Add Monad CCIP deploy scripts, relay hardening, and bridge contract updates.

Includes Monad↔Chain138 CCIP proof/deploy/verify tooling, relay service guards, bridge integration tweaks, and frontend ENS/network config follow-ups. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-13 12:52:49 -07:00
parent 78edb86c3b
commit 1ec308c3a0
26 changed files with 5292 additions and 79 deletions
--- a/scripts/deployment/check-balances-gas-and-deploy.sh
+++ b/scripts/deployment/check-balances-gas-and-deploy.sh
@@ -225,6 +225,7 @@ check_network "Ethereum Sepolia"  "${ETHEREUM_SEPOLIA_RPC:-}"     "11155111" "ET
 check_network "Polygon Amoy"      "${POLYGON_AMOY_RPC:-}"         "80002"  "MATIC" "5000000" "$(get_gas_price_for_chain 80002 "${POLYGON_AMOY_RPC:-}" "30000000000")" || true
 check_network "Base Sepolia"      "${BASE_SEPOLIA_RPC:-}"          "84532"  "ETH"   "5000000" "$(get_gas_price_for_chain 84532 "${BASE_SEPOLIA_RPC:-}" "100000000")" || true
 check_network "Optimism Sepolia" "${OPTIMISM_SEPOLIA_RPC:-}"      "11155420" "ETH"  "5000000" "$(get_gas_price_for_chain 11155420 "${OPTIMISM_SEPOLIA_RPC:-}" "1000000")" || true
+check_network "Monad Mainnet"    "${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}" "143" "MON" "5000000" "$(get_gas_price_for_chain 143 "${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}" "102000000000")" || true

 echo ""
 echo "Gas token summary: each chain uses only its native token for gas. ERC-20 (USDT, LINK, etc.) cannot pay gas."
--- a/scripts/deployment/complete-config-monad-chain138.sh
+++ b/scripts/deployment/complete-config-monad-chain138.sh
@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+# Wire Chain 138 <-> Monad CCIP WETH bridges (addDestination both directions).
+# Also enables MONAD_SELECTOR on Chain 138 custom CCIPRouter allowlist when set.
+#
+# Requires in .env:
+#   CCIPWETH9_BRIDGE_CHAIN138, CCIPWETH10_BRIDGE_CHAIN138
+#   CCIPWETH9_BRIDGE_MONAD, CCIPWETH10_BRIDGE_MONAD
+#   CHAIN138_SELECTOR, MONAD_SELECTOR, CCIP_ROUTER (138 custom router)
+#   RPC_URL_138 / CHAIN138_RPC, MONAD_MAINNET_RPC
+#
+# Usage:
+#   DRY_RUN=1 ./scripts/deployment/complete-config-monad-chain138.sh
+#   ./scripts/deployment/complete-config-monad-chain138.sh
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+fi
+
+DRY_RUN="${DRY_RUN:-0}"
+CHAIN138_RPC="${RPC_URL_138:-${CHAIN138_RPC:-http://192.168.11.211:8545}}"
+MONAD_RPC="${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}"
+if [[ "$MONAD_RPC" =~ infura\.io/v3/?$ ]]; then
+  MONAD_RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+fi
+CHAIN138_SELECTOR="${CHAIN138_SELECTOR:-}"
+MONAD_SELECTOR="${MONAD_SELECTOR:-8481857512324358265}"
+CCIP_ROUTER="${CCIP_ROUTER:-}"
+GAS_138="--legacy --gas-limit 250000 --gas-price 2000000000 --timeout 600"
+
+W9_138="${CCIPWETH9_BRIDGE_CHAIN138:-}"
+W10_138="${CCIPWETH10_BRIDGE_CHAIN138:-}"
+W9_MONAD="${CCIPWETH9_BRIDGE_MONAD:-}"
+W10_MONAD="${CCIPWETH10_BRIDGE_MONAD:-}"
+
+missing=0
+for v in W9_138 W10_138 W9_MONAD W10_MONAD CHAIN138_SELECTOR; do
+  if [[ -z "${!v}" ]]; then
+    echo "Missing: $v" >&2
+    missing=1
+  fi
+done
+[[ "$missing" == "1" ]] && exit 1
+
+if ! require_private_key_env; then
+  exit 1
+fi
+
+dest_enabled() {
+  local rpc="$1" bridge="$2" selector="$3"
+  local enabled
+  enabled=$(cast call "$bridge" "destinations(uint64)(uint64,address,bool)" "$selector" --rpc-url "$rpc" 2>/dev/null | awk 'NR==3{print $1}')
+  [[ "$enabled" == "true" ]]
+}
+
+add_dest() {
+  local rpc="$1" bridge="$2" selector="$3" receiver="$4" label="$5"
+  local gas_opts="$6"
+  if dest_enabled "$rpc" "$bridge" "$selector"; then
+    echo "Skip (already enabled): $label"
+    return 0
+  fi
+  if [[ "$DRY_RUN" == "1" ]]; then
+    echo "[DRY RUN] $label: cast send $bridge addDestination($selector,$receiver) --rpc-url ${rpc%%\?*} $gas_opts"
