner, by registering the token via setMonitored(address[], true)

Global flags (bits 8–15)

Bit	Hex	Flag	Class	Source signal	Cleared by
8	0x0100	REGISTRY_PAUSED	level	paused() on the AccessControlsRegistry — halts all stock-token transfers at once	watcher, when the pause lifts
9	0x0200	IMPLEMENTATION_UPGRADED	latching	Upgraded event on the shared beacon, or implementation() differing from the known-good address (belt and suspenders) — every stock token's code just changed	operator CLI, after the new code is reviewed
10	0x0400	BLOCKLIST_EVENT	latching	Blocked / Unblocked events on the registry blocklist	operator CLI, after exposure review
11	0x0800	ROLE_CHANGED	latching	RoleGranted / RoleRevoked / RoleAdminChanged on the registry	operator CLI, after review
12	0x1000	MARKET_CLOSED	level	24/5 session calendar: weekends and full-day US market holidays (ET)	watcher, at the next session open
13	0x2000	SEQUENCER_DOWN	level	Robinhood Chain block production lagging wall clock by > 120s	watcher, when production resumes

Masks

Constant	Value	Meaning
ALL_TOKEN_FLAGS	0x3F	every defined per-token bit, including the synthesized NOT_MONITORED
WRITABLE_TOKEN_FLAGS	0x1F	per-token bits an updater may write — excludes NOT_MONITORED
ALL_GLOBAL_FLAGS	0x3F00	every defined global bit

The registry rejects writes that set undefined bits — or the registry-synthesized NOT_MONITORED bit — on both raise and clear paths: a watcher bug that confuses token and global words, or tries to fake coverage, reverts instead of silently no-oping.

Choosing a tolerated mask

Tolerating a flag means "my risk model already prices this condition":

• MARKET_CLOSED — tolerate it if your parameters (e.g. a lending market's LLTV) already account for weekend/holiday gap risk; that's the entire point of sizing LLTVs from gap statistics. Pair it with a staleness allowance that stretches across the closure.
• MULTIPLIER_PENDING — tolerable when your price source already reflects scheduled multipliers; the official Chainlink feeds do (the feed price includes the multiplier).
• Everything else says the issuer or the data layer is doing something unusual right now — tolerate at your peril.

See Integrating for how the mask is enforced.