Skip to content

Add CROSS ctusd route artifacts#1460

Open
nambrot wants to merge 14 commits intomainfrom
codex/cross-ctusd-main-clean
Open

Add CROSS ctusd route artifacts#1460
nambrot wants to merge 14 commits intomainfrom
codex/cross-ctusd-main-clean

Conversation

@nambrot
Copy link
Copy Markdown
Contributor

@nambrot nambrot commented Apr 8, 2026

Summary

  • add CROSS/ctusd aggregate route config
  • add USDC/ctusd subroute artifacts
  • add USDT/ctusd subroute artifacts

Notes

  • this is a clean PR against main
  • includes the Solana USDC and USDT aggregate route entries plus the two EVM subroutes

@hyper-gonk
Copy link
Copy Markdown
Contributor

hyper-gonk bot commented Apr 8, 2026

Check Warp Deploy Summary

Warp Route ID On-Chain Config Sync
CROSS/ctusd N/A
USDC/ctusd
USDT/ctusd

Last updated: 2026-04-10 16:12:21 UTC

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 8, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Added multiple Warp routing configuration and deployment YAMLs that declare cross-chain tokens, collateral mappings, per-chain router/fee/mailbox settings, interchain security modules, allowed rebalancers/bridges, and cross-chain connections across ethereum, arbitrum, base, citrea, katana, and solanamainnet.

Changes

Cohort / File(s) Summary
CROSS Token Configuration
deployments/warp_routes/CROSS/ctusd-config.yaml
New token list enumerating cross-chain USDC/USDT/ctUSD entries with addressOrDenom, optional collateralAddressOrDenom, decimals, name, symbol, standard (e.g., EvmHypCrossCollateralRouter, SealevelHypCrossCollateral, EvmHypSynthetic), and connections linking assets across chains.
USDC Config & Deployment
deployments/warp_routes/USDC/ctusd-config.yaml, deployments/warp_routes/USDC/ctusd-deploy.yaml
New USDC/ctUSD/vbUSDC token mappings and a comprehensive per-chain deployment: allowedRebalancers, domain-keyed crossCollateralRouters, mailbox/token/owner, destinationGas, interchainSecurityModule (including amountRoutingIsm composition), allowedRebalancingBridges, and tokenFee using OffchainQuotedLinearFee (3 bps) with fee contract addresses and quoteSigners.
USDT Config & Deployment
deployments/warp_routes/USDT/ctusd-config.yaml, deployments/warp_routes/USDT/ctusd-deploy.yaml
Added USDT token entries and per-chain deployments for arbitrum and base with allowedRebalancers, domain-keyed crossCollateralRouters, interchainSecurityModule (nested ISM composition), mailbox/owner/token, and tokenFee (OffchainQuotedLinearFee, 3 bps) feeContracts per destination.
Schema Update
deployments/warp_routes/schema.json
Extended standard enum to include "SealevelHypCrossCollateral" to validate Sealevel (Solana) routing standard.
Package / Changeset
package.json, .changeset/small-mayflies-marry.md
Bumped dev deps @hyperlane-xyz/sdk and @hyperlane-xyz/utils to 30.1.1; added changeset noting ctusd route artifacts updates for CROSS, USDC, USDT.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    participant User as User
    participant SrcChain as SrcChain
    participant Mailbox as Mailbox
    participant ISM as InterchainSecurityModule
    participant Router as CrossCollateralRouter
    participant Fee as FeeContract
    participant DestChain as DestChain

    rect rgba(173,216,230,0.5)
    User->>SrcChain: Initiate cross-chain transfer (token + meta)
    SrcChain->>Mailbox: Submit message for destination
    end

    rect rgba(144,238,144,0.5)
    Mailbox->>ISM: Validate routing policy / thresholds
    ISM-->>Mailbox: Approve/Reject
    Mailbox->>Router: Relay transfer message
    end

