Every chain USDT0 reached, we checked before it got there.

OAdapterUpgradeable · OUpgradeable · TetherTokenOFTExtension

The first engagement was the architecture itself: the upgradeable adapter and token extension every later USDT0, XAUT0, USAT and CNHT0 deployment would inherit. It caught missing storage gaps and upgrade-safety violations before the pattern was copied chain by chain.

USDT0’s documentation still links this report as the Guardian audit.

Migration logic · upgrade triggers · pause/resume · production rehearsal · 5 auditors

Arbitrum’s entire USDT supply moved to the USDT0 architecture in this migration. Guardian verified the migration logic and pause flows and ran a full production rehearsal with the real deployment parameters. The rehearsal found what reading the contracts would not have.

Multi-leg transfer orchestration · gas refund paths

The multihop contract chains transfers across several legs in one call. Guardian found it could trap funds outright, not because of the orchestration, but because of USDT itself.

Bridging layer between HyperEVM and HyperLiquid L1

Moving USDT0 between HyperEVM and HyperLiquid’s L1 crosses a boundary with its own execution semantics. Guardian threat-modelled the composer against HyperLiquid’s system calls, where the failure modes are not those of a normal bridge.

Cross-chain multisig · replay, reentrancy, MEV, nonces

OneSig is Tether’s cross-chain multisig, the contract with authority over the deployments.

DVN configuration · permit path · fallback logic · IERC7802

Guardian found that a change to the permit domain separator would silently invalidate signatures users had already issued, a break that only surfaces when a signed approval stops working. The review also covered USDT0’s adoption of IERC7802, the Superchain interop standard.

It recorded that no DVNs were yet deployed for USDT on Optimism or Unichain: a correct contract with missing configuration, which is the thesis of this whole engagement.

USDT→USDT0 migration on Polygon · two independent Guardian teams

The Polygon migration itself, reviewed by two independent teams whose findings were merged into a single set.

Core Tether logic on HyperEVM · XAUT0 (Tether Gold) omnichain deployment

The HyperEVM deployment, and the first extension of the architecture to a second asset: XAUT0, the omnichain Tether Gold. Guardian is the only firm listed for XAUt0 deployment reports in the client’s own XAUT0 audit index, and both reports are public.

Polygon deployment · peer verification · migration transactions

The clearest case for deployment verification as its own discipline: the contracts were fine, the playbook was not. The queued migration sent USDT from Polygon’s ERC20Predicate to a multisig instead of the OAdapter that backs circulating USDT0.

XAUT0 SOL deployment and peer verification · USDT0 Solana transaction verification

Taking XAUT0 to Solana meant leaving the EVM: program authorities instead of contract ownership, but the same risk that a misconfigured peer leaves an unbacked supply. Guardian verified the deployment and its peers, then USDT0’s Solana transactions. The deployment report is public.

Flare · Sei · Rootstock · XLayer · Plasma · Celo · Hedera · Mantle · Monad · MegaETH · Tempo · and more

Most of the relationship is volume work: deployment reviews, peer verifications, wiring checks and config changes, each a chance to connect a correct contract to the wrong counterparty. Guardian verified network exits too, such as the Corn delisting, and reviewed what Ethereum’s Glamsterdam gas repricing meant for USDT0.

Most of it is public: over a dozen chains have a Guardian deployment report in the client’s repository.

50,784 lines of Java across 588 files · HTSConnectorUpgradeable.sol

Hedera has no ERC-20s; its token service lives in the consensus node itself, so trusting a USDT0 connector meant reviewing the node. Two teams read 50,784 lines of Java across the token, smart-contract and utility services over six weeks, the largest scope in the account.

Penetration test of the USDT0 web properties · LayerZero Gasolina signer/relayer review · API pentest

In December the scope left Solidity entirely: a penetration test of the USDT0 web properties, and a review of Gasolina, the off-chain signer and relayer service, including its API. A stablecoin with sound contracts and a compromised relayer is not a secure stablecoin.

Ethereum mainnet + Sepolia · bytecode verification · 62-test fork suite

USAT, Tether’s US-regulated stablecoin, is the template for deployment verification: proxy, implementation and admin bytecode matched byte-exact on both networks, ownership confirmed, and a 62-test fork suite over blocklist, permit, mint and redeem paths, all passing. Its reconfiguration and Avalanche rollout came back to Guardian in 2026.

A review of the full client stack, web, desktop and API, for authentication, key handling and business-logic enforcement, modelled on real abuse cases like a compromised client or a malicious wallet. Eight rounds between January and August 2026.

Rust/Soroban OFT contracts · SAC manager · dual independent teams

USDT0 on Stellar meant Rust on Soroban, a third virtual machine. Two independent teams reviewed the OFT contracts and SAC manager in parallel, and the deployment review verified the WASM hashes on chain.