@hyperlane-xyz/sdk 41.3.1 → 43.0.0

package/dist/token/deploy.hardhat-test.js

@@ -1,22 +1,26 @@
 import { expect } from 'chai';
 import { ethers } from 'ethers';
 import hre from 'hardhat';
-import { AtomicLocalRebalancingBridge__factory, CrossCollateralRouter__factory, ERC20Test__factory, GasRouter__factory, HypXERC20Lockbox__factory, LinearFee__factory, MailboxClient__factory, ProxyAdmin__factory, RateLimitedIsm__factory, RoutingFee__factory, StaticAggregationIsm__factory, TokenRouter__factory, TransparentUpgradeableProxy__factory, XERC20LockboxTest__factory, XERC20Test__factory, } from '@hyperlane-xyz/core';
-import { ProtocolType, assert, addressToBytes32, deepCopy, eqAddress, isZeroishAddress, objMap, } from '@hyperlane-xyz/utils';
+import sinon from 'sinon';
+import { AtomicLocalRebalancingBridge__factory, CrossCollateralRouter__factory, DelayedFlowRouterHookIsm__factory, ERC20Test__factory, GasRouter__factory, HypXERC20Lockbox__factory, LinearFee__factory, MailboxClient__factory, NetFlowRateLimitedHookIsm__factory, ProxyAdmin__factory, RateLimitedIsm__factory, RoutingFee__factory, StaticAggregationIsm__factory, TokenRouter__factory, TransparentUpgradeableProxy__factory, XERC20LockboxTest__factory, XERC20Test__factory, XERC20VSTest__factory, } from '@hyperlane-xyz/core';
+import { ProtocolType, addressToBytes32, assert, deepCopy, eqAddress, isNullish, isZeroishAddress, objMap, } from '@hyperlane-xyz/utils';
 import { TestChainName } from '../consts/testChains.js';
 import { TestCoreDeployer } from '../core/TestCoreDeployer.js';
 import { HyperlaneProxyFactoryDeployer } from '../deploy/HyperlaneProxyFactoryDeployer.js';
-import { executeWarpDeploy } from '../deploy/warp.js';
+import { enrollCrossChainRouters, executeWarpDeploy } from '../deploy/warp.js';
 import { TokenFeeType } from '../fee/types.js';
+import { HookType } from '../hook/types.js';
 import { HyperlaneIsmFactory } from '../ism/HyperlaneIsmFactory.js';
 import { IsmType, } from '../ism/types.js';
 import { MultiProvider } from '../providers/MultiProvider.js';
+import { randomAddress } from '../test/testUtils.js';
+import { collectHybridIsmNodes } from '../utils/ism.js';
 import { EvmWarpRouteReader } from './EvmWarpRouteReader.js';
 import { TokenStandard } from './TokenStandard.js';
 import { TokenType } from './config.js';
 import { checkWarpRouteDeployConfig } from './warpCheck.js';
 import { HypERC20Deployer } from './deploy.js';
-import { isAtomicLocalRebalancingBridgeTokenConfig, isDepositAddressTokenConfig, } from './types.js';
+import { XERC20Type, isAtomicLocalRebalancingBridgeTokenConfig, isDepositAddressTokenConfig, } from './types.js';
 const chain = TestChainName.test1;
 function addOverridesToConfig(config, ownerOverrides) {
     return Object.fromEntries(Object.entries(config).map(([chain, config]) => {
@@ -29,6 +33,12 @@ function addOverridesToConfig(config, ownerOverrides) {
         ];
     }));
 }
+function assertEvmTransaction(transaction, chain) {
+    assert('to' in transaction &&
+        typeof transaction.to === 'string' &&
+        'data' in transaction &&
+        typeof transaction.data === 'string', `Expected an EVM transaction for ${chain}`);
+}
 describe('TokenDeployer', async () => {
     let signer;
     let deployer;
@@ -289,12 +299,25 @@ describe('TokenDeployer', async () => {
                     chainName: currentChain,
                 })),
             });
+            // XERC20Test answers mintingMaxLimitOf/burningMaxLimitOf with the uint256
+            // max for every bridge, so a deploy config declaring no limits reads as
+            // drift against what the token holds.