    rect rgba(255,228,181,0.5)
    Router->>Fee: Request off-chain fee quote
    Fee-->>Router: Return fee (bps, signers)
    Router->>DestChain: Mint/lock collateral or synthetic per `standard`
    DestChain-->>User: Deliver destination asset
    end
Loading
🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Description check ❓ Inconclusive The PR description covers the key changes but doesn't follow the provided template structure with required sections for backward compatibility and testing details. Consider adding the template sections: explicitly state backward compatibility assessment and describe testing performed with Hyperlane tooling (CLI or otherwise).
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately reflects the main change: adding CROSS ctusd route artifacts, though it's somewhat narrow given the PR also adds USDC and USDT subroute artifacts.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@deployments/warp_routes/CROSS/ctusd-config.yaml`:
- Around line 121-122: The YAML entry uses an undefined standard value
"SealevelHypCrossCollateral" for the USDT token; change the standard to the
correct schema-defined value used for Solana cross-collateral (the same
replacement you applied to the USDC entry) so that the "symbol: USDT" entry
references the valid standard instead of "SealevelHypCrossCollateral". Ensure
the updated standard identifier exactly matches the schema name used elsewhere.
- Around line 106-107: The YAML uses a non-existent standard value
SealevelHypCrossCollateral under the standard key; either replace
SealevelHypCrossCollateral with an existing enum value (e.g.,
SealevelHypCollateral) in the affected records (the standard key entries) or add
SealevelHypCrossCollateral to the schema.json enum so it becomes a valid
standard; update the standard values consistently (including the other
occurrence noted) and ensure the schema's enum list and the YAML standard keys
match exactly.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4e18a20e-3971-4d29-b23d-356f8db685d9

📥 Commits

Reviewing files that changed from the base of the PR and between 184d411 and 1dd5bbc.

📒 Files selected for processing (5)
  • deployments/warp_routes/CROSS/ctusd-config.yaml
  • deployments/warp_routes/USDC/ctusd-config.yaml
  • deployments/warp_routes/USDC/ctusd-deploy.yaml
  • deployments/warp_routes/USDT/ctusd-config.yaml
  • deployments/warp_routes/USDT/ctusd-deploy.yaml

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@deployments/warp_routes/USDC/ctusd-deploy.yaml`:
- Around line 16-31: Reorder the YAML keys inside the amountRoutingIsm blocks so
they are alphabetical: change the amountRoutingIsm key order to lowerIsm,
threshold, type, upperIsm; inside the nested lowerIsm blocks reorder keys to
modules, threshold, type; apply this fix for the amountRoutingIsm occurrences
(including the blocks labeled amountRoutingIsm, lowerIsm, and upperIsm) present
in the file (and the repeated base and citrea sections) so all ISM blocks follow
the "YAML keys must be sorted alphabetically" rule.
- Around line 3-5: The allowedRebalancers entries in ctusd-deploy.yaml contain
inconsistent casing (one lowercase address among checksummed ones); locate the
allowedRebalancers arrays for the top-level, base, and ethereum sections and
replace the lowercase/non-checksummed addresses with their proper EIP-55
checksummed forms (use the correct checksums already present in USDTSTAGE and
ETHSTAGE as the source of truth), ensuring all addresses in allowedRebalancers
are uniformly checksummed (e.g., update the three addresses shown and the
corresponding sets in base and ethereum).

In `@deployments/warp_routes/USDT/ctusd-deploy.yaml`:
- Around line 21-31: The YAML has nested maps with keys out of alphabetical
order; reorder keys so each map sorts keys alphabetically (e.g., for the
amountRoutingIsm block put keys as lowerIsm, threshold, type -> then inside
lowerIsm/staticAggregationIsm sort as modules, threshold, type -> inside each
module sort keys alphabetically such as relayer, type and owner, domains, type
for defaultFallbackRoutingIsm) and apply the same reordering to the other nested
ISM/module block with trustedRelayerIsm/defaultFallbackRoutingIsm so all keys
(type, threshold, lowerIsm, modules, relayer, owner, domains, etc.) are
alphabetized to satisfy the YAML key-sorting policy.
- Around line 7-16: The mapping under crossCollateralRouters has domain keys out
of lexicographic order; reorder the keys so they are alphabetically sorted as
strings (e.g., "1", "1399811149", "4114", "42161", "8453") and apply the same
sorting to the other similar block(s) referenced (the block containing the keys
"1","4114","42161","8453","1399811149") to satisfy the YAML key-ordering rule.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: eca52214-a84b-4a92-a7f6-ad6f9893d555