+    return 0
+  fi
+  echo "=== $label ==="
+  # shellcheck disable=SC2086
+  cast send "$bridge" "addDestination(uint64,address)" "$selector" "$receiver" \
+    --rpc-url "$rpc" --private-key "$PRIVATE_KEY" $gas_opts
+}
+
+ensure_router_supports_monad() {
+  [[ -z "$CCIP_ROUTER" ]] && return 0
+  local rout="${CCIP_ROUTER,,}"
+  local supported
+  supported=$(cast call "$rout" "supportedChains(uint64)(bool)" "$MONAD_SELECTOR" --rpc-url "$CHAIN138_RPC" 2>/dev/null || echo "false")
+  if [[ "$supported" == "true" ]]; then
+    echo "CCIP router: Monad selector already supported ($MONAD_SELECTOR)"
+    return 0
+  fi
+  if [[ "$DRY_RUN" == "1" ]]; then
+    echo "[DRY RUN] CCIP router addSupportedChain($MONAD_SELECTOR) on $rout"
+    return 0
+  fi
+  echo "=== Chain 138 CCIP router: enable Monad selector ==="
+  # shellcheck disable=SC2086
+  cast send "$rout" "addSupportedChain(uint64)" "$MONAD_SELECTOR" \
+    --rpc-url "$CHAIN138_RPC" --private-key "$PRIVATE_KEY" $GAS_138
+}
+
+echo "=== Monad <-> Chain 138 CCIP destination wiring ==="
+ensure_router_supports_monad
+
+# 138 -> Monad
+add_dest "$CHAIN138_RPC" "$W9_138" "$MONAD_SELECTOR" "$W9_MONAD" "138 WETH9 -> Monad" "$GAS_138"
+add_dest "$CHAIN138_RPC" "$W10_138" "$MONAD_SELECTOR" "$W10_MONAD" "138 WETH10 -> Monad" "$GAS_138"
+
+# Monad -> 138
+add_dest "$MONAD_RPC" "$W9_MONAD" "$CHAIN138_SELECTOR" "$W9_138" "Monad WETH9 -> 138" "--legacy --timeout 600"
+add_dest "$MONAD_RPC" "$W10_MONAD" "$CHAIN138_SELECTOR" "$W10_138" "Monad WETH10 -> 138" "--legacy --timeout 600"
+
+echo "Done. Fund bridges with LINK/MON per CCIP_BRIDGE_DESTINATIONS_AND_LINK_FUNDING.md before live transfers."
--- a/scripts/deployment/deploy-monad-ccip-stack.sh
+++ b/scripts/deployment/deploy-monad-ccip-stack.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Deploy CCIP WETH9/WETH10 bridge stack on Monad mainnet (chain 143).
+# Uses WMON as wrapped native and native MON for CCIP fees (feeToken=0) until LINK exists on-chain.
+#
+# Usage:
+#   cd smom-dbis-138
+#   DRY_RUN=1 ./scripts/deployment/deploy-monad-ccip-stack.sh
+#   ./scripts/deployment/deploy-monad-ccip-stack.sh --execute
+#   ./scripts/deployment/deploy-monad-ccip-stack.sh --execute --configure-138
+#
+# After deploy: record addresses in .env, run complete-config-monad-chain138.sh, verify on monadscan.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+fi
+
+EXECUTE=0
+CONFIGURE_138=0
+FORCE=0
+DRY_RUN="${DRY_RUN:-0}"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --execute) EXECUTE=1; shift ;;
+    --configure-138) CONFIGURE_138=1; shift ;;
+    --force) FORCE=1; shift ;;
+    --dry-run) DRY_RUN=1; shift ;;
+    *) echo "Unknown arg: $1" >&2; exit 1 ;;
+  esac
+done
+
+RPC="${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}"
+if [[ "$RPC" =~ infura\.io/v3/?$ ]]; then
+  RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+fi
+CHAIN_ID=143
+WMON="${WMON_MAINNET:-0x754704bc059f8c67012fed69bc8a327a5aafb603}"
+
+export CCIP_MONAD_ROUTER="${CCIP_MONAD_ROUTER:-0x33566fE5976AAa420F3d5C64996641Fc3858CaDB}"
+export MONAD_SELECTOR="${MONAD_SELECTOR:-8481857512324358265}"
+export CCIP_MONAD_LINK_TOKEN="${CCIP_MONAD_LINK_TOKEN:-0x0000000000000000000000000000000000000000}"
+export WETH9_MONAD="${WETH9_MONAD:-$WMON}"
+export WETH10_MONAD="${WETH10_MONAD:-$WMON}"
+
+echo "=== Monad CCIP stack deploy (chain $CHAIN_ID) ==="
+echo "RPC: ${RPC%%\?*}"
+echo "WMON: $WMON"
+echo "CCIP router: $CCIP_MONAD_ROUTER"
+echo "MONAD selector: $MONAD_SELECTOR"
+echo "Fee token: ${CCIP_MONAD_LINK_TOKEN} (0 = native MON)"
+
+if [[ "$FORCE" != "1" && -n "${CCIPWETH9_BRIDGE_MONAD:-}" && -n "${CCIPWETH10_BRIDGE_MONAD:-}" ]]; then
+  echo "Skip: CCIPWETH9_BRIDGE_MONAD and CCIPWETH10_BRIDGE_MONAD already set. Use --force to redeploy."
