CCTPBridgeAdapterLib

HOOKED BURNS: for a Lattice hook envelope the destination domain's destinationCaller MUST be the destination diamond (enforced outbound). Otherwise anyone can call Circle's transmitter directly and mint hook-less. TRUST MODEL: the inbound mint's correctness is rooted entirely in Circle's off-chain Iris attester set and denylist (the transmitter verifies the attestation signatures) — this adapter neither attests nor gates it. CCTP is a token bridge; it is intentionally NOT an IERC7786GatewaySource and is never routed through ERC7786OpenBridge / CrosschainLink. Reuses the shared safe-transfer / force-approve helpers (BridgeFungibleLib.pullExact, AdapterBaseLib.forceApprove); no bespoke ERC-20 plumbing.

Reverts CCTPZeroAddress if any address is zero (BEFORE deploying the executor, so the zero-address init-revert tests still hold). Called via delegatecall inside the diamond initializing window, so address(this) IS the diamond — the executor is bound to it immutably as its relay.

FAIL-LOUD identity registration (mirrors every other adapter's AlreadyRegistered guards): a chainId registers exactly once (CCTPChainAlreadyRegistered) and a domain belongs to exactly one chainId (CCTPDomainAlreadyRegistered) — a fat-fingered duplicate can no longer silently remap USDC burns to the wrong destination or clobber another chain's domain config. chainId 0 is rejected so the _domainOwner zero-sentinel stays unambiguous.

Tunables stay UPDATABLE (unlike identity), but only for a registered domain (CCTPDomainNotRegistered) — configuring an unowned domain is always a misconfiguration.

Reverts CCTPEmptyHookData BEFORE any work if hookData is empty — a hook-less burn must use depositForBurn so its DepositForBurn event and 7-arg CCTP call are unambiguous. For a Lattice hook envelope (_isHookEnvelope) it reverts CCTPHookWithoutDestinationCaller BEFORE any token movement if the destination domain's destinationCaller is bytes32(0): the domain MUST be locked to the destination diamond so only that diamond can receive the message (where a third party's hook-less relay is refused). Other hookData is relayed plainly at the destination, so it is not guarded.

The caller (each public entrypoint) owns the nonReentrant frame — _burn runs INSIDE it.

Split out of _burn to keep its stack shallow (no via-IR).

destinationCaller guard (Lattice hook envelopes only, per _isHookEnvelope; before ANY token movement): reverts CCTPHookWithoutDestinationCaller when the domain is permissionless. Other hookData is relayed plainly at the destination anyway, so the lock would protect no Lattice hook. maxFee guard (before ANY token movement): CCTP's TokenMessengerV2 requires amount > maxFee; the >= form also rejects a zero-amount burn. An unconfigured domain has maxFee == 0, mapping to CCTP's free permissionless standard transfer (passes for any amount > 0). Split out of _burn so the deep 8-arg external call has a shallow stack (no via-IR).

Forwards a resolved CctpBurnCall to CCTP: the plain 7-arg depositForBurn when hookData is empty, else the 8-arg depositForBurnWithHook. The bundle is a single memory arg so each field is an MLOAD at the call site — the deep call fits the legacy-codegen stack limit (no via-IR).

A message that passes every relayMessageWithHook check (a Lattice hooked burn for this adapter's TokenMessenger) is refused with CCTPHookRelayRequired BEFORE the mint — relaying it here would burn the CCTP nonce without ever running the hook. The one exception is its attested mintRecipient (compared as the full bytes32), which may take its funds hook-less, so a hook that can never succeed cannot lock them. Every other message relays as before, so no message is refused by both entry points.

SECURITY MODEL: hookData is 100% attacker-controlled — anyone on any CCTP chain can burn 1 uUSDC toward this diamond with arbitrary hookData, and a valid Iris attestation authenticates only "someone burned >= 1 uUSDC with these bytes", NOT intent. So the hook is executed through the role-less, fund-less CCTPHookExecutor (the ONLY caller of the target) with a FIXED selector and CONTEXT ARGS READ FROM THE ATTESTED MESSAGE (never from hookData). Order — ALL validation BEFORE the external mint so a revert consumes nothing:

1. pure validation: length, header/body version, header recipient == this TokenMessenger, and a well-formed Lattice envelope (length >= 24 && leading magic — never an abi.decode);
2. mint via MessageTransmitterV2.receiveMessage (revert CCTPRelayFailed on false);
3. LENIENT executeHook — a reverting/return-bombing target does NOT revert the relay (the mint stands, the nonce is consumed). A hostile hook re-entering relayMessage/depositForBurn hits the shared reentrancy guard → the inner call reverts → the executor reports false → this outer relay still completes. The exception is a target whose OWN frame runs out of gas: the executor reverts ICCTPHookExecutor.CCTPHookOutOfGas, unwinding the mint so the nonce stays live. A sub-call's out-of-gas is an ordinary revert unless the target re-raises it (ICCTPHookReceiver);
4. emit HookExecuted + RelayedMessage.

Checks, in order: length >= 376, header AND body version == 1, header recipient == tokenMessenger_ (else NotBurnMessage); then a Lattice envelope at byte 376 per _isHookEnvelope (else InvalidHookData). The length check runs first so no fixed-offset read touches a short message.

TWO cheap comparisons — never an abi.decode that could revert on attacker garbage (the || short-circuits before slicing on < 24 B).

Split out of relayMessageWithHook purely to keep that function's stack shallow (no via-IR). All context is read from the message, not from hookData. Emits HookExecuted.

For eip-155 chains the reference IS the chainId. Reverts CCTPChainReferenceTooLong if > 32 bytes.