+            const MAX_UINT256 = '115792089237316195423570985008687907853269984665640564039457584007913129639935';
             beforeEach(async () => {
-                // @ts-expect-error - Test assigns varying token types to config
                 config[chain] = {
                     ...config[chain],
                     type,
+                    // @ts-expect-error - Test assigns varying token types to config
                     token: token(),
+                    xERC20: type === TokenType.XERC20
+                        ? {
+                            warpRouteLimits: {
+                                type: XERC20Type.Standard,
+                                mint: MAX_UINT256,
+                                burn: MAX_UINT256,
+                            },
+                        }
+                        : undefined,
                 };
                 contractsMap = await deployer.deploy(config);
             });
@@ -563,10 +586,10 @@ describe('TokenDeployer', async () => {
                 reader = new EvmWarpRouteReader(multiProvider, TestChainName.test1);
             });
             beforeEach(async () => {
-                // @ts-expect-error - Test assigns varying token types to config
                 config[chain] = {
                     ...config[chain],
                     type,
+                    // @ts-expect-error - Test assigns varying token types to config
                     token: token(),
                 };
                 const warpRoute = await deployer.deploy(config);
@@ -578,6 +601,153 @@ describe('TokenDeployer', async () => {
             });
         });
     }
+    describe('checkWarpRouteDeployConfig for a Velodrome xERC20', () => {
+        // The values the CLI e2e uses, which XERC20VSTest accepts for addBridge.
+        const BUFFER_CAP = '1000000000000000000000';
+        const RATE_LIMIT_PER_SECOND = '1000000000000000000';
+        const VELO_LIMITS = {
+            type: XERC20Type.Velo,
+            bufferCap: BUFFER_CAP,
+            rateLimitPerSecond: RATE_LIMIT_PER_SECOND,
+        };
+        let sandbox;
+        let veloToken;
+        let extraBridge;
+        let contractsMap;
+        const veloConfig = (extraBridges) => ({
+            ...config,
+            [chain]: {
+                ...config[chain],
+                type: TokenType.XERC20,
+                token: veloToken.address,
+                xERC20: { warpRouteLimits: VELO_LIMITS, extraBridges },
+            },
+        });
+        // CAST: the check only reads chainName and addressOrDenom off each token,
+        // and filling in the rest of WarpCoreConfig's token metadata would state
+        // things about the deployment this test does not know.
+        const getWarpCoreConfig = () => ({
+            tokens: Object.keys(config).map((currentChain) => ({
+                addressOrDenom: contractsMap[currentChain][currentChain === chain
+                    ? TokenType.XERC20
+                    : config[currentChain].type].address,
+                chainName: currentChain,
+            })),
+        });
+        beforeEach(async () => {
+            sandbox = sinon.createSandbox();
+            // The test chains declare a placeholder Etherscan explorer, and the bridge
+            // scan would spend a network round trip on it before falling through. The
+            // RPC is the path this exercises.
+            sandbox.stub(multiProvider, 'tryGetEvmExplorerMetadataList').returns([]);
+            const { name, decimals, symbol } = config[chain];
+            assert(name && symbol && !isNullish(decimals), `Missing token metadata for ${chain}`);
+            veloToken = await new XERC20VSTest__factory(signer).deploy(name, symbol, totalSupply, decimals);
+            contractsMap = await deployer.deploy(veloConfig());
+            // The route's own router is a bridge of the token like any other, and the
+            // extra bridge is an address nothing but the token's events knows about.