📥 Commits

Reviewing files that changed from the base of the PR and between 1dd5bbc and 011a349.

📒 Files selected for processing (2)
  • deployments/warp_routes/USDC/ctusd-deploy.yaml
  • deployments/warp_routes/USDT/ctusd-deploy.yaml

Comment on lines +3 to +5
- "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
- "0xa3948a15e1d0778a7d53268b651B2411AF198FE3"
- "0x3e0a78a330f2b97059a4d507ca9d8292b65b6fb5"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check if there's a standard for address casing in this repo
rg -n "0x3e0a78a330f2b97059a4d507ca9d8292b65b6fb5" --ignore-case

Repository: hyperlane-xyz/hyperlane-registry

Length of output: 1549


🏁 Script executed:

#!/bin/bash
# Read the YAML file to see the actual addresses and structure
head -n 10 deployments/warp_routes/USDC/ctusd-deploy.yaml

# Also check around lines 76-78 and 224-226 mentioned in the original scratchpad
echo "=== Around line 76-78 ==="
sed -n '74,80p' deployments/warp_routes/USDC/ctusd-deploy.yaml

echo "=== Around line 224-226 ==="
sed -n '222,228p' deployments/warp_routes/USDC/ctusd-deploy.yaml

# Verify the checksum validity using online source or logic
# EIP-55 checksum is derived from Keccak256 hash of the lowercase address
pip install eth-keys eth-utils >/dev/null 2>&1

python3 << 'EOF'
from eth_utils import to_checksum_address

# The address in question
lowercase_addr = "0x3e0a78a330f2b97059a4d507ca9d8292b65b6fb5"

# Generate correct checksum
correct_checksum = to_checksum_address(lowercase_addr)
print(f"Lowercase: {lowercase_addr}")
print(f"Correct checksum: {correct_checksum}")

# Check the suggested version from the diff
suggested = "0x3E0A78A330F2b97059a4d507CA9D8292b65b6fb5"
print(f"Suggested in diff: {suggested}")
print(f"Match: {suggested.lower() == correct_checksum.lower()}")
EOF

Repository: hyperlane-xyz/hyperlane-registry

Length of output: 2718


🏁 Script executed:

#!/bin/bash
# Try with a different approach to verify the checksum
# Use web-based source or alternative validation

# First, let's check if there are any guidelines in the codebase
grep -r "address" --include="*.md" --include="*.txt" | grep -i "check\|case\|format" | head -20

# Also check what the files we saw in pre-execution use
echo "=== Checksum in USDTSTAGE (seen in pre-exec results) ==="
grep -n "0x3e0A78A330F2b97059A4D507ca9d8292b65B6FB5" deployments/warp_routes/USDTSTAGE/mode-deploy.yaml | head -1

echo "=== Checksum in ETHSTAGE (seen in pre-exec results) ==="
grep -n "0x3e0A78A330F2b97059A4D507ca9d8292b65B6FB5" deployments/warp_routes/ETHSTAGE/stage-deploy.yaml | head -1

# Try Python with installed crypto backend
pip install pycryptodome >/dev/null 2>&1
python3 << 'EOF'
from eth_utils import to_checksum_address

lowercase_addr = "0x3e0a78a330f2b97059a4d507ca9d8292b65b6fb5"
correct_checksum = to_checksum_address(lowercase_addr)

print(f"Lowercase: {lowercase_addr}")
print(f"Correct EIP-55 checksum: {correct_checksum}")

