# Executor Allowlist Matrix

**Purpose:** Single source of truth for canonical addresses and permitted call graph for the Chain 138 → Ethereum Mainnet export path. Reference this in contract NatSpec and the CCIP-live runbook.

---

## Table 1 — Canonical addresses

### Chain 138 canonical inputs

Used only by StrategyExecutor138 / TreasuryVault as allowed tokens.

| Symbol      | Address (checksummed)                              |
| ----------- | -------------------------------------------------- |
| cUSDC_138   | `0xf22258f57794CC8E06237084b353Ab30fFfa640b`       |
| cUSDT_138   | `0x93E66202A11B1772E55407B32B44e5Cd8eda7f22`       |
| WETH9_138   | `0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2`       |
| WETH10_138  | `0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f`       |

### Ethereum Mainnet canonical outputs

Used only by ReceiverExecutorMainnet for swaps/unwrap.

| Symbol         | Address (checksummed)                              |
| -------------- | -------------------------------------------------- |
| WETH9_mainnet  | `0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2`       |
| USDC_mainnet   | `0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48`       |
| USDT_mainnet   | `0xdAC17F958D2ee523a2206206994597C13D831ec7`       |

### CCIP core

| Role                    | Chain   | Address (checksummed)                              |
| ----------------------- | ------- | -------------------------------------------------- |
| CCIP Router             | Mainnet | `0x80226fc0Ee2b096224EeAc085Bb9a8cba1146f7D`       |
| CCIP Router             | 138     | `0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817`       |
| CCIPWETH9 Bridge        | 138     | `0xcacfd227A040002e49e2e01626363071324f820a`      |
| Ethereum Mainnet selector (decimal) | — | `5009297550715157269`                              |

---

## Table 2 — Permitted call graph

| Callee                  | Caller(s)                                                                 | Purpose |
| ----------------------- | ------------------------------------------------------------------------- | ------- |
| TreasuryVault           | StrategyExecutor138, CcipBridgeAdapter138, (optional LPManager)           | requestTransfer / pull for harvest, rebalance, export |
| TreasuryVault           | Admin only                                                               | Config: modules, token allowlist, caps |
| StrategyExecutor138     | Keeper / bot or multisig                                                 | harvestFees, rebalanceLp, exportToMainnet |
| StrategyExecutor138     | Admin only                                                               | ExportPolicy, router/LP allowlist |
| CcipBridgeAdapter138   | StrategyExecutor138 only                                                 | sendWeth9ToMainnet(amount, minAmount, deadline) |
| ReceiverExecutorMainnet | CCIP Router (or bridge callback)                                         | Receive CCIP transfer (WETH9) |
| ReceiverExecutorMainnet | Keeper (optional)                                                        | swap/unwrap to USDC, USDT, ETH |

---

## Table 3 — Token flow

| Stage                    | Token(s) allowed |
| ------------------------ | ---------------- |
| Leave TreasuryVault     | cUSDC_138, cUSDT_138, WETH9_138, WETH10_138 (canonical 138 list only) |
| Sent via CcipBridgeAdapter138 | WETH9_138 only |
| Received on Mainnet (ReceiverExecutorMainnet) | WETH9_mainnet only (from CCIP) |
| Swap/unwrap on Mainnet  | WETH9_mainnet, USDC_mainnet, USDT_mainnet, ETH (hardcoded addresses only) |

No calldata-provided token or receiver addresses for export or swap destinations.