+            extraBridge = randomAddress();
+            for (const bridge of [
+                contractsMap[chain][TokenType.XERC20].address,
+                extraBridge,
+            ]) {
+                await veloToken
+                    .addBridge({
+                    bridge,
+                    bufferCap: BUFFER_CAP,
+                    rateLimitPerSecond: RATE_LIMIT_PER_SECOND,
+                })
+                    .then((tx) => tx.wait());
+            }
+        });
+        afterEach(() => {
+            sandbox.restore();
+        });
+        it('reports no violations for a bridge discovered from the token', async () => {
+            const result = await checkWarpRouteDeployConfig({
+                multiProvider,
+                warpCoreConfig: getWarpCoreConfig(),
+                warpDeployConfig: veloConfig([
+                    { lockbox: extraBridge, limits: VELO_LIMITS },
+                ]),
+            });
+            expect(result.diff).to.deep.equal({});
+            expect(result.violations).to.deep.equal([]);
+            expect(result.isValid).to.equal(true);
+        });
+        // Discovery follows the order the token announced its bridges in and the
+        // deploy config follows whoever wrote it. Comparing the two index by index
+        // reports the same set of bridges in two orders as drift.
+        it('reports no violations when the deploy config names the bridges in another order', async () => {
+            const laterBridge = randomAddress();
+            await veloToken
+                .addBridge({
+                bridge: laterBridge,
+                bufferCap: BUFFER_CAP,
+                rateLimitPerSecond: RATE_LIMIT_PER_SECOND,
+            })
+                .then((tx) => tx.wait());
+            const result = await checkWarpRouteDeployConfig({
+                multiProvider,
+                warpCoreConfig: getWarpCoreConfig(),
+                // Announced extraBridge first, so name it last.
+                warpDeployConfig: veloConfig([
+                    { lockbox: laterBridge, limits: VELO_LIMITS },
+                    { lockbox: extraBridge, limits: VELO_LIMITS },
+                ]),
+            });
+            expect(result.diff).to.deep.equal({});
+            expect(result.violations).to.deep.equal([]);
+            expect(result.isValid).to.equal(true);
+        });
+        // Guards the assertion above against passing because the declared limits
+        // were echoed back rather than read: declare the same bridge with limits
+        // the token does not hold and the check has to report it.
+        it('reports drift when the declared limits are not the ones the token holds', async () => {
+            const result = await checkWarpRouteDeployConfig({
+                multiProvider,
+                warpCoreConfig: getWarpCoreConfig(),
+                warpDeployConfig: veloConfig([
+                    {
+                        lockbox: extraBridge,
+                        limits: {
+                            type: XERC20Type.Velo,
+                            bufferCap: '1',
+                            rateLimitPerSecond: '1',
+                        },
+                    },
+                ]),
+            });
+            expect(result.isValid).to.equal(false);
+            expect(result.violations.map(({ chain: violationChain, name }) => ({
+                chain: violationChain,
+                name,
+            }))).to.deep.equal([
+                { chain, name: 'xERC20.extraBridges.0.limits.bufferCap' },
+                { chain, name: 'xERC20.extraBridges.0.limits.rateLimitPerSecond' },
+            ]);
+        });
+        // A bridge on chain that the deploy config does not name is drift the check
+        // exists to surface, and it is only visible because the bridge set is read
+        // from the token rather than from the config.
+        it('reports a bridge the deploy config does not name', async () => {
+            const result = await checkWarpRouteDeployConfig({
+                multiProvider,
+                warpCoreConfig: getWarpCoreConfig(),
+                warpDeployConfig: veloConfig(),
+            });
+            expect(result.isValid).to.equal(false);
+            // isValid alone is true of any drift on any field, so the violation has
+            // to name the bridge for this to be about the bridge.
+            expect(result.violations.map(({ chain: violationChain, name, actual }) => ({
+                chain: violationChain,
+                name,
+                namesTheBridge: actual.includes(extraBridge.toLowerCase()),
+            }))).to.deep.equal([
+                { chain, name: 'xERC20.extraBridges', namesTheBridge: true },
+            ]);
+        });
+    });
     describe('RateLimitedIsm with non-deployer warp owner', () => {
         let ismDeployer;
         let ismFactory;
@@ -683,6 +853,447 @@ describe('TokenDeployer', async () => {
             expect((await router.owner()).toLowerCase()).to.equal(warpOwner.toLowerCase());
         });
     });
+    describe('Hybrid hook/ISM deferred deploy', () => {
+        let registryAddresses;
+        const remoteChain = TestChainName.test2;
+        before(async () => {
+            const pfd = new HyperlaneProxyFactoryDeployer(multiProvider);
+            const factories = await pfd.deploy(multiProvider.mapKnownChains(() => ({})));
+            registryAddresses = {};
+            for (const chainName of [chain, remoteChain]) {
+                registryAddresses[chainName] = {
+                    ...objMap(factories[chainName], (_, contract) => contract.address),
+                    mailbox: coreApp.getContracts(chainName).mailbox.address,
+                };
+            }
+            // DELAYED_FLOW_ROUTER refuses nonce-0 mailboxes. Seed both test
+            // mailboxes before any staged deploy spends gas.
