Infinifi Shorttimelock - 23/09/2026 13:06 - LOW

Regenerated report. This replaces the original HIGH-rated analysis (revision 1). It was produced by the updated pipeline (yearn/monitoring#378), which simulates the batch in execution order (Tenderly bundle from the timelock) and adds verified Outland context: farm type, oracle price, PortalHub chain registry and connector route status. Key corrections: call 3 (OutlandFarm.setVault) succeeds in batch order (it only reverted when simulated alone); the chain-143 USDC route is not live after this batch, because the connector's peer and gas limit are unset until a later setConfiguration; and cctpDomainConfigured is a bool.

• Protocol: infinifi
• Contract: Infinifi Shorttimelock — 0x4B174afbeD7b98BA01F50E36109EEE5e6d327c32
• Chain: Mainnet (chain id 1)
• Risk: LOW

Summary

Sets oracle for OutlandVault OV-143 to a fixed-price oracle at 1:1. Registers OV-143 as the vault for new chain 143 on PortalHub. Links vault to OutlandFarm and registers OutlandFarm as a maturity farm. Adds CCTP-Chainlink connector and enables USDC bridging for chain 143. Maps hub USDC to an outpost token. Sets CCTP domain 15 for chain 143. Bridging is not yet live (missing peer and gas limit). This is a standard new-chain onboarding with no immediate fund movement.

Analysis

Detailed Analysis: Chain 143 Onboarding Batch

This batch of eight governance calls configures the Infinifi protocol to support a new destination chain (chain ID 143) and its associated OutlandVault (OV-143). All calls are authorized by the PROTOCOL_PARAMETERS or ORACLE_MANAGER roles, which are held by the timelock. No tokens are moved; the actions are purely administrative registrations. Bridging to chain 143 is not yet functional — a separate setConfiguration call is required to set the peer, gas limit, and selector on the connector.

1. Oracle Registration

Contract: 0x7A5C5dbA4fbD0e1e1A2eCDBe752fAe55f6E842B3 (Accounting)
Function: setOracle(address _asset, address _oracle)
Parameters:

• _asset: 0x77776F422B7EB0A95ccD35fBd088A5957D4408eA (OutlandVault OV-143)
• _oracle: 0x168DF792845BA1bd80d485399de63a4110b03242 (FixedPriceOracle)

State change:

• Before: oracle(OV-143) = 0x000...000 (not set)
• After: oracle(OV-143) = FixedPriceOracle

Significance: The FixedPriceOracle returns price() = 1e18, meaning 1 whole OV-143 token (18 decimals) is valued at 1 reference unit (likely 1 USD, given the protocol’s standard). This is a common setup for vault shares that are intended to be redeemable at a fixed 1:1 ratio to the underlying asset. No ability to change the price dynamically; if the vault’s actual value deviates (e.g., due to yield or loss), this oracle will produce an incorrect valuation. However, as a new chain onboarding, this is a standard low-risk parameter until the vault is active.

Event emitted: OracleSet

2. PortalHub Vault Registration

Contract: 0x13025F34C1ec2A16bF68f3a3c4e986a3E85CED61 (PortalHub)
Function: setVault(address _vault)
Parameter: _vault = 0x77776F422B7EB0A95ccD35fBd088A5957D4408eA (OV-143)

State change:

• Before: PortalHub had no vault registered for chain 143 (only chain 8453 existed).
• After: Chain 143 is now mapped to vault OV-143.

Significance: This is the core onboarding step — the PortalHub now recognizes chain 143 and its vault contract. Without this, no cross-chain messages could be routed to that chain.

Event emitted: VaultSet

3. OutlandFarm Vault Assignment

Contract: 0xA7c1DAEAA5D97e1319B4Ff6Cdf658F5C4582A27E (OutlandFarm)
Function: setVault(address _vault)
Parameter: _vault = 0x77776F422B7EB0A95ccD35fBd088A5957D4408eA (OV-143)

State change:

• Before: OutlandFarm’s vault = 0x000...000 (not set)
• After: vault = OV-143

Significance: This links the OutlandFarm contract to the vault. The farm uses the vault’s shares to track deposits. Setting it from zero to an address is a one-time initialization; the natspec warns that changing it later requires zeroing all vault shares.