# Check versions we've seen
version_from_usdtstage = "0x3e0A78A330F2b97059A4D507ca9d8292b65B6FB5"
version_from_diff = "0x3E0A78A330F2b97059a4d507CA9D8292b65b6fb5"

print(f"\nVersion in USDTSTAGE/ETHSTAGE: {version_from_usdtstage}")
print(f"  Matches correct: {version_from_usdtstage.lower() == correct_checksum.lower()}")
print(f"\nVersion suggested in diff: {version_from_diff}")
print(f"  Matches correct: {version_from_diff.lower() == correct_checksum.lower()}")
EOF

Repository: hyperlane-xyz/hyperlane-registry

Length of output: 1317


Those addresses be looking a wee bit disheveled, you see

Three of the allowedRebalancers across your chains got that address casing all mixed up like ogres in a swamp. Two are proper checksummed (EIP-55) and one's sitting there in all lowercase. While it might not cause trouble with everything, best to keep 'em consistent like layers.

Fix the address casing
     - "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
     - "0xa3948a15e1d0778a7d53268b651B2411AF198FE3"
-    - "0x3e0a78a330f2b97059a4d507ca9d8292b65b6fb5"
+    - "0x3e0A78A330F2b97059A4D507ca9d8292b65B6FB5"

This pattern repeats in base (lines 76-78) and ethereum (lines 224-226) sections too. The correct checksummed form matches what's already in your USDTSTAGE and ETHSTAGE files.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
- "0xa3948a15e1d0778a7d53268b651B2411AF198FE3"
- "0x3e0a78a330f2b97059a4d507ca9d8292b65b6fb5"
- "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
- "0xa3948a15e1d0778a7d53268b651B2411AF198FE3"
- "0x3e0A78A330F2b97059A4D507ca9d8292b65B6FB5"
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@deployments/warp_routes/USDC/ctusd-deploy.yaml` around lines 3 - 5, The
allowedRebalancers entries in ctusd-deploy.yaml contain inconsistent casing (one
lowercase address among checksummed ones); locate the allowedRebalancers arrays
for the top-level, base, and ethereum sections and replace the
lowercase/non-checksummed addresses with their proper EIP-55 checksummed forms
(use the correct checksums already present in USDTSTAGE and ETHSTAGE as the
source of truth), ensuring all addresses in allowedRebalancers are uniformly
checksummed (e.g., update the three addresses shown and the corresponding sets
in base and ethereum).

Comment on lines +16 to +31
ethereum:
type: amountRoutingIsm
threshold: 1000000000
lowerIsm:
type: staticAggregationIsm
threshold: 1
modules:
- type: trustedRelayerIsm
relayer: "0x1e100476e9360b11a592eafe1c90328368e547b6"
- type: defaultFallbackRoutingIsm
owner: "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
domains: {}
upperIsm:
domains: {}
owner: "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
type: defaultFallbackRoutingIsm
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

YAML keys aren't sorted alphabetically in the ISM blocks, mate.

Look, within the amountRoutingIsm block here (and repeated in base at lines 89-104 and citrea at lines 164-179), the keys type, threshold, lowerIsm, upperIsm should be reordered alphabetically. Same goes for the nested lowerIsm structure where modules should come before threshold and type.

As per coding guidelines: "YAML files must have keys sorted alphabetically"

