PolymerCCTP add support for more chains [PolymerCCTPFacet v2.0.0] (#1630)

* Update PolymerCCTPFacet version to 1.0.1 and add support for Monad (chainId 143) and Bsc (chainId 56) in bridging logic.

* update

* added ReentracyGuard

* added audit

* updates

* added new demo cases

* updates

* deleted check for mintRecipient

* updated tests

* Refactor Solana address handling in demo scripts and update wallet address usage. Removed hardcoded addresses and implemented dynamic derivation from private keys. Updated relevant scripts to use a single source of truth for the dev wallet address.

* Update PolymerCCTPFacet version to 2.0.0

* deleted audit

* added staging diamond

* added check

* added audit

Author: mirooon

.cursor/rules/200-typescript.mdc

@@ -40,6 +40,17 @@ globs:
 
 - When referring to "demo script", this means scripts in `script/demoScripts/`. They follow similar structural patterns (e.g., `main()` function, `setupEnvironment()`, helpers from `demoScriptHelpers`). See `demoLidoWrapper.ts`, `demoUnit.ts`, `demoEco.ts` as reference examples.
 
+## Solana addresses and dev wallet address ([CONV:SOLANA-DEV-WALLET])
+
+- **Solana addresses (base58, bytes32)**: Derive dynamically from the signer’s private key. Do **not** hardcode Solana addresses or store them in config (e.g. `config/global.json`).
+  - **Source**: `script/demoScripts/utils/demoScriptHelpers.ts`
+  - **Base58**: `deriveSolanaAddress(privateKey)` — use for logging, Solana APIs, or ATA computation.
+  - **Bytes32**: `solanaAddressToBytes32(deriveSolanaAddress(privateKey))` — use for contract/struct fields that expect bytes32 (e.g. non-EVM receiver, mintRecipient).
+  - **Private key**: `getPrivateKeyForEnvironment(EnvironmentEnum.staging)` (or `EnvironmentEnum.production`) from `demoScriptHelpers`. Example: `demoAcrossV4.ts`, `demoPolymerCCTP.ts`, `demoNEARIntents.ts`.
+- **Dev wallet (EVM)**: Use a single source of truth from config.
+  - Use **only** `DEV_WALLET_ADDRESS` from `script/demoScripts/utils/demoScriptHelpers.ts` (it reads `config/global.json` → `devWallet`). Do not use `globalConfig.devWallet` elsewhere.
+  - Do not add or use separate constants for the same EVM dev wallet (e.g. no `ADDRESS_DEV_WALLET_V5`-style aliases).
+
 ## CLI and Logging
 
 - CLI: use `citty`; logging via `consola`; validate env via `getEnvVar()`; exit 0/1 appropriately.

audit/auditLog.json

@@ -538,6 +538,13 @@
       "auditorGitHandle": "sujithsomraaj",
       "auditReportPath": "./audit/reports/2026.02.05_LiFiIntentEscrowFacet(v1.0.1,v1.1.1).pdf",
       "auditCommitHash": "260f8e8088c88049d4d5de532613b78af188f9a3"
+    },
+    "audit20260216": {
+      "auditCompletedOn": "16.02.2026",
+      "auditedBy": "Sujith Somraaj (individual security researcher)",
+      "auditorGitHandle": "sujithsomraaj",
+      "auditReportPath": "./audit/reports/2026.02.16_PolymerCCTPFacet(v2.0.0).pdf",
+      "auditCommitHash": "7f8a0efe29162fede3f8c647f35044a66459aadb"
     }
   },
   "auditedContracts": {
@@ -817,7 +824,8 @@
       "1.0.0": ["audit20250508"]
     },
     "PolymerCCTPFacet": {
-      "1.0.0": ["audit20251201"]
+      "1.0.0": ["audit20251201"],
+      "2.0.0": ["audit20260216"]
     },
     "Receiver": {
       "2.0.3": ["audit20250109_3"],

audit/reports/2026.02.16_PolymerCCTPFacet(v2.0.0).pdf

@@ -212,6 +212,18 @@
       "0xd35fC069dcBD50780c706750A41AfC418f25f5D6": {
         "Name": "WhitelistRecoveryFacet",
         "Version": "1.0.2"
+      },
+      "0xa8deB34CDD4915D3D5E37e622fB2585bC2c1a7d6": {
+        "Name": "PolymerCCTPFacet",
+        "Version": "2.0.0"
+      },
+      "0xC31f575546A12Bc9dEf107CE19a242cd351BaDe2": {
+        "Name": "AcrossV4SwapFacet",
+        "Version": "1.0.0"
+      },
+      "0xBdE21104479e1373a20F487D3f6ffDED62574FA7": {
+        "Name": "PolymerCCTPFacet",
+        "Version": "2.0.0"
       }
     },
     "Periphery": {