+  exit 0
+fi
+
+if [[ "$DRY_RUN" == "1" ]]; then
+  echo ""
+  echo "[DRY RUN] forge script script/DeployAll.s.sol:DeployAll \\"
+  echo "  --rpc-url \"$RPC\" --chain-id $CHAIN_ID --broadcast --legacy -vvv"
+  echo ""
+  echo "Unset DRY_RUN and pass --execute to broadcast (requires PRIVATE_KEY in .env)."
+  exit 0
+fi
+
+if [[ "$EXECUTE" != "1" ]]; then
+  echo ""
+  echo "Pass --execute to broadcast (requires PRIVATE_KEY in .env)."
+  exit 0
+fi
+
+if ! require_private_key_env; then
+  exit 1
+fi
+
+"$SCRIPT_DIR/preflight-monad-deploy.sh"
+
+GAS_OPTS="--legacy"
+BROADCAST="--broadcast"
+CMD=(forge script script/DeployAll.s.sol:DeployAll
+  --rpc-url "$RPC"
+  --chain-id "$CHAIN_ID"
+  --private-key "$PRIVATE_KEY"
+  $BROADCAST
+  $GAS_OPTS
+  -vvv)
+
+echo ""
+echo "Broadcasting DeployAll on Monad..."
+"${CMD[@]}"
+
+OUT_DIR="$PROJECT_ROOT/broadcast/DeployAll.s.sol/$CHAIN_ID"
+echo ""
+echo "=== Deploy complete ==="
+echo "Inspect broadcast logs: $OUT_DIR"
+echo "Add to smom-dbis-138/.env:"
+echo "  WETH9_MONAD=$WETH9_MONAD"
+echo "  WETH10_MONAD=$WETH10_MONAD"
+echo "  CCIPWETH9_BRIDGE_MONAD=<from script output>"
+echo "  CCIPWETH10_BRIDGE_MONAD=<from script output>"
+echo "Verify: cd smom-dbis-138 && ./scripts/deployment/verify-all-networks-explorers.sh (when Monad supported)"
+
+if [[ "$CONFIGURE_138" == "1" ]]; then
+  echo ""
+  echo "Configuring Chain 138 <-> Monad destinations..."
