Security and Compliance

Multi-Asset OFT shares the same security foundations as Stablecoin OFT — OpenZeppelin audited upgradeable libraries, EIP-7201 namespaced storage, two-step admin transfer, and push-based fee settlement. Multi-Asset OFT contracts are independently audited. This page focuses on threats and mitigations specific to the Multi-Asset OFT architecture.

Multi-Asset OFT Threat Model

Threat	Impact	Mitigation
Module swap to malicious contract	Attacker-controlled module could disable pause, zero out fees, or remove rate limits	Only `DEFAULT_ADMIN_ROLE` can call `setPauseModule` / `setFeeConfigModule` / `setRateLimiterModule`. Use governance multisig for admin.
Shared rate limit exhaustion	One high-volume token could exhaust the rate limit bucket for all tokens on a destination	Token scales convert amounts to a common unit. Set scales appropriately. Monitor bucket utilization per EID.
Token registration of malicious OFT	Rogue OFT could execute mint calls for its token in different chains	Token registration is the Multi-Asset OFT equivalent of peer setting in OFTs — a critical trust boundary. `TOKEN_REGISTRAR_ROLE` should be held by a trusted operator, not a hot wallet.
Deregistered token with inflight messages	Inbound messages for a deregistered token will revert, blocking the channel	Pause outbound transfers for the token via the NexusPauseModule, wait until all inflight messages have been delivered and processed, then deregister.
Blocked inbound nonce	Receives on that path pause until the nonce is handled (affects all tokens on the hub path)	Assign messaging channel roles to ops wallets so they can `skip` / `nilify` / `clear` / `burn` without the admin delegate.

Shared Threat Model

The following threats and mitigations are shared with Stablecoin OFT:

Pauser / Unpauser key compromise — Same split-role mitigation. See Stablecoin OFT Security.
Fee deposit address compromise — Same push-based model. Attacker controlling feeDeposit can only receive fees, not extract principal.
Supply inflation via misconfigured deployment — Ensure each NexusERC20 grants MINTER_ROLE/BURNER_ROLE only to the intended burner-minter address.
Fund recovery abuse — Same recoverFunds restriction: only from non-allowlisted addresses.
Non-atomic proxy deployment — Same risk. Deploy proxy and call initialize atomically.

Compliance Controls

Allowlist (via NexusERC20Guard)

The shared guard enforces allowlist and pause checks on transfer, transferFrom, mint, and burn for all registered NexusERC20 tokens. Mode switches (Open → Blacklist → Whitelist) are instant and do not clear existing lists.

Credit Redirect for Non-Allowlisted Recipients

setCreditRedirectConfig on Nexus redirects inbound credits for non-allowlisted recipients to an escrow address and emits CreditRedirected. When redirected, the credited amount reported to NexusOFT / compose is 0. When redirect is disabled, those credits follow normal guard allowlist and pause rules on mint. Messaging channel roles (nilify / skip) can clear paths that fail or should be ignored.

Per-Token Pause (via NexusERC20Guard)

Each NexusERC20 can be paused independently using uint160(tokenAddress) as the pause ID. This allows freezing a specific token’s local transfers without affecting other tokens.

Per-Pathway Pause (via NexusPauseModule)

Cross-chain sends can be paused at four levels: globally, per destination, per token, or per (token, destination) pair. Priority resolution determines the effective state.

Fund Recovery

Same mechanism as Stablecoin OFT — admin can transfer tokens from non-allowlisted addresses for compliance seizures.

Monitoring

Events to monitor across the Multi-Asset OFT deployment:

Event	Source	Indicates
`RoleGranted` / `RoleRevoked`	All contracts	Permission changes
`DefaultAdminTransferScheduled`	All with 2-step	Admin transfer initiated
`PauseModuleSet` / `FeeConfigModuleSet` / `RateLimiterModuleSet`	Nexus	Module swap (high severity)
`TokenRegistered` / `TokenDeregistered`	Nexus	Token registry changes
`FeeConfigSet`	Fee Module	Fee rate changes
`PauseConfigSet`	Pause Module	Pathway pause state changes
`RateLimitConfigSet` / `RateLimitStateSet`	Rate Limiter Module	Rate limit config changes
`OFTSent` / `OFTReceived`	`NexusOFT`	Cross-chain transfers (alert on large amounts)
`GuardSet`	`NexusERC20`	Guard contract swap (high severity)
`AllowlistModeChanged`	Guard	Allowlist mode transitions
`BlacklistUpdated` / `WhitelistUpdated`	Guard	Address list changes
`CreditRedirectConfigSet` / `CreditRedirected`	Nexus	Escrow redirect config or inbound credit redirect

Next Steps

RBAC Reference for the complete role-to-function matrix
Architecture for the system design overview

LayerZero for EVM

Contract Standards

Stablecoin OFT

Multi-Asset OFT

Technical Reference

Troubleshooting

Resources

Security and Compliance

Multi-Asset OFT Threat Model

Shared Threat Model

Compliance Controls

Allowlist (via NexusERC20Guard)

Credit Redirect for Non-Allowlisted Recipients

Per-Token Pause (via NexusERC20Guard)

Per-Pathway Pause (via NexusPauseModule)

Fund Recovery

Monitoring

Next Steps

​Multi-Asset OFT Threat Model

​Shared Threat Model

​Compliance Controls

​Allowlist (via NexusERC20Guard)

​Credit Redirect for Non-Allowlisted Recipients

​Per-Token Pause (via NexusERC20Guard)

​Per-Pathway Pause (via NexusPauseModule)

​Fund Recovery

​Monitoring

​Next Steps

Multi-Asset OFT Threat Model

Shared Threat Model

Compliance Controls

Allowlist (via NexusERC20Guard)

Credit Redirect for Non-Allowlisted Recipients

Per-Token Pause (via NexusERC20Guard)

Per-Pathway Pause (via NexusPauseModule)

Fund Recovery

Monitoring

Next Steps