Address CR comments

Author: shahthepro

contracts/contracts/strategies/BridgedWOETHMigrationStrategy.sol

@@ -9,8 +9,6 @@ import { Client } from "@chainlink/contracts-ccip/src/v0.8/ccip/libraries/Client
 
 import { BridgedWOETHStrategy } from "./BridgedWOETHStrategy.sol";
 import { IStrategy } from "../interfaces/IStrategy.sol";
-import { IVault } from "../interfaces/IVault.sol";
-import { NativeFeeHelper } from "./crosschainV3/libraries/NativeFeeHelper.sol";
 import { CCIPMessageBuilder } from "./crosschainV3/libraries/CCIPMessageBuilder.sol";
 
 /**
@@ -22,16 +20,15 @@ import { CCIPMessageBuilder } from "./crosschainV3/libraries/CCIPMessageBuilder.
  *         retaining V1's local deposit/withdraw + oracle pipeline (inherited unchanged).
  *
  *         Storage carries forward V1's two existing fields (lastOraclePrice, maxPriceDiffBps)
- *         and appends three new ones (totalBridged, maxPerBridge, operator) plus an upgrade
+ *         and appends two new ones (totalBridged, maxPerBridge) plus an upgrade
  *         gap. All cross-chain configuration that doesn't change between deploys lives in
  *         immutables: `master` is both the local Master strategy on Base (read for
  *         in-flight reconciliation) and the cross-chain CCIP recipient on Ethereum (same
  *         address by CreateX-driven parity).
  *
  *         Access pattern:
- *           - `bridgeToRemote` callable by operator, governor, or strategist.
+ *           - `bridgeToRemote` callable by governor or strategist.
  *           - `setMaxPerBridge` callable by governor or strategist.
- *           - `setOperator` callable by governor only.
  *           - V1's `setMaxPriceDiffBps` (governor-only) and depositBridgedWOETH /
  *             withdrawBridgedWOETH (governor or strategist) are inherited unchanged.
  */
@@ -59,15 +56,11 @@ contract BridgedWOETHMigrationStrategy is BridgedWOETHStrategy {
     /// @notice Per-call cap on `bridgeToRemote`, configurable by governor or strategist.
     uint256 public maxPerBridge;
 
-    /// @notice Automation EOA permitted to drive `bridgeToRemote` calls.
-    address public operator;
-
-    uint256[47] private __gap;
+    uint256[48] private __gap;
 
     // --- Events -----------------------------------------------------------
 
     event MaxPerBridgeSet(uint256 maxPerBridge);
-    event OperatorUpdated(address oldOperator, address newOperator);
     event WOETHBridgedToRemote(uint256 amount, uint256 totalBridged);
 
     // --- Errors -----------------------------------------------------------
@@ -101,24 +94,7 @@ contract BridgedWOETHMigrationStrategy is BridgedWOETHStrategy {
         ccipChainSelectorMainnet = _ccipChainSelectorMainnet;
     }
 
-    // --- Access control ---------------------------------------------------
-
-    modifier onlyOperatorGovernorOrStrategist() {
-        require(
-            msg.sender == operator ||
-                isGovernor() ||
-                msg.sender == IVault(vaultAddress).strategistAddr(),
-            "BWM: not authorised"
-        );
-        _;
-    }
-
-    // --- Operator / cap configuration ------------------------------------
-
-    function setOperator(address _operator) external onlyGovernor {
-        emit OperatorUpdated(operator, _operator);
-        operator = _operator;
-    }
+    // --- Cap configuration ------------------------------------------------
 
     function setMaxPerBridge(uint256 _maxPerBridge)
         external
@@ -147,7 +123,7 @@ contract BridgedWOETHMigrationStrategy is BridgedWOETHStrategy {
     function bridgeToRemote(uint256 _amount)
         external
         payable
-        onlyOperatorGovernorOrStrategist
+        onlyGovernorOrStrategist
         nonReentrant
     {
         require(_amount > 0 && _amount <= maxPerBridge, "BWM: bad amount");
@@ -169,7 +145,7 @@ contract BridgedWOETHMigrationStrategy is BridgedWOETHStrategy {
         );
 
         uint256 fee = ccipRouter.getFee(ccipChainSelectorMainnet, ccipMessage);
-        NativeFeeHelper.consume(fee);
+        _consumeNativeFee(fee);
 
