Guardian's review of USAT Reconfiguration for USDT0, published August 2026. The report records 1 finding, including 1 low.
- Published
- Review window
- July 22 to August 31, 2026
- Language
- Solidity
- Chains
- Ethereum
- Sector
- Stablecoins, Cross-chain
- 0 Critical
- 0 High
- 0 Medium
- 1 Low
- 0 Informational
Scope
Findings 1
-
L-01 Low DVN verifiers ignore the three-DVN configuration Warning Pending
Description
resolveDVNAddressesignores itsdvnNamesOrAddressesargument and always returns the hardcoded LayerZero Labs and USDT0 addresses. It also has no Anchorage entry. Consequently, the Celo verifier derives an expected required-DVN count of two even thoughlayerzero-usat.config.tsnow requires LayerZero Labs, USDT0 and Anchorage. The same defect exists inscripts/usat-oAdapterUpgradeable-deployment-config-check.ts:254-266for Ethereum. This can hide a failed or omitted configuration transaction. For example, the current Celo deployment still has only the original two required DVNs in its send and receive ULN configurations. The verifier nevertheless reportsRequired DVNs: 2 (expected: 2), says that the ULN configuration matches the LayerZero config and exits successfully. An operator relying on this result could conclude that Anchorage is required when the intended third-DVN policy is not active.Recommendation
Resolve every entry supplied in
dvnNamesOrAddressesinstead of replacing the argument with a fixed list. Add Anchorage to each chain mapping, reject unknown names and compare the exact resolved set and count against the live ULN configuration.
No findings match.
More from USDT0
All 34 reportsPut your code through the same review.
This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.
