Guardian's review of Glamsterdam Gas Price Review for USDT0, published March 2026. The report records 1 finding, including 1 low.
- Published
- Review window
- March 23 to 24, 2026
- Language
- Solidity
- Chains
- Ethereum
- Sector
- Stablecoins, Cross-chain
- 0 Critical
- 0 High
- 0 Medium
- 1 Low
- 0 Informational
Findings 1
-
L-01 Low Composer unwraps can leave USDT0 parked Informational Pending
Description
StableComposer only stores failedMessages when payload decoding fails inside lzCompose() After decoding succeeds, it calls wrapper.withdrawTo(_receiver, _amountLD) and that unwrap path performs token.transferFrom followed by bank.mint() Because the try/catch only covers decodeMessage(), an out of gas error in withdrawTo() does not populate failedMessages, so refundToSrc() is not available In that case, the OFT transfer has already credited the composer, and the USDT0 remains on the composer until the compose is retried successfully The recovery becomes operational through compose retry rather than contractual through refundToSrc(), the effect is temporary parking of funds on the composer
Recommendation
Monitor LayerZero compose retry procedures after the hardfork, and if needed due to out of gas, Increase enforced compose gas for routes that target StableComposer
No findings match.
More from USDT0
All 34 reportsPut your code through the same review.
This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.