deployments/arbitrum.diamond.staging.json

@@ -62,7 +62,7 @@
   "Patcher": "0x18069208cA7c2D55aa0073E047dD45587B26F6D4",
   "WhitelistManagerFacet": "0x6ab927f0766eE43418F508Fbad5Bd70D610fB281",
   "RelayDepositoryFacet": "0x004E291b9244C811B0BE00cA2C179d54FAA5073D",
-  "PolymerCCTPFacet": "0xc547F046174A880d08A251aF10FA659c339d30Ff",
+  "PolymerCCTPFacet": "0xBdE21104479e1373a20F487D3f6ffDED62574FA7",
   "LiFiIntentEscrowFacet": "0x06A8fA5B326F663507FfF045B90351a9DCF3f9B1",
   "NEARIntentsFacet": "0x2c748Eda11e9717Bd487c8CF6e52862351909Ad0",
   "CelerCircleBridgeV2Facet": "0xfeac1be55bCccc46D88743F9dBCCF60f66562357",

deployments/arbitrum.staging.json

@@ -9,10 +9,9 @@ import {
   AcrossFacetV4__factory,
 } from '../../typechain'
 import type { LibSwap } from '../../typechain/AcrossFacetV4'
+import { EnvironmentEnum } from '../common/types'
 
 import {
-  ADDRESS_DEV_WALLET_SOLANA_BYTES32,
-  ADDRESS_DEV_WALLET_V4,
   ADDRESS_UNISWAP_ARB,
   ADDRESS_UNISWAP_OPT,
   ADDRESS_USDC_ARB,
@@ -23,8 +22,10 @@ import {
   ADDRESS_WETH_ARB,
   ADDRESS_WETH_OPT,
   DEFAULT_DEST_PAYLOAD_ABI,
+  deriveSolanaAddress,
   DEV_WALLET_ADDRESS,
   ensureBalanceAndAllowanceToDiamond,
+  getPrivateKeyForEnvironment,
   getProvider,
   getUniswapDataERC20toExactERC20,
   getUniswapDataERC20toExactETH,
@@ -34,6 +35,7 @@ import {
   ITransactionTypeEnum,
   leftPadAddressToBytes32,
   sendTransaction,
+  solanaAddressToBytes32,
 } from './utils/demoScriptHelpers'
 
 // SUCCESSFUL TRANSACTIONS PRODUCED BY THIS SCRIPT ---------------------------------------------------------------------------------------------------
@@ -370,11 +372,6 @@ const WITH_EXCLUSIVE_RELAYER = false
 const EXCLUSIVE_RELAYER = '0x07ae8551be970cb1cca11dd7a11f47ae82e70e67' // biggest across relayer
 const SRC_CHAIN = 'optimism'
 const DIAMOND_ADDRESS_SRC = deploymentsOPT.LiFiDiamond
-const RECEIVER_ADDRESS_DST = isSolana
-  ? ADDRESS_DEV_WALLET_SOLANA_BYTES32
-  : WITH_DEST_CALL
-  ? deploymentsARB.ReceiverAcrossV3
-  : ADDRESS_DEV_WALLET_V4
 const EXPLORER_BASE_URL = 'https://optimistic.etherscan.io/tx/'
 
 // ############################################################################################################
@@ -385,6 +382,15 @@ async function main() {
   const walletAddress = await wallet.getAddress()
   consola.info('you are using this wallet address: ', walletAddress)
 
