Hedera Deployment

The DefaultProxyAdmin owner is a Safe-like wallet configured with five owners but a signing threshold of one. Because ProxyAdmin controls upgrades for the transparent proxy, a single compromised Safe owner key can authorize an implementation upgrade and fully change runtime behavior. The intended blast-radius reduction of multi-owner governance is not being realized under a one-signature threshold. This setup lowers the protocol resistance to an admin key compromise and increases upgrade takeover risk. #Recommendation Raise the Safe threshold to a multi-signature quorum aligned with production risk, such 3-of-5, and require a documented emergency upgrade process.

The deployed HTSConnectorUpgradeable instance sets both owner() and the LayerZero endpoint delegate to the same externally owned account. This account can execute privileged owner flows such as mintTokenPublic, and can also control LayerZero configuration paths via setPeer, setEnforcedOptions, setDelegate, setMsgInspector, and setPreCrime. Concentrating these powers into one hot operational identity creates a single point of catastrophic failure where one key compromise can affect token mint authority and cross-chain routing controls at the same time. If this key is compromised, an attacker can alter messaging configuration and execute privileged token actions without needing additional approvals.

Split privileges and move both roles to hardened governance. Set the owner and the endpoint delegate to the Safe wallet.

The LayerZero connection entry for the Monad and Hedera pair applies MONAD_ENFORCED_OPTIONS on the Monad to Hedera direction and EVM_ENFORCED_OPTIONS on the Hedera to Monad direction. For asymmetric chains, enforced options are expected to match the destination chain requirements, and this directionality appears inverted relative to the rest of the configuration style. If left unchanged, one direction can receive an incorrect gas/options profile and produce avoidable delivery failures or retries during cross-chain messaging.

Swap the enforced-options tuple so the Monad to Hedera direction uses EVM_ENFORCED_OPTIONS and the Hedera to Monad direction uses MONAD_ENFORCED_OPTIONS. Add a configuration regression test that asserts destination-specific option selection for asymmetric chain pairs to prevent this class of directional inversion.

Hedera is included in the production LayerZero contract set and is treated as a first class endpoint for ownership and delegate configuration, but the Hardhat network record for Hedera does not carry a safeConfig object. In parallel, the test suite computes networksWithSafeConfig by filtering only networks that have safeConfig, then asserts that every endpoint id returned by the production LayerZero config is present in that filtered set. This means the policy encoded by the test and the policy encoded by the network metadata are not aligned for Hedera.

const hederaContract: OmniPointHardhat = {
    eid: EndpointId.HEDERA_V2_MAINNET,
    contractName: 'HTSConnectorUpgradeable',
}

{
    contract: hederaContract,
    config: {
        delegate: '0x2BA553f06b26EfE2A3EdDC4f3E20C7Db9B09797f',
        owner: '0x2BA553f06b26EfE2A3EdDC4f3E20C7Db9B09797f'
    },
}
---
const hederaContract: OmniPointHardhat = {
    eid: EndpointId.HEDERA_V2_MAINNET,
    contractName: 'HTSConnectorUpgradeable',
}
{
    contract: hederaContract,
    config: {
        delegate: '0x2BA553f06b26EfE2A3EdDC4f3E20C7Db9B09797f',
        owner: '0x2BA553f06b26EfE2A3EdDC4f3E20C7Db9B09797f'
    },
}
---
'hedera-mainnet': {
    eid: EndpointId.HEDERA_V2_MAINNET,
    url: 'https://tame-ultra-wind.hedera-mainnet.quiknode.pro/...',
    accounts,
    verify: {
        etherscan: {
            apiKey: '',
            apiUrl: '',
        }
    },
},
---
const networksWithSafeConfig = Object.entries(hardhatConfig.networks || {})
    .filter(([_, config]) => (config as any).safeConfig)
    .map(([name, config]) => ({ name, eid: (config as any).eid }))

const layerzeroEids = contracts.map((item: any) => item.contract.eid)
layerzeroEids.forEach((eid: number) => {
    expect(safeConfigEids).to.include(eid)
})

Because of this, the current test overstates an invariant that is not actually true. The practical impact is a noisy CI behavior and reduced trust in deployment guardrails, because engineers may disable or ignore a test that should otherwise be authoritative.

Align policy in one place and enforce it consistently, then encode that policy directly in test logic. One valid fix path is to simply add a safeConfig for Hedera.