+  "$SCRIPT_DIR/complete-config-monad-chain138.sh" || true
+fi
--- a/scripts/deployment/deploy-tokens-and-weth-all-chains-skip-canonical.sh
+++ b/scripts/deployment/deploy-tokens-and-weth-all-chains-skip-canonical.sh
@@ -79,7 +79,7 @@ done
 # DeployAll.s.sol supports: 1, 25, 56, 137, 100, 43114, 8453, 42161, 10. 651940 = env validation only.
 # Celo / Wemix are included here for c* / cW* deployment even though their WETH/bridge deploy
 # flow is handled separately via deploy-bridges-config-ready-chains.sh.
-ALL_CHAINS="1:Mainnet:ETH_MAINNET_RPC_URL 25:Cronos:CRONOS_RPC_URL 56:BSC:BSC_RPC_URL 137:Polygon:POLYGON_RPC_URL 100:Gnosis:GNOSIS_RPC_URL 43114:Avalanche:AVALANCHE_RPC_URL 8453:Base:BASE_RPC_URL 42161:Arbitrum:ARBITRUM_RPC_URL 10:Optimism:OPTIMISM_RPC_URL 42220:Celo:CELO_RPC 1111:Wemix:WEMIX_RPC 651940:ALL:CHAIN_651940_RPC"
+ALL_CHAINS="1:Mainnet:ETH_MAINNET_RPC_URL 25:Cronos:CRONOS_RPC_URL 56:BSC:BSC_RPC_URL 137:Polygon:POLYGON_RPC_URL 100:Gnosis:GNOSIS_RPC_URL 43114:Avalanche:AVALANCHE_RPC_URL 8453:Base:BASE_RPC_URL 42161:Arbitrum:ARBITRUM_RPC_URL 10:Optimism:OPTIMISM_RPC_URL 143:Monad:MONAD_MAINNET_RPC 42220:Celo:CELO_RPC 1111:Wemix:WEMIX_RPC 651940:ALL:CHAIN_651940_RPC"

 # Fallback RPC env names (some scripts use different names)
 fallback_rpc() {
@@ -97,6 +97,7 @@ fallback_rpc() {
      8453) rpc="${BASE_MAINNET_RPC:-}";;
      42161) rpc="${ARBITRUM_MAINNET_RPC:-}";;
      10)  rpc="${OPTIMISM_MAINNET_RPC:-}";;
+      143) rpc="${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}";;
      42220) rpc="${CELO_RPC:-${CELO_MAINNET_RPC:-}}";;
      1111) rpc="${WEMIX_RPC:-${WEMIX_MAINNET_RPC:-}}";;
      651940) rpc="${CHAIN_651940_RPC:-${ALL_MAINNET_RPC:-}}";;
@@ -156,6 +157,7 @@ run_deploy_all() {
    8453) weth9_var="WETH9_BASE";      weth10_var="WETH10_BASE" ;;
    42161) weth9_var="WETH9_ARBITRUM"; weth10_var="WETH10_ARBITRUM" ;;
    10)  weth9_var="WETH9_OPTIMISM";   weth10_var="WETH10_OPTIMISM" ;;
+    143) weth9_var="WETH9_MONAD";     weth10_var="WETH10_MONAD" ;;
    *)   echo "  Unsupported chain ID $chain_id"; return 1 ;;
  esac

--- a/scripts/deployment/preflight-monad-deploy.sh
+++ b/scripts/deployment/preflight-monad-deploy.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Preflight Monad mainnet (143) CCIP stack deploy: RPC, deployer MON balance, CCIP router code.
+#
+# Usage: cd smom-dbis-138 && ./scripts/deployment/preflight-monad-deploy.sh
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+fi
+
+DEPLOYER="${DEPLOYER_ADDRESS:-0x4A666F96fC8764181194447A7dFdb7d471b301C8}"
+RPC="${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}"
+# Infura template without expanded INFURA_PROJECT_ID is unusable — fall back to public RPC
+if [[ "$RPC" =~ infura\.io/v3/?$ ]]; then
+  RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+fi
+ROUTER="${CCIP_MONAD_ROUTER:-0x33566fE5976AAa420F3d5C64996641Fc3858CaDB}"
+MIN_MON="${MONAD_DEPLOY_MIN_MON:-1}"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+echo "=== Monad deploy preflight (chain 143) ==="
+echo "Deployer: $DEPLOYER"
+echo "RPC: ${RPC%%\?*}"
+
+if ! command -v cast >/dev/null 2>&1; then
+  echo -e "${RED}cast (Foundry) required${NC}" >&2
+  exit 1
+fi
+
+chain_id=$(cast chain-id --rpc-url "$RPC" 2>/dev/null || echo "")
+if [[ "$chain_id" != "143" ]]; then
+  echo -e "${RED}RPC chain-id=$chain_id (expected 143)${NC}" >&2
+  exit 1
+fi
+echo -e "${GREEN}RPC OK (chain 143)${NC}"
+
+bal_wei=$(cast balance "$DEPLOYER" --rpc-url "$RPC" 2>/dev/null || echo "0")
+bal_mon=$(cast --to-unit "$bal_wei" ether 2>/dev/null || echo "0")
+echo "Deployer MON balance: $bal_mon"
+if awk -v b="$bal_mon" -v m="$MIN_MON" 'BEGIN { exit !(b+0 >= m+0) }'; then
+  echo -e "${GREEN}Balance OK (>= ${MIN_MON} MON recommended)${NC}"
+else
+  echo -e "${RED}Insufficient MON (need >= ${MIN_MON})${NC}" >&2
+  exit 1
+fi
+
+code=$(cast code "$ROUTER" --rpc-url "$RPC" 2>/dev/null || echo "0x")
+if [[ "$code" == "0x" || -z "$code" ]]; then
+  echo -e "${RED}CCIP router has no code at $ROUTER${NC}" >&2
+  exit 1
+fi
+echo -e "${GREEN}CCIP router code present${NC}"
+
+if [[ -n "${CCIPWETH9_BRIDGE_MONAD:-}" && -n "${CCIPWETH10_BRIDGE_MONAD:-}" ]]; then
+  echo -e "${YELLOW}CCIPWETH9_BRIDGE_MONAD / CCIPWETH10_BRIDGE_MONAD already set — deploy script will skip unless forced${NC}"
+fi
+
+echo ""
+echo "Preflight OK. Next:"
+echo "  DRY_RUN=1 ./scripts/deployment/deploy-monad-ccip-stack.sh"
+echo "  ./scripts/deployment/deploy-monad-ccip-stack.sh --execute"
--- a/scripts/deployment/proof-ccip-chain138-monad.sh
+++ b/scripts/deployment/proof-ccip-chain138-monad.sh
@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# Canary CCIP proof: Chain 138 -> Monad (143) via CCIPWETH9Bridge (LINK fees on 138).