+  // Receiver on destination: derive Solana from signer key when bridging to Solana, else use config/deployment
+  const privateKey = getPrivateKeyForEnvironment(EnvironmentEnum.staging)
+  const solanaReceiverBase58 = isSolana ? deriveSolanaAddress(privateKey) : ''
+  const receiverAddressDst = isSolana
+    ? solanaAddressToBytes32(solanaReceiverBase58)
+    : WITH_DEST_CALL
+    ? deploymentsARB.ReceiverAcrossV3
+    : DEV_WALLET_ADDRESS
+
   // Helper function to format amount with decimals
   const formatAmount = (amount: string, isNative: boolean): string => {
     if (isNative) {
@@ -416,9 +422,7 @@ async function main() {
   consola.info(`🎯 Sending Asset: ${sendingAssetId}`)
   consola.info(`📦 Receiving Asset: ${receivingAssetId}`)
   consola.info(
-    `👤 Receiver: ${
-      isSolana ? 'S5ARSDD3ddZqqqqqb2EUE2h2F1XQHBk7bErRW1WPGe4' : walletAddress
-    }`
+    `👤 Receiver: ${isSolana ? solanaReceiverBase58 : walletAddress}`
   )
   consola.info(`🔄 Transaction Type: ${ITransactionTypeEnum[TRANSACTION_TYPE]}`)
   consola.info('')
@@ -454,7 +458,7 @@ async function main() {
   const bridgeDataReceiver = isSolana
     ? NON_EVM_ADDRESS // Use NON_EVM_ADDRESS for Solana
     : WITH_DEST_CALL
-    ? RECEIVER_ADDRESS_DST
+    ? receiverAddressDst
     : walletAddress
 
   const bridgeData: ILiFi.BridgeDataStruct = {
@@ -615,7 +619,7 @@ async function main() {
       fromChainId,
       toChainId,
       fromAmount,
-      RECEIVER_ADDRESS_DST, // must be a contract address when a message is provided
+      receiverAddressDst, // must be a contract address when a message is provided
       payload
     )
 
@@ -644,10 +648,10 @@ async function main() {
   // prepare AcrossV4Data - note the differences from V3
   const acrossV4Data: AcrossFacetV4.AcrossV4DataStruct = {
     receiverAddress: isSolana
-      ? ADDRESS_DEV_WALLET_SOLANA_BYTES32 // Use pre-converted Solana bytes32 address
+      ? receiverAddressDst // Derived from signer private key (Solana bytes32)
       : leftPadAddressToBytes32(
           // For other chains, convert to bytes32
-          WITH_DEST_CALL ? RECEIVER_ADDRESS_DST : walletAddress
+          WITH_DEST_CALL ? receiverAddressDst : walletAddress
         ), // bytes32
     refundAddress: leftPadAddressToBytes32(walletAddress),
     sendingAssetId: leftPadAddressToBytes32(sendingAssetId),

script/demoScripts/demoAcrossV4.ts

@@ -12,7 +12,7 @@
 
 import { randomBytes } from 'crypto'
 
-import { getAssociatedTokenAddress } from '@solana/spl-token'
+import { getAssociatedTokenAddressSync } from '@solana/spl-token'
 import { Keypair, PublicKey } from '@solana/web3.js'
 import { defineCommand, runMain } from 'citty'
 import { config } from 'dotenv'
@@ -150,7 +150,7 @@ async function computeSolanaATA(
     const mintPublicKey = new PublicKey(tokenMint)
 
     // Compute the Associated Token Account
-    const ata = await getAssociatedTokenAddress(mintPublicKey, ownerPublicKey)
+    const ata = getAssociatedTokenAddressSync(mintPublicKey, ownerPublicKey)
 
     // Convert to bytes32 (32 bytes) - take the first 32 bytes of the public key
     const ataBytes = ata.toBytes()

script/demoScripts/demoEco.ts

@@ -14,26 +14,32 @@ import {
   zeroAddress,
 } from 'viem'
 
+import deploymentsARB from '../../deployments/arbitrum.staging.json'
+import deploymentsOPT from '../../deployments/optimism.staging.json'
 import {
   ERC20__factory,
   PolymerCCTPFacet__factory,
   type ILiFi,
   type PolymerCCTPFacet,
 } from '../../typechain'
+import { EnvironmentEnum } from '../common/types'
 
 import {
-  ADDRESS_DEV_WALLET_SOLANA_BYTES32,
   ADDRESS_USDC_ARB,
   ADDRESS_USDC_OPT,
   ADDRESS_USDC_SOL,
   DEV_WALLET_ADDRESS,
   NON_EVM_ADDRESS,
+  computeSolanaATABytes32,
   createContractObject,
+  deriveSolanaAddress,
   ensureAllowance,
   ensureBalance,
   executeTransaction,
+  getPrivateKeyForEnvironment,
   logBridgeDataStruct,
   setupEnvironment,
+  solanaAddressToBytes32,
 } from './utils/demoScriptHelpers'
 
 config()
@@ -53,44 +59,42 @@ config()
 //  RECEIVE: https://arbiscan.io/tx/0xfb6ac6f8dd9369cff32ffc2c6a166a4252f310ab1253d53fa13960dbee530824
 // ---------------------------------------------------------------------------------------------------------------------------------------------------
 