         IERC20(address(bridgedWOETH)).safeApprove(address(ccipRouter), _amount);
         ccipRouter.ccipSend{ value: fee }(
@@ -183,6 +159,23 @@ contract BridgedWOETHMigrationStrategy is BridgedWOETHStrategy {
 
     receive() external payable {}
 
+    /// @dev Consume `fee` in native for the CCIP send. Two sources:
+    ///        - `msg.value == 0` → pre-funded: `address(this).balance` covers the fee.
+    ///        - `msg.value > 0`  → user-paid: excess refunds to `msg.sender`.
+    ///      Reverts when the chosen source doesn't cover `fee`.
+    function _consumeNativeFee(uint256 fee) internal {
+        if (msg.value == 0) {
+            require(address(this).balance >= fee, "Fee: unfunded");
+            return;
+        }
+        require(msg.value >= fee, "Fee: insufficient");
+        if (msg.value > fee) {
+            // slither-disable-next-line low-level-calls
+            (bool ok, ) = msg.sender.call{ value: msg.value - fee }("");
+            require(ok, "Fee: refund failed");
+        }
+    }
+
     // --- checkBalance override (WETH-only accounting) --------------------
 
     /**

contracts/contracts/strategies/crosschainV3/DESIGN.md

@@ -457,7 +457,9 @@ The manual burn-relay in `relay()` works on both V2.0 and V2.1. But
 `CCTPAdapter._quoteFee` calls `tokenMessenger.getMinFeeAmount(amount)`,
 which is V2.1-only. If a chain has only V2.0 deployed, `quoteFee(amount > 0)`
 reverts. Current deploys (OETHb) don't use CCTP at all, so this is a
-non-issue. OUSD V3 spoke chains must be on V2.1 — check before deploying.
+non-issue. OUSD V3 spoke chains must be on V2.1 — check before deploying
+against Circle's per-chain contract list:
+https://developers.circle.com/stablecoins/evm-smart-contracts
 
 ### 4.4 Lost claim-ack stalls `pendingWithdrawalAmount`
 

contracts/contracts/strategies/crosschainV3/MasterWOTokenStrategy.sol

@@ -59,6 +59,7 @@ contract MasterWOTokenStrategy is AbstractWOTokenStrategy {
 
     event RemoteStrategyBalanceUpdated(uint256 yieldBaseline);
     event DepositRequested(uint64 nonce, uint256 amount);
+    event DepositSkipped(uint256 amount, uint256 minTransfer);
     event DepositAcked(uint64 nonce, uint256 yieldBaseline);
     event WithdrawRequested(uint64 nonce, uint256 amount);
     event WithdrawRequestAcked(uint64 nonce, uint256 yieldBaseline);
@@ -332,11 +333,17 @@ contract MasterWOTokenStrategy is AbstractWOTokenStrategy {
         // transfers it before calling `deposit`) and stays counted in `checkBalance`, so it
         // auto-deposits once enough accumulates. A revert here would DoS the mint ->
         // `_allocate` -> `deposit` path. Covers both `deposit` and `depositAll`.
-        if (_amount < IBridgeAdapter(outboundAdapter).minTransferAmount()) {
+        uint256 minTransfer = IBridgeAdapter(outboundAdapter)
+            .minTransferAmount();
+        if (_amount < minTransfer) {
+            // Signal the skipped deposit so off-chain monitoring can see the amount stayed
+            // local (still counted in `checkBalance`) instead of being silently dropped.
+            emit DepositSkipped(_amount, minTransfer);
             return;
         }
 
         uint64 nonce = _getNextYieldNonce();
+        // Store the pending deposit amount until the remote deposit is acknowledged.
         pendingDepositAmount = _amount;
 
         // bridgeAsset → outboundAdapter allowance is granted once in `_setOutboundAdapter`.
@@ -390,6 +397,7 @@ contract MasterWOTokenStrategy is AbstractWOTokenStrategy {
         );
 
         uint64 nonce = _getNextYieldNonce();
+        // Store the pending withdrawal amount until the remote withdrawal is claimed.
         pendingWithdrawalAmount = _amount;
 
         bytes memory payload = CrossChainV3Helper.encodeUint256(_amount);
@@ -540,6 +548,7 @@ contract MasterWOTokenStrategy is AbstractWOTokenStrategy {
     function _processDepositAck(uint64 nonce, bytes memory payload) internal {
         _markYieldNonceProcessed(nonce);
         uint256 yieldBaseline = CrossChainV3Helper.decodeUint256(payload);
+        // Store the acknowledged deposit in the remote balance and clear the pending amount.
         remoteStrategyBalance = yieldBaseline;
         pendingDepositAmount = 0;
         emit DepositAcked(nonce, yieldBaseline);