+#
+# Source-side only until a Monad inbound relay profile exists; verifies MessageSent on 138.
+#
+# Usage:
+#   DRY_RUN=1 ./scripts/deployment/proof-ccip-chain138-monad.sh
+#   ./scripts/deployment/proof-ccip-chain138-monad.sh
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+fi
+
+DRY_RUN="${DRY_RUN:-0}"
+AMOUNT_ETH="${AMOUNT_ETH:-0.001}"
+RPC="${RPC_URL_138:-http://192.168.11.211:8545}"
+BRIDGE="${CCIPWETH9_BRIDGE_CHAIN138:-}"
+SEL="${MONAD_SELECTOR:-8481857512324358265}"
+WETH="${WETH9_CHAIN138:-${WETH9:-0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2}}"
+LINK="${LINK_TOKEN_CHAIN138:-0xb7721dD53A8c629d9f1Ba31a5819AFe250002b03}"
+GAS="--legacy --gas-limit 800000 --gas-price 2000000000"
+
+for v in BRIDGE PRIVATE_KEY; do
+  [[ -z "${!v}" ]] && { echo "Missing $v" >&2; exit 1; }
+done
+require_private_key_env || exit 1
+
+SENDER=$(cast wallet address --private-key "$PRIVATE_KEY")
+RECIPIENT="${PROOF_RECIPIENT:-$SENDER}"
+AMOUNT_WEI=$(cast --to-wei "$AMOUNT_ETH" ether)
+
+echo "=== Chain 138 -> Monad CCIP canary ==="
+echo "Bridge: $BRIDGE"
+echo "Amount: $AMOUNT_ETH WETH ($AMOUNT_WEI wei)"
+echo "Monad selector: $SEL"
+echo "Recipient (Monad): $RECIPIENT"
+
+if ! cast call "$BRIDGE" "destinations(uint64)(uint64,address,bool)" "$SEL" --rpc-url "$RPC" 2>/dev/null | awk 'NR==3{exit ($1=="true")?0:1}'; then
+  echo "ERROR: 138 bridge destination for Monad not enabled. Run complete-config-monad-chain138.sh" >&2
+  exit 1
+fi
+
+FEE_WEI=$(cast call "$BRIDGE" "calculateFee(uint64,uint256)" "$SEL" "$AMOUNT_WEI" --rpc-url "$RPC" | cast --to-dec)
+echo "CCIP fee (LINK wei): $FEE_WEI"
+
+if [[ "$DRY_RUN" == "1" ]]; then
+  echo "[DRY RUN] approve WETH + LINK, then sendCrossChain"
+  cast call "$BRIDGE" "sendCrossChain(uint64,address,uint256)" "$SEL" "$RECIPIENT" "$AMOUNT_WEI" \
+    --rpc-url "$RPC" --from "$SENDER" && echo "Simulation: OK" || echo "Simulation: FAILED"
+  exit 0
+fi
+
+cast send "$WETH" "approve(address,uint256)" "$BRIDGE" "$AMOUNT_WEI" \
+  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" $GAS --async
+cast send "$LINK" "approve(address,uint256)" "$BRIDGE" "$((FEE_WEI + 1))" \
+  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" $GAS --async
+sleep 5
+
+OUT=$(cast send "$BRIDGE" "sendCrossChain(uint64,address,uint256)" "$SEL" "$RECIPIENT" "$AMOUNT_WEI" \
+  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" $GAS --async)
+echo "$OUT"
+HASH=$(echo "$OUT" | awk '/transactionHash/{print $2}')
+REPORT="/home/intlc/projects/proxmox/reports/status/proof-ccip-chain138-monad-latest.json"
+mkdir -p "$(dirname "$REPORT")"
+cat > "$REPORT" <<EOF
+{
+  "generatedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+  "direction": "chain138_to_monad",
+  "amountEth": "$AMOUNT_ETH",
+  "amountWei": "$AMOUNT_WEI",
+  "feeWei": "$FEE_WEI",
+  "bridge": "$BRIDGE",
+  "recipient": "$RECIPIENT",
+  "txHash": "${HASH:-}",
+  "note": "138 custom CCIP router is event-only; Monad delivery requires relay profile when available"
+}
+EOF
+echo "Report: $REPORT"
--- a/scripts/deployment/proof-ccip-monad-chain138.sh
+++ b/scripts/deployment/proof-ccip-monad-chain138.sh
@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+# Canary CCIP proof: Monad (143) -> Chain 138 via CCIPWETH9Bridge (native MON fees).