🔧 Proposed fix for alphabetical sorting
       ethereum:
-        type: amountRoutingIsm
-        threshold: 1000000000
         lowerIsm:
-          type: staticAggregationIsm
-          threshold: 1
           modules:
             - type: trustedRelayerIsm
               relayer: "0x1e100476e9360b11a592eafe1c90328368e547b6"
             - type: defaultFallbackRoutingIsm
-              owner: "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
               domains: {}
+              owner: "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
+          threshold: 1
+          type: staticAggregationIsm
+        threshold: 1000000000
+        type: amountRoutingIsm
         upperIsm:
           domains: {}
           owner: "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
           type: defaultFallbackRoutingIsm
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
ethereum:
type: amountRoutingIsm
threshold: 1000000000
lowerIsm:
type: staticAggregationIsm
threshold: 1
modules:
- type: trustedRelayerIsm
relayer: "0x1e100476e9360b11a592eafe1c90328368e547b6"
- type: defaultFallbackRoutingIsm
owner: "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
domains: {}
upperIsm:
domains: {}
owner: "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
type: defaultFallbackRoutingIsm
ethereum:
lowerIsm:
modules:
- type: trustedRelayerIsm
relayer: "0x1e100476e9360b11a592eafe1c90328368e547b6"
- type: defaultFallbackRoutingIsm
domains: {}
owner: "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
threshold: 1
type: staticAggregationIsm
threshold: 1000000000
type: amountRoutingIsm
upperIsm:
domains: {}
owner: "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
type: defaultFallbackRoutingIsm
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@deployments/warp_routes/USDC/ctusd-deploy.yaml` around lines 16 - 31, Reorder
the YAML keys inside the amountRoutingIsm blocks so they are alphabetical:
change the amountRoutingIsm key order to lowerIsm, threshold, type, upperIsm;
inside the nested lowerIsm blocks reorder keys to modules, threshold, type;
apply this fix for the amountRoutingIsm occurrences (including the blocks
labeled amountRoutingIsm, lowerIsm, and upperIsm) present in the file (and the
repeated base and citrea sections) so all ISM blocks follow the "YAML keys must
be sorted alphabetically" rule.

Comment on lines +21 to +31
type: amountRoutingIsm
threshold: 1000000000
lowerIsm:
type: staticAggregationIsm
threshold: 1
modules:
- type: trustedRelayerIsm
relayer: "0x1e100476e9360b11a592eafe1c90328368e547b6"
- type: defaultFallbackRoutingIsm
owner: "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
domains: {}
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Nested ISM/module maps need one more onion layer of key sorting.

A few nested maps are out of alpha order (type/threshold/lowerIsm, module entries like type/relayer, and type/owner/domains). Same content, just reorder keys to match policy and keep CI happy.

As per coding guidelines, **/*.{yaml,yml}: YAML files must have keys sorted alphabetically.

Also applies to: 98-108

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@deployments/warp_routes/USDT/ctusd-deploy.yaml` around lines 21 - 31, The
YAML has nested maps with keys out of alphabetical order; reorder keys so each
map sorts keys alphabetically (e.g., for the amountRoutingIsm block put keys as
lowerIsm, threshold, type -> then inside lowerIsm/staticAggregationIsm sort as
modules, threshold, type -> inside each module sort keys alphabetically such as
relayer, type and owner, domains, type for defaultFallbackRoutingIsm) and apply
the same reordering to the other nested ISM/module block with
trustedRelayerIsm/defaultFallbackRoutingIsm so all keys (type, threshold,
lowerIsm, modules, relayer, owner, domains, etc.) are alphabetized to satisfy
the YAML key-sorting policy.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this resolved?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check the current state of the USDT ctusd-deploy.yaml file for key ordering
cat deployments/warp_routes/USDT/ctusd-deploy.yaml

Length of output: 6321


@nambrot, not quite — the nested keys in the interchainSecurityModule block are still out of order in both arbitrum and base sections. Here's what needs fixing:

# Current (out of order)          →  # Fixed (alphabetical)
type: amountRoutingIsm             →  lowerIsm:
threshold: 1000000000              →    modules:
lowerIsm:                          →      - relayer: "0x1e100..."
  type: staticAggregationIsm       →        type: trustedRelayerIsm
  threshold: 1                     →      - domains: {}
  modules:                         →        owner: "0xEA21..."
    - type: trustedRelayerIsm      →        type: defaultFallbackRoutingIsm
      relayer: "0x1e100..."        →    threshold: 1
    - type: defaultFallbackRouting →    type: staticAggregationIsm
      owner: "0xEA21..."           →  threshold: 1000000000
      domains: {}                  →  type: amountRoutingIsm

