DestChainConfigV2 to Onramp- PR 287 - Chainlink Labs

1. Introduction

Chainlink Labs engaged Halborn to conduct a security assessment of several packages for the Aptos blockchain, beginning on September 8th, 2025, and ending on September 12th, 2025. This security assessment focused on the smart contracts within the chainlink-aptos GitHub repository; commit hashes and further details can be found in the Scope section of this report.

The engagement was performed to validate that the V2 migration and configuration changes are upgrade-safe and to identify functional and security issues introduced by the change.

2. Assessment Summary

The team at Halborn assigned one full-time security engineer to verify the security of the smart contracts. The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.

The purpose of this assessment is to:

• Ensure that smart contract functions operate as intended.

• Identify potential security issues with the smart contracts.

In summary, Halborn identified some improvements to reduce the likelihood and impact of risks, which were partially addressed by the Chainlink team. The main ones were the following:

• Provide explicit router_state_address values as migration inputs for each destination. Alternatively, ensure ccip_send is gated to return a clear "not configured" error until a non-zero, non-state-address value is set.

• Impose a reasonable upper bound on fee_tokens.length() or provide documented batching guidance and tooling to process withdrawals in smaller chunks.

• Use error::permission_denied(E_MUST_BE_CALLED_BY_ROUTER) instead of error::invalid_argument(...) for router authorization checks in both V1 and V2 ccip_send.

3. Test Approach and Methodology

Halborn performed a combination of the manual view of the code and automated security testing to balance efficiency, timeliness, practicality, and accuracy regarding the scope of the smart contract assessment. While manual testing is recommended to uncover flaws in logic, process, and implementation, automated testing techniques help enhance the coverage of smart contracts. They can quickly identify items that do not follow security best practices. The following phases and associated tools were used throughout the term of the assessment:

• Research into the architecture, purpose, and use of the platform.

• Manual code review and walkthrough.

• Manual assessment of the critical Move variables and functions in scope to identify any vulnerability classes related to arithmetic or logic.

• Cross-contract call controls.

• Logical controls related to the platform architecture.

• Review unit tests.