# SpiritFactory won't be able to stop the Airstream contract Medium · 0xSimao · AI revenue sharing · 28th November 2025 Finding M-1 of the Spirit Protocol security review. - Report: /reports/spirit-protocol - Source: https://github.com/0xSimao/audits/blob/main/0xSimao/2025-11-28-spirit-protocol.pdf --- **Description:** The Airstream [controller](https://github.com/BlossomLabs/Airstreams/blob/master/contracts/airstream/contracts/AirstreamFactory.sol#L81) is owned by the `SpiritFactory`, but the latter has no function to call the AirstreamController. Since the `SpiritFactory` is upgradeable, this can be mitigated. The [AirstreamController](https://github.com/BlossomLabs/Airstreams/blob/master/contracts/airstream/contracts/AirstreamController.sol#L15) has 3 important functions that may be called, `resumeAirstream()`, `pauseAirstream()` and `withdraw()` (redirectRewards()` is optional). The most important one is `pauseAirstream()`, since it stops the flow, preventing the controller from being liquidated and losing some of the funds. **Impact:** Airstream partially liquidated. **Recommended Mitigation:** Add the necessary functions to the `SpiritFactory`, `pauseAirstream()` being the most important. **0xSimao:** Fixed in PR [#7](https://github.com/0xPilou/spirit-contracts/pull/7).