Events emitted: AssetEnabled (for the vault token) and VaultSet

4. Farm Registry – Adding Maturity Farm

Contract: 0xF5f2718708f471e43968271956CC01aaA8c46119 (FarmRegistry)
Function: addFarms(uint256 _type, address[] _list)
Parameters:

• _type: 2 (FarmTypes.MATURITY)
• _list: 0xA7c1DAEAA5D97e1319B4Ff6Cdf658F5C4582A27E

State change: The OutlandFarm is now registered as a type 2 (maturity) farm. Maturity farms lock principal until a fixed maturity date, meaning depositors cannot withdraw early. This is an illiquid product. No existing farm of this type is replaced.

Event emitted: FarmsAdded

5. Connector Authorization

Contract: 0x13025F34C1ec2A16bF68f3a3c4e986a3E85CED61 (PortalHub)
Function: addConnector(address _connector)
Parameter: _connector = 0x3373784A7a52A07F9339aA8F60403420cC602c52 (ConnectorCCTP_Chainlink)

State change: The CCTP-Chainlink connector is now a whitelisted bridge adapter for the PortalHub. Without this, cross-chain messages could not be sent through this connector.

Event emitted: ConnectorAdded

6. Enable USDC for CCTP Bridging to Chain 143

Contract: 0x3373784A7a52A07F9339aA8F60403420cC602c52 (ConnectorCCTP_Chainlink)
Function: enableChainAsset(uint256 _chainId, address _chainAsset)
Parameters:

• _chainId: 143
• _chainAsset: 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 (USDC, 6 decimals)

State change: The connector now allows CCTP transfers of USDC to chain 143. This is a prerequisite for bridging; however, the route is still broken because no peer address, gas limit, or CCIP selector has been set for chain 143 on this connector (confirmed by Protocol Context: sendTokens would revert with MissingPeer).

Event emitted: AssetEnabled

7. Asset Mapping (Hub → Outpost)

Contract: 0x13025F34C1ec2A16bF68f3a3c4e986a3E85CED61 (PortalHub)
Function: setAssetMapping(uint256 _chainId, address _hubAsset, address _outpostAsset)
Parameters:

• _chainId: 143
• _hubAsset: 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 (USDC)
• _outpostAsset: 0x754704Bc059F8C67012fEd69BC8A327a5aafb603

State change: A bidirectional mapping is created: on chain 143, the outpost token 0x754704... is the equivalent of hub USDC. This allows the portal to translate asset addresses when routing deposits/withdrawals. The outpost token’s identity is not resolved by the provided context; it is presumably a bridged USDC representation or a local ERC20.

Event emitted: AssetMappingSet

8. CCTP Domain Registration

Contract: 0x3373784A7a52A07F9339aA8F60403420cC602c52 (ConnectorCCTP_Chainlink)
Function: setCctpDomain(uint256 _chainId, uint32 _domain)
Parameters:

• _chainId: 143
• _domain: 15

State change:

• Before: cctpDomains(143) = 0, cctpDomainConfigured(143) = False
• After: cctpDomains(143) = 15, cctpDomainConfigured(143) = True

Significance: Domain 15 is the official Circle CCTP domain for the destination chain (likely Arbitrum or a similar L2). Setting this is mandatory for CCTP bridging. The sentinel boolean prevents confusion with the default domain 0 (used by Ethereum).

Event emitted: CctpDomainSet

Risk Assessment

LOW – This is a standard new-chain onboarding batch. Key points:

• No funds are moved in this transaction.
• No roles are granted (the calls use existing PROTOCOL_PARAMETERS and ORACLE_MANAGER roles already held by the timelock).
• Bridging is not yet live – the CCTP connector lacks the peer address and gas limit configuration required to actually send tokens (confirmed by Protocol Context). A subsequent setConfiguration call will be needed.
• Oracle is fixed at 1:1, which is acceptable for a still-inactive vault but could misprice assets if the vault accumulates yield or incurs losses.
• Farm type MATURITY means deposits will be locked until maturity, which is a product design choice, not an immediate security risk.

The only concern is the fixed price oracle; once the vault becomes active, governance should update it to a proper price feed if the vault’s value diverges from the underlying. For now, this is a routine deployment with no exposed attack surface.

