Skip to content
$1,000,000 in security audit grants are live now, Apply here →

Security review · August 2026

USAT Reconfiguration

for USDT0

Guardian's review of USAT Reconfiguration for USDT0, published August 2026. The report records 1 finding, including 1 low.

Published
Review window
July 22 to August 31, 2026
Language
Solidity
Chains
Ethereum
Sector
Stablecoins, Cross-chain
  • 0 Critical
  • 0 High
  • 0 Medium
  • 1 Low
  • 0 Informational

1 pending

Scope

Findings 1

  1. L-01 Low DVN verifiers ignore the three-DVN configuration Warning Pending

    Description

    resolveDVNAddresses ignores its dvnNamesOrAddresses argument and always returns the hardcoded LayerZero Labs and USDT0 addresses. It also has no Anchorage entry. Consequently, the Celo verifier derives an expected required-DVN count of two even though layerzero-usat.config.ts now requires LayerZero Labs, USDT0 and Anchorage. The same defect exists in scripts/usat-oAdapterUpgradeable-deployment-config-check.ts:254-266 for Ethereum. This can hide a failed or omitted configuration transaction. For example, the current Celo deployment still has only the original two required DVNs in its send and receive ULN configurations. The verifier nevertheless reports Required DVNs: 2 (expected: 2), says that the ULN configuration matches the LayerZero config and exits successfully. An operator relying on this result could conclude that Anchorage is required when the intended third-DVN policy is not active.

    Recommendation

    Resolve every entry supplied in dvnNamesOrAddresses instead of replacing the argument with a fixed list. Add Anchorage to each chain mapping, reject unknown names and compare the exact resolved set and count against the live ULN configuration.

More from USDT0

All 34 reports
  1. Stellar Deployment

    2 findings 2 findings: 2 informational
  2. Corn Network Delisting

    1 finding 1 finding: 1 low
  3. Canary Chain Configuration Verification

    4 findings 4 findings: 4 informational
  4. Solana Transaction Verification

    4 findings 4 findings: 1 medium, 3 informational

Put your code through the same review.

This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.

Get a quote