+            for (const [origin, destination] of [
+                [chain, remoteChain],
+                [remoteChain, chain],
+            ]) {
+                const mailbox = coreApp.getContracts(origin).mailbox;
+                if ((await mailbox.nonce()) !== 0)
+                    continue;
+                const recipient = addressToBytes32(signer.address);
+                const quote = await mailbox['quoteDispatch(uint32,bytes32,bytes)'](multiProvider.getDomainId(destination), recipient, '0x');
+                await multiProvider.handleTx(origin, mailbox['dispatch(uint32,bytes32,bytes)'](multiProvider.getDomainId(destination), recipient, '0x', { value: quote }));
+            }
+        });
+        function delayedFlowTree(owner) {
+            return {
+                type: IsmType.AGGREGATION,
+                threshold: 2,
+                modules: [
+                    {
+                        type: IsmType.TRUSTED_RELAYER,
+                        relayer: signer.address,
+                    },
+                    {
+                        type: IsmType.DELAYED_FLOW_ROUTER,
+                        thresholdBps: 10000,
+                        maxDelay: 3600,
+                        duration: 86400n,
+                        owner,
+                    },
+                ],
+            };
+        }
+        const hookView = (ism) => {
+            const nodes = collectHybridIsmNodes(ism);
+            assert(nodes.length === 1, `Expected one hybrid node, found ${nodes.length}`);
+            const node = nodes[0];
+            return node.type === IsmType.DELAYED_FLOW_ROUTER
+                ? { ...node, type: HookType.DELAYED_FLOW_ROUTER }
+                : { ...node, type: HookType.NET_FLOW_RATE_LIMITED };
+        };
+        async function deployHybridRoute(warpConfig, isms) {
+            const planned = objMap(warpConfig, (chainName, chainConfig) => {
+                const ism = isms[chainName];
+                assert(ism, `Missing hybrid ISM tree for ${chainName}`);
+                return {
+                    ...chainConfig,
+                    interchainSecurityModule: ism,
+                    hook: hookView(ism),
+                };
+            });
+            const routers = await executeWarpDeploy(planned, multiProvider, {}, registryAddresses, {});
+            return objMap(routers, (_, address) => ({
+                synthetic: { address },
+            }));
+        }
+        async function expectDeployRejection(promise, message) {
+            const error = await promise.then(() => undefined, (thrown) => thrown instanceof Error ? thrown : new Error(String(thrown)));
+            assert(error, 'Expected staged deploy to reject');
+            expect(error.message).to.include(message);
+        }
+        it('wires a nested delayedFlowRouterHookIsm as ISM member AND hook, keeping deployer ownership for enrollment', async () => {
+            const warpOwner = ethers.Wallet.createRandom().address;
+            const warpConfig = {
+                [chain]: {
+                    ...config[chain],
+                    type: TokenType.synthetic,
+                    owner: warpOwner,
+                },
+            };
+            const contracts = await deployHybridRoute(warpConfig, {
+                [chain]: delayedFlowTree(warpOwner),
+            });
+            const routerAddress = contracts[chain].synthetic.address;
+            const provider = multiProvider.getProvider(chain);
+            const tokenClient = MailboxClient__factory.connect(routerAddress, provider);
+            const ismAddress = await tokenClient.interchainSecurityModule();
+            expect(isZeroishAddress(ismAddress)).to.be.false;
+            // hook must be wired to the hybrid instance
+            const hookAddress = await tokenClient.hook();
+            expect(isZeroishAddress(hookAddress)).to.be.false;
+            // the hook is the DelayedFlowRouterHookIsm paired with this router
+            const delayedIsm = DelayedFlowRouterHookIsm__factory.connect(hookAddress, provider);
+            expect(eqAddress(await delayedIsm.warpRouter(), routerAddress)).to.be
+                .true;
+            expect(await delayedIsm.maxDelay()).to.equal(3600);
+            // the same instance must be a member of the aggregation ISM
+            const aggregationIsm = StaticAggregationIsm__factory.connect(ismAddress, provider);
+            const [modules] = await aggregationIsm.modulesAndThreshold(ethers.constants.AddressZero);
+            expect(modules.map((m) => m.toLowerCase())).to.include(hookAddress.toLowerCase());
+            // Both stay with the deployer until the final router-enrollment pass.
+            expect(eqAddress(await delayedIsm.owner(), signer.address)).to.be.true;
+            const router = GasRouter__factory.connect(routerAddress, provider);
+            expect((await router.owner()).toLowerCase()).to.equal(signer.address.toLowerCase());
+        });
+        it('does not proceed to the ISM phase when installing the hook fails', async () => {
+            const setHookSighash = MailboxClient__factory.createInterface().getSighash('setHook');
+            const setIsmSighash = MailboxClient__factory.createInterface().getSighash('setInterchainSecurityModule');
+            let sawIsmInstall = false;
+            const sendTransaction = multiProvider.sendTransaction.bind(multiProvider);
+            const sandbox = sinon.createSandbox();
+            sandbox
+                .stub(multiProvider, 'sendTransaction')
+                .callsFake(async (txChain, txProm, options) => {
+                const tx = await txProm;
+                if (typeof tx.data === 'string' &&
+                    tx.data.startsWith(setIsmSighash)) {
+                    sawIsmInstall = true;
+                }
+                if (typeof tx.data === 'string' &&
+                    tx.data.startsWith(setHookSighash)) {
+                    throw new Error('execution reverted: setHook');
+                }
+                return sendTransaction(txChain, tx, options);
+            });
+            try {
+                const warpConfig = {
+                    [chain]: {
+                        ...config[chain],
+                        type: TokenType.synthetic,
+                        owner: signer.address,
+                    },
+                };
+                const error = await deployHybridRoute(warpConfig, {
+                    [chain]: delayedFlowTree(signer.address),
+                }).then(() => undefined, (thrown) => thrown instanceof Error ? thrown : new Error(String(thrown)));
+                assert(error, 'expected the deploy to fail');
+                expect(error.message).to.include('execution reverted: setHook');
+                expect(sawIsmInstall).to.be.false;
+            }
+            finally {
+                sandbox.restore();
+            }
+        });
+        it('rejects a hybrid on an unmeterable router type before staged deploy', async () => {
+            const warpConfig = {
+                [chain]: {
+                    ...config[chain],
+                    type: TokenType.collateralVault,
+                    token: erc20.address,
+                    owner: signer.address,
+                },
+            };
+            await expectDeployRejection(deployHybridRoute(warpConfig, {
+                [chain]: delayedFlowTree(signer.address),
+            }), 'cannot meter');
+        });
+        it('rejects a hybrid combined with a predicateWrapper before staged deploy', async () => {
+            const warpConfig = {
+                [chain]: {
+                    ...config[chain],
+                    type: TokenType.synthetic,
+                    owner: signer.address,
+                    predicateWrapper: {
+                        predicateRegistry: randomAddress(),
+                        policyId: 'test-policy',
+                        owner: signer.address,
+                    },
+                },
+            };
+            await expectDeployRejection(deployHybridRoute(warpConfig, {
+                [chain]: delayedFlowTree(signer.address),
+            }), 'both must own');
+        });
+        it('rejects a top-level netFlowRateLimitedHookIsm (no authenticating ISM)', async () => {
+            const warpOwner = ethers.Wallet.createRandom().address;
+            const warpConfig = {
+                [chain]: {
+                    ...config[chain],
+                    type: TokenType.synthetic,
+                    owner: warpOwner,
+                },
+            };
+            // moduleType() is NULL: alone it authenticates nothing, so a forged
+            // message would mint on this synthetic leg subject only to bucket
+            // capacity. The composition rule must reject it.
+            const netFlowConfig = {
+                type: IsmType.NET_FLOW_RATE_LIMITED,
+                thresholdBps: 500,
+                duration: 86400n,
+                owner: warpOwner,
+            };
+            await expectDeployRejection(deployHybridRoute(warpConfig, { [chain]: netFlowConfig }), 'verifies flow, not message authenticity');
+        });
+        it('wires a netFlowRateLimitedHookIsm composed under an authenticating aggregation as both hook and ISM', async () => {
+            const warpOwner = ethers.Wallet.createRandom().address;
+            const warpConfig = {
+                [chain]: {
+                    ...config[chain],
+                    type: TokenType.synthetic,
+                    owner: warpOwner,
+                },
+            };
+            const netFlowConfig = {
+                type: IsmType.AGGREGATION,
+                threshold: 2,
+                modules: [
+                    { type: IsmType.TRUSTED_RELAYER, relayer: signer.address },
+                    {
+                        type: IsmType.NET_FLOW_RATE_LIMITED,
+                        thresholdBps: 500,
+                        duration: 86400n,
+                        owner: warpOwner,
+                    },
+                ],
+            };
+            const contracts = await deployHybridRoute(warpConfig, {
+                [chain]: netFlowConfig,
+            });
+            const routerAddress = contracts[chain].synthetic.address;
+            const provider = multiProvider.getProvider(chain);
+            // Mirror the CLI's post-deploy pass. It enrolls route peers and hands
+            // the router, ProxyAdmin, and shared hybrid to their final owner.
+            const enrollmentTxs = await enrollCrossChainRouters({
+                multiProvider,
+                altVmSigners: {},
+                registryAddresses,
+                warpDeployConfig: warpConfig,
+            }, { [chain]: routerAddress });
+            for (const rawTx of enrollmentTxs[chain] ?? []) {
+                assertEvmTransaction(rawTx, chain);
+                await multiProvider.sendTransaction(chain, {
+                    to: rawTx.to,
+                    data: rawTx.data,
+                    value: rawTx.value,
+                });
+            }
+            const tokenClient = MailboxClient__factory.connect(routerAddress, provider);
+            const ismAddress = await tokenClient.interchainSecurityModule();
+            const hookAddress = await tokenClient.hook();
+            expect(isZeroishAddress(hookAddress)).to.be.false;
+            // The hook is the hybrid leaf inside the installed aggregation, not the
+            // aggregation itself.
+            const [modules] = await StaticAggregationIsm__factory.connect(ismAddress, provider).modulesAndThreshold(ethers.constants.AddressZero);
+            expect(modules.map((m) => m.toLowerCase())).to.include(hookAddress.toLowerCase());
+            const netFlowIsm = NetFlowRateLimitedHookIsm__factory.connect(hookAddress, provider);
+            expect(eqAddress(await netFlowIsm.warpRouter(), routerAddress)).to.be
+                .true;
+            // Ownership transfers only after all route wiring is complete.
+            expect((await netFlowIsm.owner()).toLowerCase()).to.equal(warpOwner.toLowerCase());
+            expect((await TokenRouter__factory.connect(routerAddress, provider).owner()).toLowerCase()).to.equal(warpOwner.toLowerCase());
+            const secondEnrollmentTxs = await enrollCrossChainRouters({
+                multiProvider,
+                altVmSigners: {},
+                registryAddresses,
+                warpDeployConfig: warpConfig,
+            }, { [chain]: routerAddress });
+            expect(Object.keys(secondEnrollmentTxs)).to.have.length(0);
+        });
+        it('defaults an omitted netFlowRateLimitedHookIsm owner to the chain config owner', async () => {
+            const warpOwner = ethers.Wallet.createRandom().address;
+            const warpConfig = {
+                [chain]: {
+                    ...config[chain],
+                    type: TokenType.synthetic,
+                    owner: warpOwner,
+                },
+            };
+            const ownerlessNetFlow = {
+                type: IsmType.AGGREGATION,
+                threshold: 2,
+                modules: [
+                    { type: IsmType.TRUSTED_RELAYER, relayer: signer.address },
+                    {
+                        type: IsmType.NET_FLOW_RATE_LIMITED,
+                        thresholdBps: 500,
+                        duration: 86400n,
+                    },
+                ],
+            };
+            const contracts = await deployHybridRoute(warpConfig, {
+                [chain]: ownerlessNetFlow,
+            });
+            const routerAddress = contracts[chain].synthetic.address;
+            const provider = multiProvider.getProvider(chain);
+            const enrollmentTxs = await enrollCrossChainRouters({
+                multiProvider,
+                altVmSigners: {},
+                registryAddresses,
+                warpDeployConfig: warpConfig,
+            }, { [chain]: routerAddress });
+            for (const rawTx of enrollmentTxs[chain] ?? []) {
+                assertEvmTransaction(rawTx, chain);
+                await multiProvider.sendTransaction(chain, {
+                    to: rawTx.to,
+                    data: rawTx.data,
+                    value: rawTx.value,
+                });
+            }
+            // the hybrid leaf is the router's hook; the ISM is the aggregation
+            const hookAddress = await MailboxClient__factory.connect(routerAddress, provider).hook();
+            const netFlowIsm = NetFlowRateLimitedHookIsm__factory.connect(hookAddress, provider);
+            // The final pass defaults an omitted hybrid owner to the chain owner.
+            expect((await netFlowIsm.owner()).toLowerCase()).to.equal(warpOwner.toLowerCase());
+        });
+        it('enrolls delayedFlowRouterHookIsm counterparts cross-chain and transfers ownership last', async () => {
+            const warpOwner = ethers.Wallet.createRandom().address;
+            const warpDeployConfig = {
+                [chain]: {
+                    ...config[chain],
+                    type: TokenType.synthetic,
+                    owner: warpOwner,
+                    interchainSecurityModule: delayedFlowTree(warpOwner),
+                },
+                [remoteChain]: {
+                    ...config[remoteChain],
+                    type: TokenType.synthetic,
+                    owner: warpOwner,
+                    interchainSecurityModule: delayedFlowTree(warpOwner),
+                },
+            };
+            const contracts = await deployHybridRoute(warpDeployConfig, {
+                [chain]: delayedFlowTree(warpOwner),
+                [remoteChain]: delayedFlowTree(warpOwner),
+            });
+            const deployedContracts = objMap(contracts, (_, c) => c.synthetic.address);
+            const enrollTxs = await enrollCrossChainRouters({
+                multiProvider,
+                altVmSigners: {},
+                registryAddresses,
+                warpDeployConfig,
+            }, deployedContracts);
+            for (const [txChain, txs] of Object.entries(enrollTxs)) {
+                for (const rawTx of txs) {
+                    assertEvmTransaction(rawTx, txChain);
+                    // drop the annotated chainId: every hardhat test chain shares one
+                    // node (chainId 31337) while test-chain metadata carries fake ids
+                    await multiProvider.sendTransaction(txChain, {
+                        to: rawTx.to,
+                        data: rawTx.data,
+                        value: rawTx.value,
+                    });
+                }
+            }
+            const localProvider = multiProvider.getProvider(chain);
+            const remoteProvider = multiProvider.getProvider(remoteChain);
+            const localDfr = DelayedFlowRouterHookIsm__factory.connect(await MailboxClient__factory.connect(deployedContracts[chain], localProvider).hook(), localProvider);
+            const remoteDfr = DelayedFlowRouterHookIsm__factory.connect(await MailboxClient__factory.connect(deployedContracts[remoteChain], remoteProvider).hook(), remoteProvider);
+            // mutual DFR enrollment
+            const localDomain = multiProvider.getDomainId(chain);
+            const remoteDomain = multiProvider.getDomainId(remoteChain);
+            expect(await localDfr.routers(remoteDomain)).to.equal(addressToBytes32(remoteDfr.address).toLowerCase());
+            expect(await remoteDfr.routers(localDomain)).to.equal(addressToBytes32(localDfr.address).toLowerCase());
+            // ownership handed to the configured owner after enrollment
+            expect((await localDfr.owner()).toLowerCase()).to.equal(warpOwner.toLowerCase());
+            expect((await remoteDfr.owner()).toLowerCase()).to.equal(warpOwner.toLowerCase());
+            // a second pass converges to zero transactions
+            const secondEnrollTxs = await enrollCrossChainRouters({
+                multiProvider,
+                altVmSigners: {},
+                registryAddresses,
+                warpDeployConfig,
+            }, deployedContracts);
+            expect(Object.keys(secondEnrollTxs)).to.have.length(0);
+        });
+        it('reconciles delayedFlowRouterHookIsm enrollment drift', async () => {
+            // Owner is the deployer so the drift can be introduced directly and the
+            // corrective transactions can be submitted from this test.
+            const owner = signer.address;
+            const warpDeployConfig = {
+                [chain]: {
+                    ...config[chain],
+                    type: TokenType.synthetic,
+                    owner,
+                    interchainSecurityModule: delayedFlowTree(owner),
+                },
+                [remoteChain]: {
+                    ...config[remoteChain],
+                    type: TokenType.synthetic,
+                    owner,
+                    interchainSecurityModule: delayedFlowTree(owner),
+                },
+            };
+            const contracts = await deployHybridRoute(objMap(warpDeployConfig, (_, c) => ({
+                ...c,
+                interchainSecurityModule: undefined,
+            })), {
+                [chain]: delayedFlowTree(owner),
+                [remoteChain]: delayedFlowTree(owner),
+            });
+            const deployedContracts = objMap(contracts, (_, c) => c.synthetic.address);
+            const submit = async (txs) => {
+                for (const [txChain, chainTxs] of Object.entries(txs)) {
+                    for (const rawTx of chainTxs) {
+                        assertEvmTransaction(rawTx, txChain);
+                        await multiProvider.sendTransaction(txChain, {
+                            to: rawTx.to,
+                            data: rawTx.data,
+                            value: rawTx.value,
+                        });
+                    }
+                }
+            };
+            await submit(await enrollCrossChainRouters({
+                multiProvider,
+                altVmSigners: {},
+                registryAddresses,
+                warpDeployConfig,
+            }, deployedContracts));
+            const localProvider = multiProvider.getProvider(chain);
+            const localDfrAddress = await MailboxClient__factory.connect(deployedContracts[chain], localProvider).hook();
+            const localDfr = DelayedFlowRouterHookIsm__factory.connect(localDfrAddress, multiProvider.getSigner(chain));
+            const remoteDomain = multiProvider.getDomainId(remoteChain);
+            // Introduce drift: point the local instance at a bogus counterpart.
+            const bogusRouter = addressToBytes32(randomAddress()).toLowerCase();
+            await multiProvider.handleTx(chain, localDfr.enrollRemoteRouter(remoteDomain, bogusRouter));
+            expect(await localDfr.routers(remoteDomain)).to.equal(bogusRouter);
+            // Re-running enrollment must emit corrective transactions...
+            const driftTxs = await enrollCrossChainRouters({
+                multiProvider,
+                altVmSigners: {},
+                registryAddresses,
+                warpDeployConfig,
+            }, deployedContracts);
+            expect(Object.keys(driftTxs)).to.include(chain);
+            await submit(driftTxs);
+            // ...restoring the real counterpart, and then converging again.
+            const remoteDfrAddress = await MailboxClient__factory.connect(deployedContracts[remoteChain], multiProvider.getProvider(remoteChain)).hook();
+            expect(await localDfr.routers(remoteDomain)).to.equal(addressToBytes32(remoteDfrAddress).toLowerCase());
+            const convergedTxs = await enrollCrossChainRouters({
+                multiProvider,
+                altVmSigners: {},
+                registryAddresses,
+                warpDeployConfig,
+            }, deployedContracts);
+            expect(Object.keys(convergedTxs)).to.have.length(0);
+        });
+    });
     describe('TokenFee with optional token for synthetic', () => {
         it('should deploy LinearFee without token and resolve to router address', async () => {
             const syntheticConfig = {