Skip to content
$1,000,000 in security audit grants are live now, Apply here →
Get a quote

Security review · December 2025

XAUT0 Wiring

for USDT0

Guardian's review of XAUT0 Wiring for USDT0, published December 2025. The report records 4 findings, including 2 low and 2 informational.

Get a quote Read the full report
Published
Review window
December 1 to 3, 2025
Chains
Ethereum, Arbitrum, Ink, Hyperliquid, Polygon, Monad, Solana, Stellar
Sector
Stablecoins
  • 0 Critical
  • 0 High
  • 0 Medium
  • 2 Low
  • 2 Informational

4 acknowledged

Findings 4

  1. L-01 Low Ink Has Duplicate and Failing Transactions Warning Acknowledged

    Description

    Ink has 6 duplicate transactions as shown in the below table. Consequently, some of these transactions will revert with error LZ_SameValue().

    Function First Duplicate
    setPeer 127 133
    setSendLibrary 128 134
    setReceiveLibrary 129 135
    setConfig 130 136
    setConfig 131 137
    setEnforcedOptions 132 138

    Recommendation

    Remove the duplicate transactions.

    Link to L-01
  2. L-02 Low Solana Not Configured To Monad And Stable Warning Acknowledged

    Description

    Solana to Monad/Stable is not configured (contrary to Monad/Stable to Solana connection which is configured), hence transfers between Solana <> Monad/Stable will not function. This is different from

    === Per-path Peer & ULN ===

--- dstEid 30390 ---
PeerConfig: NOT FOUND
📡 Getting ULN configs via SDK...

🔗 Monad (EID: 30390) Block Confirmations:
  📥 Receive: 0
  📤 Send   : 0

📥 Receive ULN Config Details:
  Confirmations: N/A
  Required DVNs: 0
  Required DVNs:
  Optional DVNs: 0
  Optional DVN Threshold: 0
  Receive Library: 7a4WjyR8VZ7yZz5XJAKm39BUGn5iT9CKcv2pmG9tdXVH

📤 Send ULN Config Details:
  Confirmations: N/A
  Required DVNs: 0
  Required DVNs:
  Optional DVNs: 0
  Optional DVN Threshold: 0
  Send Library: 7a4WjyR8VZ7yZz5XJAKm39BUGn5iT9CKcv2pmG9tdXVH

--- dstEid 30396 ---
PeerConfig: NOT FOUND
📡 Getting ULN configs via SDK...

🔗 Stable-Mainnet (EID: 30396) Block Confirmations:
  📥 Receive: 0
  📤 Send   : 0

📥 Receive ULN Config Details:
  Confirmations: N/A
  Required DVNs: 0
  Required DVNs:
  Optional DVNs: 0
  Optional DVN Threshold: 0
  Receive Library: 7a4WjyR8VZ7yZz5XJAKm39BUGn5iT9CKcv2pmG9tdXVH

📤 Send ULN Config Details:
  Confirmations: N/A
  Required DVNs: 0
  Required DVNs:
  Optional DVNs: 0
  Optional DVN Threshold: 0
  Send Library: 7a4WjyR8VZ7yZz5XJAKm39BUGn5iT9CKcv2pmG9tdXVH

    Recommendation

    Ensure this is currently intended. Configure Solana with Monad/Stable in the future.

    Link to L-02
  3. I-01 Informational Conflux <> ETH Enforced Option Gas Changes Warning Acknowledged

    Description

    The enforced option gas values for the Conflux<>ETH connection has been updated to use 150,000 gas for lzReceive and composed. However, the oft-contracts repo still displays old values:

    const ETHEREUM_BLOCKS = 15
const CONFLUX_BLOCKS = 2800

const EVM_ENFORCED_OPTIONS: OAppEnforcedOption[] = [
    {
        msgType: 1,
        optionType: ExecutorOptionType.LZ_RECEIVE,
        gas: 80000,
        value: 0,
    },
    {
        msgType: 2,
        optionType: ExecutorOptionType.LZ_RECEIVE,
        gas: 100000,
        value: 0,
    },
    {
        msgType: 2,
        optionType: ExecutorOptionType.COMPOSE,
        index: 0,
        gas: 100000,
        value: 0,
    },
]

    Recommendation

    Ensure 150,000 is the intended gas value and consider documenting this in the oft-contract repo.

    Link to I-01
  4. I-02 Informational Chains Still Have Pending USDT0 TX’s Warning Acknowledged

    Description

    Certain chains such as Optimism and XLayer have pending transactions for Conflux/Monad enforced option setup which is not part of this latest XAU wiring and CNHT0 option review request.

    Recommendation

    Ensure these transactions are still appropriately handled.

    Link to I-02

More from USDT0

All 20 reports

  1. Stellar Deployment

     2 findings 2 findings: 2 informational

  2. Corn Network Delisting

     1 finding 1 finding: 1 low

  3. Canary Chain Configuration Verification

     4 findings 4 findings: 4 informational

  4. Solana Transaction Verification

     4 findings 4 findings: 1 medium, 3 informational

Put your code through the same review.

This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.

Get a quote