+#
+# Usage:
+#   DRY_RUN=1 ./scripts/deployment/proof-ccip-monad-chain138.sh
+#   ./scripts/deployment/proof-ccip-monad-chain138.sh
+#   AMOUNT_ETH=0.001 ./scripts/deployment/proof-ccip-monad-chain138.sh
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+fi
+
+DRY_RUN="${DRY_RUN:-0}"
+AMOUNT_ETH="${AMOUNT_ETH:-0.001}"
+MONAD_RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+if [[ "${MONAD_MAINNET_RPC:-}" =~ infura\.io/v3/?$ ]]; then
+  MONAD_RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+elif [[ -n "${MONAD_MAINNET_RPC:-}" ]]; then
+  MONAD_RPC="$MONAD_MAINNET_RPC"
+fi
+
+BRIDGE="${CCIPWETH9_BRIDGE_MONAD:-}"
+WMON="${WMON_MAINNET:-0x754704Bc059F8C67012fEd69BC8A327a5aafb603}"
+SEL="${CHAIN138_SELECTOR:-}"
+
+for v in BRIDGE SEL PRIVATE_KEY; do
+  if [[ -z "${!v}" ]]; then
+    echo "Missing: $v" >&2
+    exit 1
+  fi
+done
+
+if ! require_private_key_env; then
+  exit 1
+fi
+
+SENDER=$(cast wallet address --private-key "$PRIVATE_KEY")
+RECIPIENT="${PROOF_RECIPIENT:-$SENDER}"
+AMOUNT_WEI=$(cast --to-wei "$AMOUNT_ETH" ether)
+
+echo "=== Monad -> Chain 138 CCIP canary ==="
+echo "Bridge: $BRIDGE"
+echo "WMON: $WMON"
+echo "Amount: $AMOUNT_ETH WMON ($AMOUNT_WEI wei)"
+echo "Recipient (138): $RECIPIENT"
+echo "Selector: $SEL"
+
+FEE_WEI=$(cast call "$BRIDGE" "calculateFee(uint64,uint256)" "$SEL" "$AMOUNT_WEI" --rpc-url "$MONAD_RPC" | cast --to-dec)
+echo "CCIP fee (native MON): $FEE_WEI wei"
+
+BAL=$(cast call "$WMON" "balanceOf(address)(uint256)" "$SENDER" --rpc-url "$MONAD_RPC" | cast --to-dec)
+echo "Deployer WMON balance: $BAL wei"
+
+if [[ "$BAL" -lt "$AMOUNT_WEI" ]]; then
+  WRAP=$((AMOUNT_WEI - BAL + 1000000000000000))
+  echo "Wrapping $WRAP wei MON -> WMON via deposit()"
+  if [[ "$DRY_RUN" == "1" ]]; then
+    echo "[DRY RUN] cast send $WMON deposit() --value $WRAP --rpc-url $MONAD_RPC"
+  else
+    cast send "$WMON" "deposit()" --value "$WRAP" \
+      --rpc-url "$MONAD_RPC" --private-key "$PRIVATE_KEY" --legacy
+  fi
+fi
+
+if [[ "$DRY_RUN" == "1" ]]; then
+  echo "[DRY RUN] cast send $WMON approve($BRIDGE,$AMOUNT_WEI)"
+  echo "[DRY RUN] cast send $BRIDGE sendCrossChain($SEL,$RECIPIENT,$AMOUNT_WEI) --value $FEE_WEI"
+  cast call "$BRIDGE" "sendCrossChain(uint64,address,uint256)" "$SEL" "$RECIPIENT" "$AMOUNT_WEI" \
+    --rpc-url "$MONAD_RPC" --from "$SENDER" --value "$FEE_WEI" >/dev/null && echo "Simulation: OK" || echo "Simulation: FAILED"
+  exit 0
+fi
+
+cast send "$WMON" "approve(address,uint256)" "$BRIDGE" "$AMOUNT_WEI" \
+  --rpc-url "$MONAD_RPC" --private-key "$PRIVATE_KEY" --legacy
+
+OUT=$(cast send "$BRIDGE" "sendCrossChain(uint64,address,uint256)" "$SEL" "$RECIPIENT" "$AMOUNT_WEI" \
+  --value "$FEE_WEI" --rpc-url "$MONAD_RPC" --private-key "$PRIVATE_KEY" --legacy)
+echo "$OUT"
+HASH=$(echo "$OUT" | awk '/transactionHash/{print $2}')
+echo ""
+echo "Submitted: $HASH"
+echo "Monad explorer: https://monadscan.com/tx/${HASH}"
