[DO NOT MERGE] audit q3 2025

.changeset/angry-pandas-swim.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": patch
+---
+
+Fix CCTP v2 transferRemote amount

.changeset/big-papayas-grow.md

@@ -0,0 +1,15 @@
+---
+"@hyperlane-xyz/core": major
+---
+
+Refactor warp route contracts for shallower inheritance tree and smaller bytecode size.
+
+Deprecated `Router` and `GasRouter` internal functions have been removed.
+
+`FungibleTokenRouter` has been removed and functionality lifted into `TokenRouter`.
+
+`quoteTransferRemote` and `transferRemote` can no longer be overriden with optional `hook` and `hookMetadata` for simplicity.
+
+`quoteTransferRemote` returns a consistent shape of `[nativeMailboxDispatchFee, internalTokenFee, externalTokenFee]`.
+
+`HypNative` and `HypERC20Collateral` inherit from `MovableCollateral` and `LpCollateral` but other extensions (eg `HypXERC20`) do not. Storage layouts have been preserved to ensure upgrade compatibility.

.changeset/brown-scissors-crash.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": patch
+---
+
+Rebalancer covers all fees associated with rebalancing

.changeset/clever-carpets-double.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": patch
+---
+
+Remove ValueTransferBridge and use ITokenBridge. ValueTransferBridge is a deprecated name for the interface.

.changeset/gold-islands-agree.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": minor
+---
+
+Add Everclear bridges for ETH and ERC20 tokens.

.changeset/light-years-reply.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": minor
+---
+
+Implement support for CCTP v2 fast transfers

.changeset/many-stingrays-invite.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": patch
+---
+
+Remove majority of virtual override functions

.changeset/mean-pigs-check.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/helloworld": patch
+---
+
+Update HelloWorld to use new Router utils

.changeset/nice-crabs-vanish.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": minor
+---
+
+Extend CCTP TokenBridge with GMP support via hook

.changeset/odd-carrots-whisper.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": patch
+---
+
+Fix TokenBridgeCCTP.verify burn message sender enforcement

.changeset/red-moose-change.md

@@ -0,0 +1,10 @@
+---
+"@hyperlane-xyz/core": minor
+"@hyperlane-xyz/sdk": patch
+---
+
+Implement token fees on FungibleTokenRouter
+
+Removes `metadata` from return type of internal `TokenRouter._transferFromSender` hook
+
+To append `metadata` to `TokenMessage`, override the `TokenRouter._beforeDispatch` hook

.changeset/rude-apricots-try.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": minor
+---
+
+feat: emit event on protocol fee payment

.changeset/sharp-clouds-pay.md

@@ -0,0 +1,6 @@
+---
+"@hyperlane-xyz/sdk": minor
+"@hyperlane-xyz/cli": patch
+---
+
+Decouple movable collateral and hyp collateral token adapters

.changeset/short-yaks-laugh.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": minor
+---
+
+Adds fees to FungibleTokenRouter

.changeset/stale-baboons-hope.md

@@ -0,0 +1,9 @@
+---
+'@hyperlane-xyz/core': major
+---
+
+Add LP interface to collateral routers
+
+The `balanceOf` function has been removed from `TokenRouter` to remove ambiguity between `LpCollateralRouter.balanceOf`.
+
+To migrate, use the new `TokenRouter.token()` to get an `IERC20` or `IERC721` compliant address that you can call `balanceOf` on.

.changeset/sweet-tips-bake.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": patch
+---
+
+Update Yield Routes (HypERC4626OwnerCollateral and HypERC4626Collateral) to use safeApprove

.changeset/wise-steaks-think.md

@@ -0,0 +1,5 @@
+---
+"@hyperlane-xyz/core": patch
+---
+
+Remove absolute imports. Fixes compilation for users who import from files under `solidity/contracts`.

.github/workflows/storage-analysis.yml

@@ -2,7 +2,8 @@ name: Check Storage Layout Changes
 
 on:
   pull_request:
-    branches: [main]
+    branches:
+      - '*'
     paths:
       - 'solidity/**'
   workflow_dispatch:
@@ -53,13 +54,30 @@ jobs:
         env:
           BASE_REF: ${{ github.event.inputs.base || github.event.pull_request.base.sha }}
         run: |
+          # Fetch the base reference
           git fetch origin $BASE_REF
-          git checkout $BASE_REF -- solidity/contracts
+          # Check if BASE_REF is a commit SHA (40 hex characters) or a branch name
+          if [[ "$BASE_REF" =~ ^[0-9a-f]{40}$ ]]; then
+            # For commit SHAs, checkout directly without origin/ prefix
+            git checkout $BASE_REF -- solidity/contracts
+          else
+            # For branch names, use origin/ prefix
+            git checkout origin/$BASE_REF -- solidity/contracts
+          fi
 
       # Run the command on the target branch
       - name: Run command on target branch
         run: yarn workspace @hyperlane-xyz/core storage base-storage
 