Specifically, for each occurrence (both arbitrum and base, Lines 21–31 and Lines 98–108):

  1. ethereum block: reorder type → threshold → lowerIsm to lowerIsm → threshold → type
  2. lowerIsm block: reorder type → threshold → modules to modules → threshold → type
  3. trustedRelayerIsm module: reorder type → relayer to relayer → type
  4. defaultFallbackRoutingIsm module: reorder type → owner → domains to domains → owner → type

🧠 Learnings used
Learnt from: CR
Repo: hyperlane-xyz/hyperlane-registry PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-27T21:55:19.210Z
Learning: Applies to deployments/warp_routes/**/*-config.yaml : Warp route IDs must follow format: {SYMBOL}/{label} where label is typically chain names joined by hyphens (e.g., USDC/ethereum-arbitrum)

Learnt from: CR
Repo: hyperlane-xyz/hyperlane-registry PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-27T21:55:07.081Z
Learning: Applies to deployments/warp_routes/**/*.yaml : Warp route IDs must follow format: {SYMBOL}/{label} where label is typically chain names joined by hyphens

Learnt from: Xaroz
Repo: hyperlane-xyz/hyperlane-registry PR: 1444
File: deployments/warp_routes/USDT/eclipsemainnet-deploy.yaml:1-1
Timestamp: 2026-04-02T15:08:14.086Z
Learning: In the hyperlane-xyz/hyperlane-registry repo, `deployments/warp_routes/warpRouteConfigs.yaml` is automatically updated by a CI job that runs after a PR is merged. Manual edits to this index file are not required in PRs that add or rename warp routes.

Learnt from: paulbalaji
Repo: hyperlane-xyz/hyperlane-registry PR: 1302
File: deployments/warp_routes/USDC/paradex-deploy.yaml:43-55
Timestamp: 2025-12-23T12:47:38.840Z
Learning: In Hyperlane warp route deployment YAML files under deployments/warp_routes, omitting the contractVersion field for a chain means that chain will use the latest contract version, while other chains with explicit contractVersion remain on their specified versions. Ensure this behavior is intentional and documented; review each deploy before applying to avoid unintended upgrades.

Learnt from: CR
Repo: hyperlane-xyz/hyperlane-registry PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-03-27T21:55:19.210Z
Learning: Applies to **/*.yaml : YAML files must have keys sorted alphabetically

Learnt from: CR
Repo: hyperlane-xyz/hyperlane-registry PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-27T21:55:07.081Z
Learning: Applies to **/*.{yaml,yml} : YAML files must have keys sorted alphabetically

Learnt from: CR
Repo: hyperlane-xyz/hyperlane-registry PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-27T21:55:07.081Z
Learning: Applies to **/*.{ts,tsx} : Sort arrays and maps before processing for consistent, deterministic output

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
deployments/warp_routes/USDC/ctusd-deploy.yaml (1)

81-87: Keys aren't in alphabetical order within the chain blocks, and that just ain't right.

destinationGas is sitting at the bottom of each chain section when it should be right after crossCollateralRouters alphabetically. This pattern repeats across all five chain blocks (arbitrum, base, citrea, ethereum, katana).

As per coding guidelines: "YAML files must have keys sorted alphabetically"