+// ADDITIONAL DEMO TXS
+// ARB.USDC > OPT.USDC (fast path):
+//  SEND: https://arbiscan.io/tx/0x8bece438c05af716fa727a228d5b4f4a0bdc9ab1fe63c820f4864f5def8bea2f
+//  RECEIVE: https://optimistic.etherscan.io/tx/0x546f37d42364f9613ad702f6340c55935b3de8f7e933b7301a02fcd30ed4709c
+//  EXPLORER: https://lifi-explorer.polymer.zone/transfer/testnet/0x8bece438c05af716fa727a228d5b4f4a0bdc9ab1fe63c820f4864f5def8bea2f
+// ARB.USDC > SOLANA.USDC (fast path):
+//  SEND: https://arbiscan.io/tx/0x17ae338fce5766f004e51cfe9897c41da7ed56e3ffd40ca8a4d0b6a722f8bc70
+//  RECEIVE: https://explorer.solana.com/address/AhLkXqoSJR7hYcLcJAdjpCFG6HJUTDBRpvR2uBMfnq63
+//  EXPLORER: https://lifi-explorer.polymer.zone/transfer/testnet/0x17ae338fce5766f004e51cfe9897c41da7ed56e3ffd40ca8a4d0b6a722f8bc70
+
 // ########################################## CONFIGURE SCRIPT HERE ##########################################
-const BRIDGE_TO_SOLANA = false
+const BRIDGE_TO_SOLANA = true
 const SEND_TX = false // Set to false to dry-run without sending transaction
-const USE_FAST_MODE = false // Set to true for fast route (1000), false for standard route (2000)
+const USE_FAST_MODE = true // Set to true for fast route (1000), false for standard route (2000)
 
 // Polymer API configuration
-// const POLYMER_API_URL = 'https://lifi.devnet.polymer.zone' // testnet API URL
-const POLYMER_API_URL = 'https://lifi.shadownet.polymer.zone' // mainnet API URL
+const POLYMER_API_URL = 'https://lifi.testnet.polymer.zone' // testnet API URL
 
 // Source chain: 'arbitrum' or 'optimism'
-const SRC_CHAIN = 'optimism' as 'arbitrum' | 'optimism'
-
-// in order to test with our staging diamond, the polymer team needs to update their off-chain logic
-// to monitor our addresses. So far we tested with their deployments.
-// const DIAMOND_ADDRESS_SRC =
-//   SRC_CHAIN === 'arbitrum'
-//     ? deploymentsARB.LiFiDiamond
-//     : deploymentsOPT.LiFiDiamond
-
-// these are test deployments by Polymer team
-const LIFI_DIAMOND_ADDRESS_ARB = '0xD99A49304227d3fE2c27A1F12Ef66A95b95837b6'
-const LIFI_DIAMOND_ADDRESS_OPT = '0x36d7A6e0B2FE968a9558C5AaF5713aC2DAc0DbFc'
+const SRC_CHAIN = 'arbitrum' as 'arbitrum' | 'optimism'
+
 const DIAMOND_ADDRESS_SRC = getAddress(
-  SRC_CHAIN === 'arbitrum' ? LIFI_DIAMOND_ADDRESS_ARB : LIFI_DIAMOND_ADDRESS_OPT
+  SRC_CHAIN === 'arbitrum'
+    ? deploymentsARB.LiFiDiamond
+    : deploymentsOPT.LiFiDiamond
 )
 
-const LIFI_CHAIN_ID_SOLANA = 1151111081099710
+const LIFI_AND_POLYMER_CHAIN_ID_SOLANA = 1151111081099710
 const LIFI_CHAIN_ID_ARBITRUM = 42161
 const LIFI_CHAIN_ID_OPTIMISM = 10
 