+echo "Report: reports/status/proof-ccip-monad-chain138-latest.json"
+
+mkdir -p "/home/intlc/projects/proxmox/reports/status"
+REPORT="/home/intlc/projects/proxmox/reports/status/proof-ccip-monad-chain138-latest.json"
+cat > "$REPORT" <<EOF
+{
+  "generatedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+  "direction": "monad_to_chain138",
+  "amountEth": "$AMOUNT_ETH",
+  "amountWei": "$AMOUNT_WEI",
+  "feeWei": "$FEE_WEI",
+  "bridge": "$BRIDGE",
+  "recipient": "$RECIPIENT",
+  "txHash": "${HASH:-}",
+  "monadExplorer": "https://monadscan.com/tx/${HASH:-}"
+}
+EOF
--- a/scripts/deployment/verify-all-networks-explorers.sh
+++ b/scripts/deployment/verify-all-networks-explorers.sh
@@ -46,6 +46,7 @@ step "Ethereum Mainnet CWMultiTokenBridgeL2" bash "$SCRIPT_DIR/verify-mainnet-cw
 step "Ethereum Mainnet cW* (CompliantWrappedToken)" bash "$SCRIPT_DIR/verify-mainnet-cw-etherscan.sh" || true
 step "Multichain cW* (all CW*_* except MAINNET)" bash "$SCRIPT_DIR/verify-multichain-cw-etherscan.sh" || true
 step "Avalanche + Arbitrum WETH/CCIP bridges" bash "$SCRIPT_DIR/verify-deployed-contracts.sh" || true
+step "Monad CCIP bridges (chain 143)" bash "$SCRIPT_DIR/verify-monad-ccip-bridges.sh" || true

 # Bytecode + manual-verify instructions (no explorer API key required).
 step "Cronos deployments + manual verify runbook" bash "$SCRIPT_DIR/verify-cronos-contracts.sh" || true
--- a/scripts/deployment/verify-mainnet-cw-etherscan.sh
+++ b/scripts/deployment/verify-mainnet-cw-etherscan.sh
@@ -47,7 +47,7 @@ if [[ -z "$ADMIN" || "$ADMIN" == "0x0000000000000000000000000000000000000000" ]]
 fi

 verify_one() {
-  local envkey="$1" cname="$2" sym="$3"
+  local envkey="$1" cname="$2" sym="$3" dec="${4:-6}"
  local addr
  addr="${!envkey:-}"
  if [[ -z "$addr" ]]; then
@@ -55,7 +55,7 @@ verify_one() {
    return 0
  fi
  local enc
-  enc="$(cast abi-encode "constructor(string,string,uint8,address)" "$cname" "$sym" 6 "$ADMIN")"
+  enc="$(cast abi-encode "constructor(string,string,uint8,address)" "$cname" "$sym" "$dec" "$ADMIN")"
  if $DRY_RUN; then
    echo "forge verify-contract --chain-id 1 --num-of-optimizations 200 --via-ir --constructor-args \"$enc\" --etherscan-api-key \"\$ETHERSCAN_API_KEY\" \"$addr\" contracts/tokens/CompliantWrappedToken.sol:CompliantWrappedToken"
    return 0
@@ -82,24 +82,33 @@ verify_one() {
  fi
 }

+export FOUNDRY_SRC="contracts/tokens,contracts/interfaces"
+export FOUNDRY_OUT="out/scopes/tokens"
+export FOUNDRY_CACHE_PATH="cache/scopes/tokens"
+
+if ! $DRY_RUN; then
+  bash "$PROJECT_ROOT/scripts/forge/scope.sh" build tokens -q
+fi
+
 echo "=== Verify Mainnet CompliantWrappedToken (admin=$ADMIN) ==="
-# envVar|constructor name|symbol — must match DeployCWTokens.s.sol
-while IFS='|' read -r envkey cname sym; do
+# envVar|constructor name|symbol|decimals — must match deploy constructors
+while IFS='|' read -r envkey cname sym dec; do
