Guardian's review of XAUT0 Deployment for USDT0, published May 2025. The report records 4 findings across 2 review rounds, including 4 informational.
- Published
- Review window
- May 14 to 22, 2025
- Rounds
- Main Review, Remediation Review
- Language
- Solidity
- Chains
- Ethereum, Hyperliquid
- Sector
- Stablecoins, Cross-chain
- 0 Critical
- 0 High
- 0 Medium
- 0 Low
- 4 Informational
Scope
Findings 4
Main Review
3 findings · May 14 to 15, 2025-
I-01 Informational OApp Owner and Delegate Address Set to an EOA Instead of a Multisig Configuration Resolved
Description
The current
owneranddelegateaddress for all the OApps deployed across the different chains is set to the externally owned address0x565786AbE5BA0f9D307AdfA681379F0788bEdEf7. This configuration introduces a single point of control and potential security risks across all blockchains where it is deployed. EOA-controlled addresses can be more vulnerable to key compromise or misuse by a single actor.Recommendation
Migrate the address to a multisignature wallet to distribute control and reduce the risk of unauthorized transactions. This ensures that multiple parties approve critical operations, thereby enhancing the overall protocol security.
Resolution
Guardian: The current
delegateaddress for all the OApps deployed across the different chains is still set to the externally owned address0x565786AbE5BA0f9D307AdfA681379F0788bEdEf7. This configuration introduces a single point of control and potential security risks across all blockchains where it is deployed. EOA-controlled addresses can be more vulnerable to key compromise or misuse by a single actor.Recommendation Migrate the address to a multisignature wallet to distribute control and reduce the risk of unauthorized transactions. This ensures that multiple parties approve critical operations, thereby enhancing the overall protocol security.
-
I-02 Informational Inaccurate Block Confirmations for HyperEVM Messages Configuration Resolved
Description
The current LayerZero configuration sets block confirmations to 60 for any HyperEVM communication, which does not align with the actual block time requirements and risks finality issues. The desired interval for messages with this chain is half a day, equivalent to a setting of 43200 blocks.
Recommendation
Update the block confirmation value for messages sent from and to HyperEVM to 43200 to reflect half a day’s worth of blocks. This adjustment ensures adequate certainty for finalizing messages.
-
I-03 Informational Missing setTrusted Call In HyperliquidExtension Configuration Acknowledged
Description
The current
HyperliquidExtensiondeployed: https://purrsec.com/address/0xf4d9235269a96aadafc9adae454a0618ebe37949/contract is missing asetTrustedcall to theHyperLiquidComposercontract.Recommendation
Similarly as was performed during the USDT deployment in the following transaction: https://purrsec.com/tx/0xc3ffd03eb3295f81efefa17309e1c01601a33e365187ac6729d529ebf19659bd consider calling
setTrusted(<HyperLiquidComposer address>)in the XAUt0HyperliquidExtension.
Remediation Review
1 finding · May 22, 2025-
I-01 Informational Bytecode Does Not Match Configuration Resolved
Description
The deployed OUpgradable contracts do not match the bytecode of the local deployments. (Figure. See the PDF report.)
Recommendation
Diagnose the reason for bytecode differences.
No findings match.
More from USDT0
All 34 reportsPut your code through the same review.
This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.