-// Polymer API chain IDs (different from LiFi chain IDs)
-// Note: even though SOLANA's custom chain id in LifiData.sol is 1151111081099710,
-// polymer's chain id for solana is 2, so we need to pass in 2 for the polymer endpoint
-const POLYMER_CHAIN_ID_SOLANA = 2
-
 const DST_CHAIN_ID_EVM =
   SRC_CHAIN === 'arbitrum' ? LIFI_CHAIN_ID_OPTIMISM : LIFI_CHAIN_ID_ARBITRUM
-const DST_CHAIN_ID = BRIDGE_TO_SOLANA ? LIFI_CHAIN_ID_SOLANA : DST_CHAIN_ID_EVM
+const DST_CHAIN_ID = BRIDGE_TO_SOLANA
+  ? LIFI_AND_POLYMER_CHAIN_ID_SOLANA
+  : DST_CHAIN_ID_EVM
 
 const sendingAssetId = getAddress(
   SRC_CHAIN === 'arbitrum' ? ADDRESS_USDC_ARB : ADDRESS_USDC_OPT
@@ -100,7 +104,6 @@ const fromAmount = parseUnits('1', 6) // 1 USDC (6 decimals)
 const receiverAddress = getAddress(
   BRIDGE_TO_SOLANA ? NON_EVM_ADDRESS : DEV_WALLET_ADDRESS
 )
-const solanaReceiverBytes32 = ADDRESS_DEV_WALLET_SOLANA_BYTES32
 
 const EXPLORER_BASE_URL =
   SRC_CHAIN === 'arbitrum'
@@ -314,7 +317,7 @@ async function main() {
 
   // Polymer API uses its own chain ID mapping (Solana = 2, not LiFi's 1151111081099710)
   const destinationChainIdPolymer = BRIDGE_TO_SOLANA
-    ? POLYMER_CHAIN_ID_SOLANA
+    ? LIFI_AND_POLYMER_CHAIN_ID_SOLANA
     : DST_CHAIN_ID
 
   // Get quote from Polymer API
@@ -370,13 +373,32 @@ async function main() {
   consola.info('')
   logBridgeDataStruct(bridgeData)
 
+  // For Solana: derive wallet from same key as EVM signer, then compute USDC ATA (CCTP v2 requires mintRecipient = ATA)
+  let solanaUserWalletBytes32: `0x${string}` = toHex(0, { size: 32 })
+  let solanaReceiverATABytes32: `0x${string}` = toHex(0, { size: 32 })
+  if (BRIDGE_TO_SOLANA) {
+    const privateKey = getPrivateKeyForEnvironment(EnvironmentEnum.staging)
+    const solanaBase58 = deriveSolanaAddress(privateKey)
+    solanaUserWalletBytes32 = solanaAddressToBytes32(solanaBase58)
+    consola.info(`  Solana user wallet (bytes32): ${solanaUserWalletBytes32}`)
+    solanaReceiverATABytes32 = await computeSolanaATABytes32(
+      solanaBase58,
+      ADDRESS_USDC_SOL
+    )
+    consola.info(
+      `  Solana USDC ATA (solanaReceiverATA): ${solanaReceiverATABytes32}`
+    )
+    consola.info(`  Solana user wallet (base58): ${solanaBase58}`)
+  }
+
   // Prepare PolymerCCTP data using fees extracted from API response
   const polymerData: PolymerCCTPFacet.PolymerCCTPDataStruct = {
     polymerTokenFee: polymerTokenFee.toString(),
     maxCCTPFee: maxCCTPFee.toString(),
     nonEVMReceiver: BRIDGE_TO_SOLANA
-      ? toHex(solanaReceiverBytes32)
+      ? solanaUserWalletBytes32
       : toHex(0, { size: 32 }),
+    solanaReceiverATA: solanaReceiverATABytes32,
     minFinalityThreshold,
   }
   consola.info('\n📋 POLYMER CCTP DATA PREPARED:')
@@ -386,7 +408,12 @@ async function main() {
       maxCCTPFee === 0n ? '0 = no limit' : 'from API'
     })`
   )
-  consola.info(`  nonEVMReceiver: ${polymerData.nonEVMReceiver}`)
+  consola.info(
+    `  nonEVMReceiver (Solana user wallet): ${polymerData.nonEVMReceiver}`
+  )
+  consola.info(
+    `  solanaReceiverATA (USDC ATA): ${polymerData.solanaReceiverATA}`
+  )
   consola.info(
     `  minFinalityThreshold: ${polymerData.minFinalityThreshold} (from API, ${
       minFinalityThreshold === 1000 ? 'fast path' : 'standard path'
@@ -401,6 +428,10 @@ async function main() {
       walletClient
     )
 
+    consola.info(`Wallet: ${walletAddress}`)
+    consola.info(
+      `Wallet balance: ${await tokenContract.read.balanceOf([walletAddress])}`
+    )
     // Contract transfers minAmount, so user must approve minAmount (fromAmount)
     await ensureBalance(tokenContract, walletAddress, fromAmount, publicClient)
     await ensureAllowance(