[pegahcarter]

Fixes from a review by Nordin Sabli (KupiaSec) of four areas: origin authentication in TransceiverBase and ReceiverBase for each provider (including the vendored LayerZero OApp peer check), the permissionless Wormhole executeVAAv1 path, bootstrap and receiver reports, and Commitment and ERC-7930 encoding.

Stacked on #59, because the Wormhole Executor path under review lands there. Retarget this PR to main once #59 merges.

Fixed

• Transceiver: a Predetermined chain's default counterpart can be repointed after it is in use #60 (Medium): a Predetermined chain's default counterpart could be repointed after it was in use. setCounterpart and resolveCounterpart refused only when a counterpart was stored, but the parity default is live from the moment a chain is graded. Both now go through _recordCounterpart, which refuses an address other than _parityAddress(chainKey) on a Predetermined chain. test_anExplicitCounterpartOverridesTheDefault encoded the old behavior as an escape hatch. It is replaced: a chain where parity does not hold is graded Unique, and through a non-parity counterpart every inbound bootstrap reverts ParityBroken anyway. Twelve fixtures that paired a Predetermined grade with an arbitrary counterpart now use the parity address or a Unique chain.
• Receivers on CCIP, Hyperlane, Wormhole, and Superchain interop accept their transmitter's address from any origin chain #61 (Medium): CCIP, Hyperlane, Wormhole, Superchain interop, and ERC-7786 receivers accepted their transmitter's address from any origin. ReceiverBase now records homeOrigin at initialization, and _onMessageFrom(origin, sender, payload) refuses any other origin. The origin is in the transport's own naming: the provider id from the transceiver's table (ProviderTransceiver._accountInitializer), the source chain id for interop, the messenger for op-stack-l1-l2, the eid for LayerZero, and the chainKey over an ERC-7786 gateway. ProviderReceiveSpec.test_anUnconfiguredOriginIsRejected now delivers the real transmitter from another origin. It failed on CCIP, Hyperlane, Wormhole, and interop before this change. The new test_aCreatedReceiverAcceptsItsTransmitterOnlyFromItsHome checks end to end, on every binding, that the origin the transceiver writes is the one deliveries report.
• LayerZero transceiver: a peer can disagree with the counterpart, and both are write-once #62 (Low): the LayerZero transceiver's peer could disagree with its counterpart, and both are write-once. setPeer now refuses a peer other than the counterpart on the chain the eid maps to. Deploy step 5 in deploy/README.md now sets the peer after the counterpart.

Not a bug

• Receiver report: the quote and the send run under different refund addresses #63 (closed): I misread the order of the report's quote and send. The quote is evaluated after _reporting is set. A regression test with a mock mailbox that prices the refund address pins it.
• An eip155 envelope accepts addresses of any length. The CAIP-350 eip155 profile says addresses are 20 bytes today but may become 32, so a strict rule would be a policy choice. No issue was filed.

Reviewed, no findings

The Wormhole consumed-hash set (keyed on vm.hash, per contract, consumed only after the (targetChain, targetAddress) prefix matches this contract on this chain); zkSync and Tron CREATE2 derivation and the AccountAddressMismatch guard; write-once provider ids and the reverse index; bootstrap fee and float flows through Treasury; chainKey canonicity in Erc7930.parseStrict and _requireNames; the Blake2b IV, counters, and final-block flag; the Sha256 and Keccak plugins against Commitment's fold; cross-chain replay of a commitment (seeded with the destination chainKey) and of a path A payload (each transport binds the destination).

Cost

• Receivers on CCIP, Hyperlane, Wormhole, and Superchain interop accept their transmitter's address from any origin chain #61 adds one storage slot per receiver. Measured with the provider fixtures: 22,000 to 26,000 gas per bootstrap and 1,300 to 2,300 per payload, against defaults of 1,000,000 and 200,000. deploy/CHECKS.md §4, DeliveryGas, and todo.md are updated. No payload size changes.
• EIP-170 headroom after this PR: LzTronTransceiver 153 bytes, LzZkSyncTransceiver 211, LzTransceiver 549.

Checks

forge test: 796 passed, 1 skipped (the fork test). forge lint -D notes and FOUNDRY_PROFILE=lint-src forge lint -D notes src are clean. forge build --sizes src is under EIP-170.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

It rewrites origin-authentication across six provider bindings and alters write-once counterpart/peer invariants and the receiver storage layout, which is security-critical and warrants final human review despite no defects being found.

0 open findings

What changed in this PR

This PR applies fixes from a KupiaSec (Nordin Sabli) security review of the EVM messaging layer, hardening origin authentication and write-once configuration. It is central to the protocol's cross-chain trust model: it closes paths by which a compromised transceiver owner or a provider's deploy key could repoint a live lane or forge another account's payloads.

Changes:

• #61 (receiver home origin): ReceiverBase gains a write-once homeOrigin and _onMessageFrom(origin, sender, payload) that rejects any origin but the account's home. Each native binding now reports the origin in its transport's own naming (CCIP selector, Hyperlane domain, Wormhole emitter chain, interop source chain id, LZ eid, op-stack messenger), and each transceiver arms the receiver with the matching value.
• #60 (counterpart parity): setCounterpart/resolveCounterpart now share _recordCounterpart, which refuses a non-parity address on a Predetermined chain (CounterpartNotParity).
• #62 (LayerZero peer): LzTransceiver.setPeer refuses any peer other than the counterpart on the eid's chain; deploy order updated so the peer is set after the counterpart.

File	Description
src/​messaging/​inbound/​ReceiverBase.sol	Adds homeOrigin, NotHomeOrigin/ZeroHomeOrigin; folds origin check into _onMessageFrom; new initializer arg
src/​messaging/​transceiver/​TransceiverBase.sol	New _recordCounterpart with parity guard; arms receiver with homeChainKey
src/​protocols/​ProviderTransceiver.sol	Overrides _accountInitializer to arm a receiver with the home's provider id
src/​protocols/​{ccip,hyperlane}/​*DivergentTransceiver.sol	Diamond-resolving _accountInitializer overrides
src/​protocols/​op-stack/​OpStackInteropTransceiver.sol, OpStackInteropReceiver.sol, OpStackReceiver.sol	Arm/report origin by source chain id / messenger
src/​protocols/​{ccip,hyperlane,wormhole}/​*Receiver.sol	Report origin alongside sender in delivery callbacks
src/​protocols/​layerzero/​{LzTransceiver,LzReceiver}.sol	setPeer counterpart check; receiver armed/report by eid
src/​messaging/​DeliveryGas.sol, docs/​*, deploy/​{README,CHECKS}.md	Updated gas figures, procedure, and spec/research/todo prose
test/​**	Updated fixtures/initializers; new tests for parity, home-origin, peer-counterpart, and the #63 refund-address regression

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.