Bug fixes

Author: shahthepro

contracts/contracts/strategies/crosschainV3/adapters/CCTPAdapter.sol

@@ -208,18 +208,17 @@ contract CCTPAdapter is AbstractAdapter, IMessageHandlerV2 {
         bytes calldata attestation
     ) internal {
         (
-            address burnToken,
+            ,
             address mintRecipient,
             uint256 amount,
             address msgSender,
             uint256 feeExecuted,
             bytes memory hookData
         ) = CCTPMessageHelper.decodeBurnBody(body);
-        // `burnToken` is the SOURCE-chain USDC address, which differs from this chain's
-        // `usdcToken` for cross-chain transfers. CCTP's MessageTransmitter validates the
-        // burn record cryptographically via the attestation; what gets minted here is
-        // always the local USDC by protocol design. So no local burnToken equality check.
-        burnToken; // silence unused-var
+        // The source-chain burn token is intentionally not extracted or checked: it's the
+        // SOURCE-chain USDC address (differs from this chain's `usdcToken` for cross-chain
+        // transfers), CCTP's MessageTransmitter validates the burn record cryptographically via
+        // the attestation, and what gets minted here is always the local USDC by protocol design.
         // The burn branch skips the pure-message branch's `transportRecipient` parity check,
         // so enforce mint-recipient parity here: a forged burn that mints elsewhere reverts
         // cleanly instead of silently delivering 0.

contracts/contracts/strategies/crosschainV3/adapters/SuperbridgeAdapter.sol

@@ -278,6 +278,14 @@ contract SuperbridgeAdapter is
     function processStoredMessage(address _target) external override {
         PendingMessage memory p = pendingFor[_target];
         require(p.exists, "Super: nothing pending");
+        // Re-assert the incident-response levers on the deferred path too. The atomic path
+        // gates on these in `_validateInbound`; a `pauseLane`/`revoke` issued after the message
+        // was stored must block deferred delivery as well, otherwise the pause is ineffective
+        // for exactly the split-delivery window it exists to cover. Check `authorised` first —
+        // `revoke` leaves `paused` untouched. A held slot isn't dropped: its WETH stays on the
+        // adapter until unpause / re-authorise (recoverable via `transferToken`).
+        require(authorised[_target], "Super: not authorised");
+        require(!laneConfig[_target].paused, "Super: lane paused");
         require(
             IERC20(weth).balanceOf(address(this)) >= p.intendedAmount,
             "Super: tokens not yet landed"

contracts/test/strategies/crosschainV3/split-inbound-adapter.js

@@ -239,6 +239,49 @@ describe("Unit: SuperbridgeAdapter split delivery", function () {
     expect(await strategy.callCount()).to.equal(1);
   });
 
+  it("stored message honours a pause/revoke issued after it was stored (incident response)", async () => {
+    const amount = ethers.utils.parseUnits("250", 6);
+    const data = wrapEnvelope(strategy.address, amount, packPayload("pending"));
+    const sRouter = await impersonateAndFund(await receiver.ccipRouter());
+
+    // Message stored while the lane is healthy (token leg not yet landed).
+    await receiver
+      .connect(sRouter)
+      .ccipReceive(
+        buildAny2EvmMessage({ data, transportSender: receiver.address })
+      );
+    expect(await receiver.hasPendingMessage(strategy.address)).to.equal(true);
+
+    // Canonical-bridge ETH lands and `receive()` wraps it to WETH.
+    await deliverBridgeEth(amount);
+
+    // Incident: governance pauses the lane. Deferred delivery must be blocked too, not just
+    // the atomic ccipReceive path.
+    await receiver.connect(governor).pauseLane(strategy.address);
+    await expect(
+      receiver.processStoredMessage(strategy.address)
+    ).to.be.revertedWith("Super: lane paused");
+
+    // Revoke leaves `paused` untouched, so this exercises the `authorised` check.
+    await receiver.connect(governor).unpauseLane(strategy.address);
+    await receiver.connect(governor).revoke(strategy.address);
+    await expect(
+      receiver.processStoredMessage(strategy.address)
+    ).to.be.revertedWith("Super: not authorised");
+
+    // The message + its WETH were held, not lost: re-authorise + unpause and delivery resumes.
+    await receiver.connect(governor).authorise(strategy.address, {
+      paused: false,
+      chainSelector: PEER_CHAIN,
+      destGasLimit: DEST_GAS_LIMIT,
+    });
+    await receiver.processStoredMessage(strategy.address);
+    expect(await receiver.hasPendingMessage(strategy.address)).to.equal(false);
+    expect(await strategy.callCount()).to.equal(1);
+    expect(await strategy.lastAmount()).to.equal(amount);
+    expect(await wethMock.balanceOf(strategy.address)).to.equal(amount);
+  });
+
   it("multi-tenant: one adapter routes messages to distinct targets by envelope sender", async () => {
     const cfg = {
       paused: false,