🔧 Suggested reordering for arbitrum block (apply same pattern to other chains)
 arbitrum:
   allowedRebalancers:
     ...
   crossCollateralRouters:
     ...
+  destinationGas:
+    "1": "68000"
+    "4114": "68000"
+    "8453": "68000"
+    "1399811149": "68000"
+    "747474": "68000"
   interchainSecurityModule:
     ...
   mailbox: "0x979Ca5202784112f4738403dBec5D0F3B9daabB9"
   owner: "0xEA2117b24F7947647Bec60527B68f4244AE40c01"
   token: "0xaf88d065e77c8cC2239327C5EDb3A432268e5831"
   tokenFee:
     ...
-  destinationGas:
-    "1": "68000"
-    "4114": "68000"
-    "8453": "68000"
-    "1399811149": "68000"
-    "747474": "68000"
   type: crossCollateral
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@deployments/warp_routes/USDC/ctusd-deploy.yaml` around lines 81 - 87, The
YAML keys in each chain block are not alphabetized: move destinationGas so it
appears immediately after crossCollateralRouters (alphabetical order) within the
arbitrum, base, citrea, ethereum, and katana chain sections; ensure every key in
those chain blocks (including crossCollateralRouters, destinationGas, type:
crossCollateral, etc.) is sorted alphabetically so the destinationGas entry is
no longer at the bottom but correctly positioned after crossCollateralRouters.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@deployments/warp_routes/USDC/ctusd-deploy.yaml`:
- Around line 81-87: The YAML keys in each chain block are not alphabetized:
move destinationGas so it appears immediately after crossCollateralRouters
(alphabetical order) within the arbitrum, base, citrea, ethereum, and katana
chain sections; ensure every key in those chain blocks (including
crossCollateralRouters, destinationGas, type: crossCollateral, etc.) is sorted
alphabetically so the destinationGas entry is no longer at the bottom but
correctly positioned after crossCollateralRouters.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 089aab84-760d-451e-a7d9-ab24e94a7e90

📥 Commits

Reviewing files that changed from the base of the PR and between 011a349 and e27fe06.

📒 Files selected for processing (2)
  • deployments/warp_routes/USDC/ctusd-config.yaml
  • deployments/warp_routes/USDC/ctusd-deploy.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
  • deployments/warp_routes/USDC/ctusd-config.yaml

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (1)
deployments/warp_routes/CROSS/ctusd-config.yaml (1)

111-112: ⚠️ Potential issue | 🟠 Major

Use a schema-valid Sealevel standard for both Solana tokens.

Line 111 and Line 126 use SealevelHypCrossCollateral, but that value is not in deployments/warp_routes/schema.json’s standard enum from the provided snippet. This will break schema validation.

Suggested patch
-    standard: SealevelHypCrossCollateral
+    standard: SealevelHypCollateral
...
-    standard: SealevelHypCrossCollateral
+    standard: SealevelHypCollateral

Also applies to: 126-127

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@deployments/warp_routes/CROSS/ctusd-config.yaml` around lines 111 - 112, The
YAML uses a non-schema value "SealevelHypCrossCollateral" for the "standard"
field (seen near the entries with "symbol: USDC"); replace those occurrences
(the two "standard: SealevelHypCrossCollateral" entries) with one of the valid
enum values from deployments/warp_routes/schema.json's "standard" enum so the
documents validate—update both entries to the correct Sealevel standard string
that matches the schema.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@deployments/warp_routes/CROSS/ctusd-config.yaml`:
- Around line 111-112: The YAML uses a non-schema value
"SealevelHypCrossCollateral" for the "standard" field (seen near the entries
with "symbol: USDC"); replace those occurrences (the two "standard:
SealevelHypCrossCollateral" entries) with one of the valid enum values from
deployments/warp_routes/schema.json's "standard" enum so the documents
validate—update both entries to the correct Sealevel standard string that
matches the schema.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 95b9f313-1c9a-4ac1-a294-a9733a134d75

📥 Commits

Reviewing files that changed from the base of the PR and between e27fe06 and 4aeb11b.