Call Flow

From: 0x4B174afbeD7b98BA01F50E36109EEE5e6d327c32

1. setOracle(address,address) on 0x7A5C5dbA4fbD0e1e1A2eCDBe752fAe55f6E842B3 (Accounting)

   • address _asset: 0x77776F422B7EB0A95ccD35fBd088A5957D4408eA (OutlandVault (OV-143, 18 dec))
   • address _oracle: 0x168DF792845BA1bd80d485399de63a4110b03242 (FixedPriceOracle)
   • Batch simulation: SUCCESS, gas 54,064 (run in batch order on the state left by the preceding calls)

2. setVault(address) on 0x13025F34C1ec2A16bF68f3a3c4e986a3E85CED61 (PortalHub)

   • address _vault: 0x77776F422B7EB0A95ccD35fBd088A5957D4408eA (OutlandVault (OV-143, 18 dec))
   • Batch simulation: SUCCESS, gas 111,351 (run in batch order on the state left by the preceding calls)

3. setVault(address) on 0xA7c1DAEAA5D97e1319B4Ff6Cdf658F5C4582A27E (OutlandFarm)

   • address _vault: 0x77776F422B7EB0A95ccD35fBd088A5957D4408eA (OutlandVault (OV-143, 18 dec))
   • Batch simulation: SUCCESS, gas 114,803 (run in batch order on the state left by the preceding calls)

4. addFarms(uint256,address[]) on 0xF5f2718708f471e43968271956CC01aaA8c46119 (FarmRegistry)

   • uint256 _type: 2
   • address[] _list:
     • 0xA7c1DAEAA5D97e1319B4Ff6Cdf658F5C4582A27E (OutlandFarm)
   • Batch simulation: SUCCESS, gas 239,157 (run in batch order on the state left by the preceding calls)

5. addConnector(address) on 0x13025F34C1ec2A16bF68f3a3c4e986a3E85CED61 (PortalHub)

   • address _connector: 0x3373784A7a52A07F9339aA8F60403420cC602c52 (ConnectorCCTP_Chainlink)
   • Batch simulation: SUCCESS, gas 85,734 (run in batch order on the state left by the preceding calls)

6. enableChainAsset(uint256,address) on 0x3373784A7a52A07F9339aA8F60403420cC602c52 (ConnectorCCTP_Chainlink)

   • uint256 _chainId: 143
   • address _chainAsset: 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 (Circle: USDC Token (USDC, 6 dec))
   • Batch simulation: SUCCESS, gas 98,303 (run in batch order on the state left by the preceding calls)

7. setAssetMapping(uint256,address,address) on 0x13025F34C1ec2A16bF68f3a3c4e986a3E85CED61 (PortalHub)

   • uint256 _chainId: 143
   • address _hubAsset: 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 (Circle: USDC Token (USDC, 6 dec))
   • address _outpostAsset: 0x754704Bc059F8C67012fEd69BC8A327a5aafb603
   • Batch simulation: SUCCESS, gas 193,660 (run in batch order on the state left by the preceding calls)

8. setCctpDomain(uint256,uint32) on 0x3373784A7a52A07F9339aA8F60403420cC602c52 (ConnectorCCTP_Chainlink)

   • uint256 _chainId: 143
   • uint32 _domain: 15
   • Batch simulation: SUCCESS, gas 75,593 (run in batch order on the state left by the preceding calls)

Current State

• On 0x7A5C5dbA4fbD0e1e1A2eCDBe752fAe55f6E842B3 (Accounting):
  • oracle(0x77776F422B7EB0A95ccD35fBd088A5957D4408eA (OutlandVault (OV-143, 18 dec))) = 0x0000000000000000000000000000000000000000 (mapping(address => address))
• On 0xA7c1DAEAA5D97e1319B4Ff6Cdf658F5C4582A27E (OutlandFarm):
  • vault = 0x0000000000000000000000000000000000000000 (address)
• On 0x3373784A7a52A07F9339aA8F60403420cC602c52 (ConnectorCCTP_Chainlink):
  • cctpDomains(143) = 0 (mapping(uint256 => uint32))
  • cctpDomainConfigured(143) = False (mapping(uint256 => bool))

Protocol Context

• Oracle price: 0x168DF792845BA1bd80d485399de63a4110b03242 (FixedPriceOracle) reports 1000000000000000000 → one whole OV-143 = 1 reference units (USDC ≈ 1)
• PortalHub vault for chain 143: new chain, no vault replaced; chains registered before: 8453
• Farm type 2: FarmTypes.MATURITY — illiquid: principal is locked until the farm's maturity (0xF5f2718708f471e43968271956CC01aaA8c46119 (FarmRegistry) addFarms)
• Connector route to chain 143 (0x3373784A7a52A07F9339aA8F60403420cC602c52 (ConnectorCCTP_Chainlink)): not configured — sends revert until a later setConfiguration sets the peer

Reference