contracts/contracts/strategies/crosschainV3/README.md

@@ -42,7 +42,6 @@ contracts/strategies/crosschainV3/adapters/
 contracts/strategies/crosschainV3/libraries/
   CCTPMessageHelper.sol   — CCTP V2 wire-format decoder: transport header + burn-message body
   CCIPMessageBuilder.sol  — shared CCIP `Client.EVM2AnyMessage` construction
-  NativeFeeHelper.sol     — shared native-fee consumption helper
 
 contracts/proxies/create2/
   CrossChainStrategyProxy.sol — Master/Remote strategy proxy (CreateX/CREATE2-deployable for peer parity)

contracts/contracts/strategies/crosschainV3/RemoteWOTokenStrategy.sol

@@ -447,12 +447,11 @@ contract RemoteWOTokenStrategy is AbstractWOTokenStrategy {
     }
 
     function _opportunisticClaim() internal {
-        uint256 stored = outstandingRequestId;
-        if (stored == REQUEST_ID_EMPTY) {
+        // `outstandingRequestId` stores the vault id verbatim.
+        uint256 vaultRequestId = outstandingRequestId;
+        if (vaultRequestId == REQUEST_ID_EMPTY) {
             return;
         }
-        // `outstandingRequestId` stores the vault id verbatim.
-        uint256 vaultRequestId = stored;
         // Hoist `claimed` outside the try so its scope is unambiguous to static
         // analysers (avoids the slither uninitialized-local false-positive that
         // fired when `claimed` was named only in the try-returns clause).

contracts/contracts/strategies/crosschainV3/adapters/CCIPAdapter.sol

@@ -37,6 +37,11 @@ contract CCIPAdapter is AbstractAdapter, IAny2EVMMessageReceiver, IERC165 {
         ccipRouter = _ccipRouter;
     }
 
+    /// @dev Inbound liveness: if the CCIP DON never auto-executes a delivered message, anyone can
+    ///      trigger manual execution. That path still runs `OffRamp.manuallyExecute` ->
+    ///      `Router.routeMessage` -> `ccipReceive`, so `msg.sender` is the Router here even on a
+    ///      manual replay and this guard passes — no governance escape hatch is needed.
+    ///      https://docs.chain.link/ccip/tutorials/evm/manual-execution#trigger-manual-execution
     modifier onlyRouter() {
         require(msg.sender == address(ccipRouter), "CCIP: not router");
         _;

contracts/contracts/strategies/crosschainV3/libraries/NativeFeeHelper.sol

@@ -67,17 +67,13 @@ module.exports = deployOnBase(
           args: [dMigrationImpl.address],
         },
         // 2. Set the per-call cap. (Governor-or-strategist gate; runs as governance here.)
+        // `bridgeToRemote` is governor-or-strategist gated, so the strategist can drive it
+        // directly — no separate operator authorisation needed.
         {
           contract: cMigration,
           signature: "setMaxPerBridge(uint256)",
           args: [MAX_PER_BRIDGE],
         },
-        // 3. Authorise the multichain strategist as the operator for `bridgeToRemote`.
-        {
-          contract: cMigration,
-          signature: "setOperator(address)",
-          args: [addresses.multichainStrategist],
-        },
       ],
     };
   }

contracts/deploy/base/102_oethb_v3_woeth_v2_upgrade.js

@@ -525,7 +525,10 @@ describe("Unit: Adapter transfer caps", function () {
       await bridgeAsset.mintTo(master.address, ONE_K.div(2)); // 500
       await outbound.setMinTransferAmountOverride(ONE_K); // floor 1000
 
-      await mockL2Vault.callDepositAll(master.address);
+      // Signals the skip so it isn't silently dropped.
+      await expect(mockL2Vault.callDepositAll(master.address))
+        .to.emit(master, "DepositSkipped")
+        .withArgs(ONE_K.div(2), ONE_K);
 
       // Nothing bridged; funds stay local and are still counted in checkBalance.
       expect(await outbound.lastAmountSent()).to.equal(0);
@@ -542,11 +545,15 @@ describe("Unit: Adapter transfer caps", function () {
       await bridgeAsset.mintTo(master.address, ONE_K.div(2)); // 500
       await outbound.setMinTransferAmountOverride(ONE_K); // floor 1000
 
-      await mockL2Vault.callDeposit(
-        master.address,
-        bridgeAsset.address,
-        ONE_K.div(2)
-      );
+      await expect(
+        mockL2Vault.callDeposit(
+          master.address,
+          bridgeAsset.address,
+          ONE_K.div(2)
+        )
+      )
+        .to.emit(master, "DepositSkipped")
+        .withArgs(ONE_K.div(2), ONE_K);
 
       expect(await master.pendingDepositAmount()).to.equal(0);
       expect(await bridgeAsset.balanceOf(master.address)).to.equal(