       # Compare outputs
-      - name: Compare outputs
-        run: diff --unified solidity/base-storage solidity/HEAD-storage
+      - name: Compare outputs (fail on removals only)
+        run: |
+          DIFF_OUTPUT=$(diff --unified solidity/base-storage solidity/HEAD-storage || true)
+          echo "$DIFF_OUTPUT"
+          # Fail only if there are removal lines in diff hunks (lines starting with '-' but not '---')
+          if echo "$DIFF_OUTPUT" | grep -E '^-([^-])' >/dev/null; then
+            echo "Detected storage removals in diff. Failing job."
+            exit 1
+          else
+            echo "No storage removals detected."
+          fi

package.json

@@ -40,6 +40,7 @@
     "postinstall": "husky install"
   },
   "workspaces": [
+    "solhint-plugin",
     "solidity",
     "typescript/*",
     "starknet"

solhint-plugin/index.js

@@ -0,0 +1,48 @@
+// https://protofire.github.io/solhint/docs/writing-plugins.html
+class NoVirtualOverrideAllowed {
+  constructor(reporter, config) {
+    this.ruleId = 'no-virtual-override';
+
+    this.reporter = reporter;
+    this.config = config;
+  }
+
+  FunctionDefinition(ctx) {
+    const isVirtual = ctx.isVirtual;
+    const hasOverride = ctx.override !== null;
+
+    if (isVirtual && hasOverride) {
+      this.reporter.error(
+        ctx,
+        this.ruleId,
+        'Functions cannot be "virtual" and "override" at the same time',
+      );
+    }
+  }
+}
+
+class NoVirtualInitializerAllowed {
+  constructor(reporter, config) {
+    this.ruleId = 'no-virtual-initializer';
+
+    this.reporter = reporter;
+    this.config = config;
+  }
+
+  FunctionDefinition(ctx) {
+    const isVirtual = ctx.isVirtual;
+    const hasInitializer = ctx.modifiers.some(
+      (modifier) => modifier.name === 'initializer',
+    );
+
+    if (isVirtual && hasInitializer) {
+      this.reporter.error(
+        ctx,
+        this.ruleId,
+        'Functions cannot be "virtual" and "initializer" at the same time',
+      );
+    }
+  }
+}
+
+module.exports = [NoVirtualOverrideAllowed, NoVirtualInitializerAllowed];

solhint-plugin/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "solhint-plugin-hyperlane",
+  "private": true,
+  "version": "0.0.0",
+  "description": "",
+  "license": "Apache-2.0",
+  "type": "commonjs",
+  "main": "index.js"
+}

solidity/.gitignore

@@ -15,6 +15,7 @@ docs
 flattened/
 buildArtifact.json
 fixtures/
+broadcast/
 # ZKSync
 artifacts-zk
 cache-zk

solidity/.solhint.json

@@ -12,7 +12,9 @@
     "reason-string": ["warn", { "maxLength": 64 }],
     "prettier/prettier": "error",
     "gas-custom-errors": "off",
-    "named-parameters-mapping": "error"
+    "named-parameters-mapping": "error",
+    "hyperlane/no-virtual-override": "error",
+    "hyperlane/no-virtual-initializer": "error"
   },
-  "plugins": ["prettier"]
+  "plugins": ["prettier", "hyperlane"]
 }

solidity/contracts/AttributeCheckpointFraud.sol

@@ -5,7 +5,7 @@ import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
 import {Address} from "@openzeppelin/contracts/utils/Address.sol";
 import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
 
-import {PackageVersioned} from "contracts/PackageVersioned.sol";
+import {PackageVersioned} from "./PackageVersioned.sol";
 import {TREE_DEPTH} from "./libs/Merkle.sol";
 import {CheckpointLib, Checkpoint} from "./libs/CheckpointLib.sol";
 import {CheckpointFraudProofs} from "./CheckpointFraudProofs.sol";

solidity/contracts/avs/HyperlaneServiceManager.sol

@@ -19,7 +19,7 @@ import {IAVSDirectory} from "../interfaces/avs/vendored/IAVSDirectory.sol";
 import {IRemoteChallenger} from "../interfaces/avs/IRemoteChallenger.sol";
 import {ISlasher} from "../interfaces/avs/vendored/ISlasher.sol";
 import {ECDSAServiceManagerBase} from "./ECDSAServiceManagerBase.sol";
-import {PackageVersioned} from "contracts/PackageVersioned.sol";
+import {PackageVersioned} from "../PackageVersioned.sol";
 
 contract HyperlaneServiceManager is ECDSAServiceManagerBase, PackageVersioned {
     // ============ Libraries ============
@@ -286,9 +286,7 @@ contract HyperlaneServiceManager is ECDSAServiceManagerBase, PackageVersioned {
     }
 
     /// @inheritdoc ECDSAServiceManagerBase
-    function _deregisterOperatorFromAVS(
-        address operator
-    ) internal virtual override {
+    function _deregisterOperatorFromAVS(address operator) internal override {
         address[] memory challengers = getOperatorChallengers(operator);
         _completeUnenrollment(operator, challengers);
 

solidity/contracts/client/GasRouter.sol

@@ -59,7 +59,13 @@ abstract contract GasRouter is Router {
     function quoteGasPayment(
         uint32 _destinationDomain
     ) public view virtual returns (uint256) {
-        return _GasRouter_quoteDispatch(_destinationDomain, "", address(hook));
+        return
+            _Router_quoteDispatch(
+                _destinationDomain,
+                "",
+                _GasRouter_hookMetadata(_destinationDomain),
+                address(hook)
+            );
     }
 
     function _GasRouter_hookMetadata(
@@ -73,34 +79,4 @@ abstract contract GasRouter is Router {
         destinationGas[domain] = gas;
         emit GasSet(domain, gas);
     }
-
-    function _GasRouter_dispatch(
-        uint32 _destination,
-        uint256 _value,
-        bytes memory _messageBody,
-        address _hook
-    ) internal returns (bytes32) {
-        return
-            _Router_dispatch(
-                _destination,
-                _value,
-                _messageBody,
-                _GasRouter_hookMetadata(_destination),
-                _hook
-            );
-    }
-
-    function _GasRouter_quoteDispatch(
-        uint32 _destination,
-        bytes memory _messageBody,
-        address _hook
-    ) internal view returns (uint256) {
-        return
-            _Router_quoteDispatch(
-                _destination,
-                _messageBody,
-                _GasRouter_hookMetadata(_destination),
-                _hook
-            );
-    }
 }