  [[ -z "$envkey" ]] && continue
-  verify_one "$envkey" "$cname" "$sym"
+  verify_one "$envkey" "$cname" "$sym" "${dec:-6}"
 done <<'EOF'
-CWUSDT_MAINNET|Wrapped cUSDT|cWUSDT
-CWUSDC_MAINNET|Wrapped cUSDC|cWUSDC
-CWEURC_MAINNET|Wrapped cEURC|cWEURC
-CWEURT_MAINNET|Wrapped cEURT|cWEURT
-CWGBPC_MAINNET|Wrapped cGBPC|cWGBPC
-CWGBPT_MAINNET|Wrapped cGBPT|cWGBPT
-CWAUDC_MAINNET|Wrapped cAUDC|cWAUDC
-CWJPYC_MAINNET|Wrapped cJPYC|cWJPYC
-CWCHFC_MAINNET|Wrapped cCHFC|cWCHFC
-CWCADC_MAINNET|Wrapped cCADC|cWCADC
-CWXAUC_MAINNET|Wrapped cXAUC|cWXAUC
-CWXAUT_MAINNET|Wrapped cXAUT|cWXAUT
+CWUSDT_MAINNET|Wrapped cUSDT|cWUSDT|6
+CWUSDC_MAINNET|Wrapped cUSDC|cWUSDC|6
+CWEURC_MAINNET|Wrapped cEURC|cWEURC|6
+CWEURT_MAINNET|Wrapped cEURT|cWEURT|6
+CWGBPC_MAINNET|Wrapped cGBPC|cWGBPC|6
+CWGBPT_MAINNET|Wrapped cGBPT|cWGBPT|6
+CWAUDC_MAINNET|Wrapped cAUDC|cWAUDC|6
+CWJPYC_MAINNET|Wrapped cJPYC|cWJPYC|6
+CWCHFC_MAINNET|Wrapped cCHFC|cWCHFC|6
+CWCADC_MAINNET|Wrapped cCADC|cWCADC|6
+CWXAUC_MAINNET|Wrapped cXAUC|cWXAUC|6
+CWXAUT_MAINNET|Wrapped cXAUT|cWXAUT|6
+CWBTC_MAINNET|Wrapped cBTC|cWBTC|8
 EOF

 echo "Done."
--- a/scripts/deployment/verify-monad-ccip-bridges.sh
+++ b/scripts/deployment/verify-monad-ccip-bridges.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Verify Monad (chain 143) CCIP WETH9/WETH10 bridges on monadscan (Etherscan V2 API).
+#
+# Usage: cd smom-dbis-138 && ./scripts/deployment/verify-monad-ccip-bridges.sh
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+fi
+
+ROUTER="${CCIP_MONAD_ROUTER:-0x33566fE5976AAa420F3d5C64996641Fc3858CaDB}"
+WMON="${WMON_MAINNET:-0x754704Bc059F8C67012fEd69BC8A327a5aafb603}"
+FEE="${CCIP_MONAD_LINK_TOKEN:-0x0000000000000000000000000000000000000000}"
+W9="${CCIPWETH9_BRIDGE_MONAD:-}"
+W10="${CCIPWETH10_BRIDGE_MONAD:-}"
+
+if [[ -z "$W9" || -z "$W10" ]]; then
+  echo "Set CCIPWETH9_BRIDGE_MONAD and CCIPWETH10_BRIDGE_MONAD in .env" >&2
+  exit 1
+fi
+
+if [[ -z "${ETHERSCAN_API_KEY:-}" ]]; then
+  echo "ETHERSCAN_API_KEY required (Etherscan V2 unified key for chainid=143)" >&2
+  exit 1
+fi
+
+CTOR9=$(cast abi-encode "constructor(address,address,address)" "$ROUTER" "$WMON" "$FEE")
+CTOR10=$(cast abi-encode "constructor(address,address,address)" "$ROUTER" "$WMON" "$FEE")
+
+echo "=== Verify CCIPWETH9Bridge on Monad ($W9) ==="
+forge verify-contract \
+  --chain-id 143 \
+  --num-of-optimizations 200 \
+  --watch \
+  --constructor-args "$CTOR9" \
+  --etherscan-api-key "$ETHERSCAN_API_KEY" \
+  "$W9" \
+  "contracts/ccip/CCIPWETH9Bridge.sol:CCIPWETH9Bridge"
+
+echo ""
+echo "=== Verify CCIPWETH10Bridge on Monad ($W10) ==="
+forge verify-contract \
+  --chain-id 143 \
+  --num-of-optimizations 200 \
+  --watch \
+  --constructor-args "$CTOR10" \
+  --etherscan-api-key "$ETHERSCAN_API_KEY" \
+  "$W10" \
+  "contracts/ccip/CCIPWETH10Bridge.sol:CCIPWETH10Bridge"
+
+echo ""
+echo "Verification submitted. Check https://monadscan.com/"