📒 Files selected for processing (1)
  • deployments/warp_routes/CROSS/ctusd-config.yaml

@socket-security
Copy link
Copy Markdown

socket-security bot commented Apr 8, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​hyperlane-xyz/​utils@​29.1.0 ⏵ 30.1.184 +110078 -198100
Updated@​hyperlane-xyz/​sdk@​29.1.0 ⏵ 30.1.186 +110086 +198100

View full report

@socket-security
Copy link
Copy Markdown

socket-security bot commented Apr 8, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @hyperlane-xyz/core is 86.0% likely obfuscated

Confidence: 0.86

Location: Package overview

From: pnpm-lock.yamlnpm/@hyperlane-xyz/sdk@30.1.1npm/@hyperlane-xyz/core@11.3.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@hyperlane-xyz/core@11.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @hyperlane-xyz/core is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/@hyperlane-xyz/sdk@30.1.1npm/@hyperlane-xyz/core@11.3.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@hyperlane-xyz/core@11.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @hyperlane-xyz/core is 88.0% likely obfuscated

Confidence: 0.88

Location: Package overview

From: pnpm-lock.yamlnpm/@hyperlane-xyz/sdk@30.1.1npm/@hyperlane-xyz/core@11.3.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@hyperlane-xyz/core@11.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @hyperlane-xyz/core is 85.0% likely obfuscated

Confidence: 0.85

Location: Package overview

From: pnpm-lock.yamlnpm/@hyperlane-xyz/sdk@30.1.1npm/@hyperlane-xyz/core@11.3.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@hyperlane-xyz/core@11.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @hyperlane-xyz/core is 85.0% likely obfuscated

Confidence: 0.85

Location: Package overview

From: pnpm-lock.yamlnpm/@hyperlane-xyz/sdk@30.1.1npm/@hyperlane-xyz/core@11.3.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@hyperlane-xyz/core@11.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
deployments/warp_routes/warpRouteConfigs.yaml (1)

672-810: Prefer letting CI update this index file instead of manual edits.

These entries look structurally fine, but deployments/warp_routes/warpRouteConfigs.yaml is CI-managed after merge, so hand-editing it in the PR can add noisy diff churn. I’d recommend dropping manual index edits unless your workflow explicitly requires pre-merge updates.

Based on learnings: deployments/warp_routes/warpRouteConfigs.yaml is automatically updated by a CI job after merge, so manual edits are not required for added/renamed warp routes.

Also applies to: 7464-7524, 10633-10652

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@deployments/warp_routes/warpRouteConfigs.yaml` around lines 672 - 810, The
CI-managed index file has been edited manually; revert the manual changes to the
CROSS/ctusd section in warpRouteConfigs.yaml (the entries under the
"CROSS/ctusd" block such as tokens with addressOrDenom
"0x62fe676dff1e7ABBCcbedc8BABc993827b9fb189", "0x8243539...", "0xd54A15f8...",
the Sealevel entries "HxwQM6D6F..." and "3zh5dN..." and the katana token
"0xe064aee7...") — remove these hand edits from your branch so the file is
unchanged and allow the CI job to update warpRouteConfigs.yaml after merge.
Preserve any other unrelated changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@deployments/warp_routes/warpRouteConfigs.yaml`:
- Around line 672-810: The CI-managed index file has been edited manually;
revert the manual changes to the CROSS/ctusd section in warpRouteConfigs.yaml
(the entries under the "CROSS/ctusd" block such as tokens with addressOrDenom
"0x62fe676dff1e7ABBCcbedc8BABc993827b9fb189", "0x8243539...", "0xd54A15f8...",
the Sealevel entries "HxwQM6D6F..." and "3zh5dN..." and the katana token
"0xe064aee7...") — remove these hand edits from your branch so the file is
unchanged and allow the CI job to update warpRouteConfigs.yaml after merge.
Preserve any other unrelated changes.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 23f80fbb-a0be-425c-978c-10c29230cfc6

📥 Commits

Reviewing files that changed from the base of the PR and between 4aeb11b and 49c697e.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (4)
  • .changeset/small-mayflies-marry.md
  • deployments/warp_routes/schema.json
  • deployments/warp_routes/warpRouteConfigs.yaml
  • package.json
✅ Files skipped from review due to trivial changes (3)
  • .changeset/small-mayflies-marry.md
  • package.json
  • deployments/warp_routes/schema.json

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants