@layerzerolabs/protocol-stellar-v2 0.2.21 → 0.2.23

package/contracts/message-libs/blocked-message-lib/src/tests/blocked_message_lib_tests.rs

@@ -0,0 +1,108 @@
+//! Unit tests for BlockedMessageLib.
+
+use endpoint_v2::{MessageLibType, MessageLibVersion, SetConfigParam};
+use soroban_sdk::{testutils::Address as _, Address, Bytes, Vec};
+
+use super::setup::{create_packet, setup};
+use crate::BlockedMessageLibError;
+
+// ============================================================================
+// IMessageLib Tests
+// ============================================================================
+
+#[test]
+fn is_supported_eid_returns_true_for_any_eid() {
+    let test = setup();
+
+    assert!(test.client.is_supported_eid(&0u32));
+    assert!(test.client.is_supported_eid(&12345u32));
+    assert!(test.client.is_supported_eid(&u32::MAX));
+}
+
+#[test]
+fn version_returns_max_values() {
+    let test = setup();
+
+    assert_eq!(
+        test.client.version(),
+        MessageLibVersion { major: u64::MAX, minor: u8::MAX as u32, endpoint_version: 2 }
+    );
+}
+
+#[test]
+fn message_lib_type_returns_send_and_receive() {
+    let test = setup();
+
+    let lib_type = test.client.message_lib_type();
+
+    assert_eq!(lib_type, MessageLibType::SendAndReceive);
+}
+
+#[test]
+fn set_config_panics() {
+    let test = setup();
+    let oapp = Address::generate(&test.env);
+    let params: Vec<SetConfigParam> = Vec::new(&test.env);
+
+    let result = test.client.try_set_config(&oapp, &params);
+
+    assert_eq!(result.unwrap_err().unwrap(), BlockedMessageLibError::NotImplemented.into());
+}
+
+#[test]
+fn get_config_panics() {
+    let test = setup();
+    let oapp = Address::generate(&test.env);
+
+    let result = test.client.try_get_config(&1u32, &oapp, &0u32);
+
+    assert_eq!(result.unwrap_err().unwrap(), BlockedMessageLibError::NotImplemented.into());
+}
+
+// ============================================================================
+// ISendLib Tests
+// ============================================================================
+
+#[test]
+fn quote_panics() {
+    let test = setup();
+    let packet = create_packet(&test.env);
+    let options = Bytes::new(&test.env);
+
+    let result = test.client.try_quote(&packet, &options, &false);
+
+    assert_eq!(result.unwrap_err().unwrap(), BlockedMessageLibError::NotImplemented.into());
+}
+
+#[test]
+fn quote_panics_with_zro() {
+    let test = setup();
+    let packet = create_packet(&test.env);
+    let options = Bytes::new(&test.env);
+
+    let result = test.client.try_quote(&packet, &options, &true);
+
+    assert_eq!(result.unwrap_err().unwrap(), BlockedMessageLibError::NotImplemented.into());
+}
+
+#[test]
+fn send_panics() {
+    let test = setup();
+    let packet = create_packet(&test.env);
+    let options = Bytes::new(&test.env);
+
+    let result = test.client.try_send(&packet, &options, &false);
+
+    assert_eq!(result.unwrap_err().unwrap(), BlockedMessageLibError::NotImplemented.into());
+}
+
+#[test]
+fn send_panics_with_zro() {
+    let test = setup();
+    let packet = create_packet(&test.env);
+    let options = Bytes::new(&test.env);
+
+    let result = test.client.try_send(&packet, &options, &true);
+
+    assert_eq!(result.unwrap_err().unwrap(), BlockedMessageLibError::NotImplemented.into());
+}

package/contracts/message-libs/blocked-message-lib/src/tests/mod.rs

@@ -0,0 +1,4 @@
+//! Tests for BlockedMessageLib contract.
+
+mod blocked_message_lib_tests;
+mod setup;

package/contracts/message-libs/blocked-message-lib/src/tests/setup.rs

@@ -0,0 +1,40 @@
+//! Test setup for BlockedMessageLib tests.
+
+use endpoint_v2::OutboundPacket;
+use soroban_sdk::{testutils::Address as _, Address, Bytes, BytesN, Env};
+
+use crate::{BlockedMessageLib, BlockedMessageLibClient};
+
+// ============================================================================
+// Test Setup
+// ============================================================================
+
+pub struct TestSetup<'a> {
+    pub env: Env,
+    pub client: BlockedMessageLibClient<'a>,
+}
+
+/// Creates a test setup with the BlockedMessageLib contract.
+pub fn setup<'a>() -> TestSetup<'a> {
+    let env = Env::default();
+    let contract_id = env.register(BlockedMessageLib, ());
+    let client = BlockedMessageLibClient::new(&env, &contract_id);
+    TestSetup { env, client }
+}
+
+// ============================================================================
+// Helper Functions
+// ============================================================================
+
+/// Creates a test outbound packet.
+pub fn create_packet(env: &Env) -> OutboundPacket {
+    OutboundPacket {
+        nonce: 1,
+        src_eid: 1,
+        sender: Address::generate(env),
+        dst_eid: 2,
+        receiver: BytesN::from_array(env, &[0u8; 32]),
+        guid: BytesN::from_array(env, &[0u8; 32]),
+        message: Bytes::from_array(env, b"test"),
+    }
+}

package/contracts/message-libs/simple-message-lib/src/lib.rs

@@ -11,4 +11,4 @@ cfg_if::cfg_if! {
 }
 
 #[cfg(test)]
-mod test;
+mod tests;

package/contracts/message-libs/simple-message-lib/src/tests/mod.rs

@@ -0,0 +1,2 @@
+mod setup;
+mod simple_message_lib_tests;

package/contracts/message-libs/simple-message-lib/src/tests/setup.rs

@@ -0,0 +1,124 @@
+//! Test setup for SimpleMessageLib tests.
+
+use endpoint_v2::{LayerZeroEndpointV2Client, Origin, OutboundPacket};
+use soroban_sdk::{contract, contractimpl, symbol_short, testutils::Address as _, Address, Bytes, BytesN, Env};
+
+use crate::simple_message_lib::{SimpleMessageLib, SimpleMessageLibClient};
+
+// ============================================================================
+// Mock Contracts
+// ============================================================================
+
+#[contract]
+pub struct MockEndpoint;
+
+#[contractimpl]
+impl MockEndpoint {
+    pub fn __constructor(env: Env, native_token: Address) {
+        env.storage().instance().set(&symbol_short!("ntk"), &native_token);
+    }
+
+    pub fn eid(_env: Env) -> u32 {
+        1
+    }
+
+    pub fn native_token(env: Env) -> Address {
+        env.storage().instance().get(&symbol_short!("ntk")).unwrap()
+    }
+
+    pub fn zro(env: Env) -> Option<Address> {
+        env.storage().instance().get(&symbol_short!("zro")).unwrap_or(None)
+    }
+
+    pub fn set_zro(env: Env, zro: Address) {
+        env.storage().instance().set(&symbol_short!("zro"), &zro);
+    }
+
+    // Minimal `verify` implementation so `SimpleMessageLib::validate_packet` can be unit-tested.
+    // Stores the last arguments for assertions.
+    pub fn verify(env: Env, receive_lib: Address, origin: Origin, receiver: Address, payload_hash: BytesN<32>) {
+        receive_lib.require_auth();
+
+        env.storage().instance().set(&symbol_short!("v_rl"), &receive_lib);
+        env.storage().instance().set(&symbol_short!("v_or"), &origin);
+        env.storage().instance().set(&symbol_short!("v_rc"), &receiver);
+        env.storage().instance().set(&symbol_short!("v_ph"), &payload_hash);
+    }
+
+    pub fn last_verify(env: Env) -> (Address, Origin, Address, BytesN<32>) {
+        let receive_lib: Address = env.storage().instance().get(&symbol_short!("v_rl")).unwrap();
+        let origin: Origin = env.storage().instance().get(&symbol_short!("v_or")).unwrap();
+        let receiver: Address = env.storage().instance().get(&symbol_short!("v_rc")).unwrap();
+        let payload_hash: BytesN<32> = env.storage().instance().get(&symbol_short!("v_ph")).unwrap();
+        (receive_lib, origin, receiver, payload_hash)
+    }
+}
+
+#[contract]
+pub struct DummyReceiver;
+
+#[contractimpl]
+impl DummyReceiver {
+    pub fn __constructor(_env: Env) {}
+}
+
+// ============================================================================
+// Test Setup
+// ============================================================================
+
+pub struct TestSetup<'a> {
+    pub env: Env,
+    pub owner: Address,
+    pub fee_recipient: Address,
+    pub endpoint: LayerZeroEndpointV2Client<'a>,
+    pub sml: SimpleMessageLibClient<'a>,
+}
+
+/// Creates a test setup with the SimpleMessageLib contract and MockEndpoint.
+pub fn setup<'a>() -> TestSetup<'a> {
+    let env = Env::default();
+    let owner = Address::generate(&env);
+    let fee_recipient = Address::generate(&env);
+
+    let native_token = env.register_stellar_asset_contract_v2(owner.clone());
+
+    let endpoint = env.register(MockEndpoint, (&native_token.address(),));
+    let endpoint_client = LayerZeroEndpointV2Client::new(&env, &endpoint);
+    let sml_address = env.register(SimpleMessageLib, (&owner, &endpoint, &fee_recipient));
+    let sml = SimpleMessageLibClient::new(&env, &sml_address);
+    TestSetup { env, owner, fee_recipient, endpoint: endpoint_client, sml }
+}
+
+// ============================================================================
+// Helper Functions
+// ============================================================================
+
+/// Creates a test outbound packet.
+pub fn create_packet(env: &Env) -> OutboundPacket {
+    create_packet_with_contract_receiver(env, BytesN::from_array(env, &[0u8; 32]))
+}
+
+/// Creates a contract receiver and returns both the address and its bytes representation.
+pub fn create_contract_receiver(env: &Env) -> (Address, BytesN<32>) {
+    use soroban_sdk::address_payload::AddressPayload;
+
+    let receiver_addr = env.register(DummyReceiver, ());
+    let receiver_bytes = match receiver_addr.to_payload().unwrap() {
+        AddressPayload::ContractIdHash(b) => b,
+        AddressPayload::AccountIdPublicKeyEd25519(_) => panic!("receiver must be a contract"),
+    };
+    (receiver_addr, receiver_bytes)
+}
+
+/// Creates a test outbound packet with a custom contract receiver.
+pub fn create_packet_with_contract_receiver(env: &Env, receiver: BytesN<32>) -> OutboundPacket {
+    OutboundPacket {
+        nonce: 1,
+        src_eid: 2,
+        sender: Address::generate(env),
+        dst_eid: 3,
+        receiver,
+        guid: BytesN::from_array(env, &[0u8; 32]),
+        message: Bytes::from_array(env, b"test"),
+    }
+}

package/contracts/message-libs/simple-message-lib/src/tests/simple_message_lib_tests.rs

@@ -0,0 +1,309 @@
+use endpoint_v2::{MessageLibType, MessageLibVersion, SetConfigParam};
+use message_lib_common::packet_codec_v1;
+use soroban_sdk::{
+    testutils::{Address as _, MockAuth, MockAuthInvoke},
+    Address, Bytes, BytesN, IntoVal, Vec,
+};
+
+use crate::errors::SimpleMessageLibError;
+
+use super::setup::{
+    create_contract_receiver, create_packet, create_packet_with_contract_receiver, setup, MockEndpointClient, TestSetup,
+};
+
+// ============================================================================
+// Quote Tests
+// ============================================================================
+
+#[test]
+fn test_quote() {
+    let TestSetup { env, sml, endpoint, .. } = setup();
+
+    let packet = create_packet(&env);
+    let options = Bytes::new(&env);
+    let pay_in_zro = false;
+
+    env.mock_auths(&[MockAuth {
+        address: &endpoint.address,
+        invoke: &MockAuthInvoke {
+            contract: &sml.address,
+            fn_name: "quote",
+            args: (&packet, &options, &pay_in_zro).into_val(&env),
+            sub_invokes: &[],
+        },
+    }]);
+
+    let fee = sml.quote(&packet, &options, &pay_in_zro);
+    assert_eq!(fee.native_fee, 100);
+    assert_eq!(fee.zro_fee, 0);
+}
+
+#[test]
+fn test_quote_with_zro_fee() {
+    let TestSetup { env, sml, endpoint, .. } = setup();
+
+    let packet = create_packet(&env);
+    let options = Bytes::new(&env);
+    let pay_in_zro = true;
+
+    env.mock_auths(&[MockAuth {
+        address: &endpoint.address,
+        invoke: &MockAuthInvoke {
+            contract: &sml.address,
+            fn_name: "quote",
+            args: (&packet, &options, &pay_in_zro).into_val(&env),
+            sub_invokes: &[],
+        },
+    }]);
+
+    let fee = sml.quote(&packet, &options, &pay_in_zro);
+    assert_eq!(fee.native_fee, 100);
+    assert_eq!(fee.zro_fee, 99);
+}
+
+// ============================================================================
+// Send Tests
+// ============================================================================
+
+#[test]
+fn test_send() {
+    let TestSetup { env, sml, endpoint, fee_recipient, .. } = setup();
+
+    let packet = create_packet(&env);
+    let options = Bytes::new(&env);
+    let pay_in_zro = false;
+
+    env.mock_auths(&[MockAuth {
+        address: &endpoint.address,
+        invoke: &MockAuthInvoke {
+            contract: &sml.address,
+            fn_name: "send",
+            args: (&packet, &options, &pay_in_zro).into_val(&env),
+            sub_invokes: &[],
+        },
+    }]);
+
+    let send_result = sml.send(&packet, &options, &pay_in_zro);
+
+    // Verify encoded packet
+    assert_eq!(send_result.encoded_packet, packet_codec_v1::encode_packet(&env, &packet));
+
+    // Verify native fee recipient
+    assert_eq!(send_result.native_fee_recipients.len(), 1);
+    assert_eq!(send_result.zro_fee_recipients.len(), 0);
+
+    let native_recipient = send_result.native_fee_recipients.get(0).unwrap();
+    assert_eq!(native_recipient.to, fee_recipient);
+    assert_eq!(native_recipient.amount, 100);
+}
+
+#[test]
+fn test_send_returns_both_fee_recipients_with_zro() {
+    let TestSetup { env, sml, endpoint, owner, fee_recipient } = setup();
+
+    // Set up ZRO token
+    let zro = env.register_stellar_asset_contract_v2(owner.clone());
+    let zro_address = zro.address();
+    env.mock_auths(&[MockAuth {
+        address: &owner,
+        invoke: &MockAuthInvoke {
+            contract: &endpoint.address,
+            fn_name: "set_zro",
+            args: (&zro_address,).into_val(&env),
+            sub_invokes: &[],
+        },
+    }]);
+    endpoint.set_zro(&zro_address);
+
+    let packet = create_packet(&env);
+    let options = Bytes::new(&env);
+    let pay_in_zro = true;
+
+    env.mock_auths(&[MockAuth {
+        address: &endpoint.address,
+        invoke: &MockAuthInvoke {
+            contract: &sml.address,
+            fn_name: "send",
+            args: (&packet, &options, &pay_in_zro).into_val(&env),
+            sub_invokes: &[],
+        },
+    }]);
+
+    let send_result = sml.send(&packet, &options, &pay_in_zro);
+
+    assert_eq!(send_result.native_fee_recipients.len(), 1);
+    assert_eq!(send_result.zro_fee_recipients.len(), 1);
+
+    let native_recipient = send_result.native_fee_recipients.get(0).unwrap();
+    assert_eq!(native_recipient.to, fee_recipient);
+    assert_eq!(native_recipient.amount, 100);
+
+    let zro_recipient = send_result.zro_fee_recipients.get(0).unwrap();
+    assert_eq!(zro_recipient.to, fee_recipient);
+    assert_eq!(zro_recipient.amount, 99);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Auth, InvalidAction)")]
+fn test_send_requires_endpoint_auth() {
+    let TestSetup { env, sml, .. } = setup();
+
+    let packet = create_packet(&env);
+    let options = Bytes::new(&env);
+    let pay_in_zro = false;
+
+    // `send` requires endpoint auth; without mocks it should panic.
+    sml.send(&packet, &options, &pay_in_zro);
+}
+
+// ============================================================================
+// Admin Setter Tests
+// ============================================================================
+
+#[test]
+fn test_admin_setters_update_storage() {
+    let TestSetup { env, sml, owner, .. } = setup();
+
+    let new_fee_recipient = Address::generate(&env);
+    let new_native_fee = 1234i128;
+    let new_zro_fee = 5678i128;
+    let new_whitelisted = Address::generate(&env);
+
+    env.mock_auths(&[
+        MockAuth {
+            address: &owner,
+            invoke: &MockAuthInvoke {
+                contract: &sml.address,
+                fn_name: "set_fee_recipient",
+                args: (&new_fee_recipient,).into_val(&env),
+                sub_invokes: &[],
+            },
+        },
+        MockAuth {
+            address: &owner,
+            invoke: &MockAuthInvoke {
+                contract: &sml.address,
+                fn_name: "set_native_fee",
+                args: (&new_native_fee,).into_val(&env),
+                sub_invokes: &[],
+            },
+        },
+        MockAuth {
+            address: &owner,
+            invoke: &MockAuthInvoke {
+                contract: &sml.address,
+                fn_name: "set_zro_fee",
+                args: (&new_zro_fee,).into_val(&env),
+                sub_invokes: &[],
+            },
+        },
+        MockAuth {
+            address: &owner,
+            invoke: &MockAuthInvoke {
+                contract: &sml.address,
+                fn_name: "set_whitelisted_caller",
+                args: (&new_whitelisted,).into_val(&env),
+                sub_invokes: &[],
+            },
+        },
+    ]);
+
+    sml.set_fee_recipient(&new_fee_recipient);
+    sml.set_native_fee(&new_native_fee);
+    sml.set_zro_fee(&new_zro_fee);
+    sml.set_whitelisted_caller(&new_whitelisted);
+
+    assert_eq!(sml.fee_recipient(), new_fee_recipient);
+    assert_eq!(sml.native_fee(), new_native_fee);
+    assert_eq!(sml.zro_fee(), new_zro_fee);
+    assert_eq!(sml.whitelisted_caller(), new_whitelisted);
+}
+
+// ============================================================================
+// Metadata Tests
+// ============================================================================
+
+#[test]
+fn test_message_lib_metadata() {
+    let TestSetup { sml, fee_recipient, .. } = setup();
+
+    assert!(sml.is_supported_eid(&123u32));
+    assert_eq!(sml.message_lib_type(), MessageLibType::SendAndReceive);
+    assert_eq!(sml.version(), MessageLibVersion { major: 0, minor: 0, endpoint_version: 2 });
+
+    assert_eq!(sml.fee_recipient(), fee_recipient);
+    assert_eq!(sml.native_fee(), 100);
+    assert_eq!(sml.zro_fee(), 99);
+}
+
+#[test]
+fn test_get_config_not_implemented() {
+    let TestSetup { env, sml, .. } = setup();
+
+    let oapp = Address::generate(&env);
+    let res = sml.try_get_config(&1u32, &oapp, &0u32);
+    assert_eq!(res.unwrap_err().unwrap(), SimpleMessageLibError::NotImplemented.into());
+}
+
+#[test]
+fn test_set_config_not_implemented() {
+    let TestSetup { env, sml, .. } = setup();
+
+    let oapp = Address::generate(&env);
+    let empty: Vec<SetConfigParam> = Vec::new(&env);
+    let res = sml.try_set_config(&oapp, &empty);
+    assert_eq!(res.unwrap_err().unwrap(), SimpleMessageLibError::NotImplemented.into());
+}
+
+// ============================================================================
+// Validate Packet Tests
+// ============================================================================
+
+#[test]
+fn test_validate_packet_calls_endpoint_verify() {
+    let TestSetup { env, sml, owner, endpoint, .. } = setup();
+
+    env.mock_all_auths_allowing_non_root_auth();
+
+    let (receiver_addr, receiver_bytes) = create_contract_receiver(&env);
+    let packet = create_packet_with_contract_receiver(&env, receiver_bytes);
+
+    let header_bytes = packet_codec_v1::encode_packet_header(&env, &packet);
+    let payload_hash = BytesN::from_array(&env, &[2u8; 32]);
+
+    env.mock_auths(&[MockAuth {
+        address: &owner,
+        invoke: &MockAuthInvoke {
+            contract: &sml.address,
+            fn_name: "validate_packet",
+            args: (&header_bytes, &payload_hash).into_val(&env),
+            sub_invokes: &[],
+        },
+    }]);
+
+    sml.validate_packet(&header_bytes, &payload_hash);
+
+    let (last_rl, last_origin, last_receiver, last_hash) =
+        MockEndpointClient::new(&env, &endpoint.address).last_verify();
+
+    assert_eq!(last_rl, sml.address);
+    assert_eq!(last_origin.src_eid, packet.src_eid);
+    assert_eq!(last_origin.nonce, packet.nonce);
+    assert_eq!(last_receiver, receiver_addr);
+    assert_eq!(last_hash, payload_hash);
+}
+
+#[test]
+#[should_panic(expected = "HostError: Error(Auth, InvalidAction)")]
+fn test_validate_packet_requires_whitelisted_caller_auth() {
+    let TestSetup { env, sml, .. } = setup();
+
+    let (_, receiver_bytes) = create_contract_receiver(&env);
+    let packet = create_packet_with_contract_receiver(&env, receiver_bytes);
+
+    let header_bytes = packet_codec_v1::encode_packet_header(&env, &packet);
+    let payload_hash = BytesN::from_array(&env, &[3u8; 32]);
+
+    // No auth mocked => should panic at whitelisted_caller.require_auth().
+    sml.validate_packet(&header_bytes, &payload_hash);
+}

package/contracts/message-libs/uln-302/src/errors.rs

@@ -2,23 +2,44 @@ use common_macros::contract_error;
 
 #[contract_error]
 pub enum Uln302Error {
+    /// Default executor configuration is not set for the destination endpoint
     DefaultExecutorConfigNotFound,
+    /// Default receive ULN configuration is not set for the source endpoint
     DefaultReceiveUlnConfigNotFound,
+    /// Default send ULN configuration is not set for the destination endpoint
     DefaultSendUlnConfigNotFound,
+    /// Optional DVNs list contains duplicate addresses
     DuplicateOptionalDVNs,
+    /// Required DVNs list contains duplicate addresses
     DuplicateRequiredDVNs,
+    /// Configuration bytes failed to parse as expected XDR type
     InvalidConfig,
+    /// Config type is not one of EXECUTOR, SEND_ULN, or RECEIVE_ULN
     InvalidConfigType,
+    /// Confirmations must be zero when using default confirmations
     InvalidConfirmations,
+    /// Packet header destination EID does not match this endpoint's EID
     InvalidEID,
+    /// Message size exceeds executor's configured maximum
     InvalidMessageSize,
+    /// Optional DVNs count exceeds maximum allowed (127)
     InvalidOptionalDVNCount,
+    /// Optional DVNs must be empty when using default optional DVNs
     InvalidOptionalDVNs,
+    /// Optional DVN threshold is invalid (must be 0 with no DVNs, or 1 to DVN count)
     InvalidOptionalDVNThreshold,
+    /// Required DVNs count exceeds maximum allowed (127)
     InvalidRequiredDVNCount,
+    /// Required DVNs must be empty when using default required DVNs
     InvalidRequiredDVNs,
+    /// Sender address must be a contract (C-address), not an account (G-address)
+    InvalidSenderAddress,
+    /// Configuration must have at least one DVN (required or optional with threshold > 0)
     UlnAtLeastOneDVN,
+    /// Endpoint ID is not supported (missing default configurations)
     UnsupportedEid,
+    /// Message has not been verified by enough DVNs yet
     Verifying,
+    /// Executor max message size cannot be zero
     ZeroMessageSize,
 }

package/contracts/message-libs/uln-302/src/interfaces/receive_uln.rs

@@ -36,7 +36,7 @@ pub trait IReceiveUln302 {
     /// True if the message has been verified by enough DVNs to be committed, false otherwise
     fn verifiable(env: &Env, packet_header: &Bytes, payload_hash: &BytesN<32>) -> bool;
 
-    /// Permissonless to commit a verified message to the endpoint after sufficient DVN verification.
+    /// Permissionless function to commit a verified message to the endpoint after sufficient DVN verification.
     ///
     /// Checks that all required DVNs and the optional DVN threshold have verified
     /// the message, then calls `verify` on the endpoint to make the message executable.

package/contracts/message-libs/uln-302/src/receive_uln.rs

@@ -35,7 +35,7 @@ impl IReceiveUln302 for Uln302 {
         .publish(env);
     }
 
-    /// Permissonless to commit a verified message to the endpoint after sufficient DVN verification.
+    /// Permissionless function to commit a verified message to the endpoint after sufficient DVN verification.
     ///
     /// Validates the packet header and checks that enough DVNs have verified the message
     /// (all required DVNs + optional DVN threshold). Once verified, cleans up DVN confirmation
@@ -168,9 +168,11 @@ impl Uln302 {
         let threshold = uln_config.optional_dvn_threshold as usize;
         let is_verified = |dvn: &Address| Self::verified(env, dvn, header_hash, payload_hash, uln_config.confirmations);
 
-        // check if all required DVNs are verified and the optional DVNs threshold is met
-        uln_config.required_dvns.iter().all(|dvn| is_verified(&dvn))
-            && uln_config.optional_dvns.iter().filter(is_verified).take(threshold).count() == threshold
+        // All required DVNs must be verified AND at least `threshold` optional DVNs must be verified
+        let all_required_verified = uln_config.required_dvns.iter().all(|dvn| is_verified(&dvn));
+        let optional_threshold_met =
+            uln_config.optional_dvns.iter().filter(is_verified).take(threshold).count() == threshold;
+        all_required_verified && optional_threshold_met
     }
 
     /// Checks if a DVN has submitted enough confirmations for the message.