feat:offramp only if more than zero balance

[subhasishgoswami]

No description provided.

[octane-security-app]

Summary by Octane

New Contracts

No new contracts were added in this PR.

Updated Contracts

• OfframpTokensHook.sol: Enhanced token handling by sorting, uniquifying, and streamlining execution array updates for native and ERC20 tokens.

---

🔗 Commit Hash: da25e89

[graphite-app]

How to use the Graphite Merge Queue

Add the label contracts to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

[octane-security-app]

Overview

Vulnerabilities found:	1
Severity breakdown:	1 Critical

Detailed findings

src/hooks/tokens/OfframpTokensHook.sol

• Unbounded user-controlled tokens array iteration in OfframpTokensHook causes paymaster deposit drain and cross-chain relayer gas grief. See more

---

🔗 Commit Hash: da25e89
🛡️ Octane Dashboard: All vulnerabilities

[graphite-app]

Graphite Automations

"Request reviewers once CI passes" took an action on this PR • (10/23/25)

1 reviewer was added to this PR based on 's automation.

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: In-place Sorting Alters Token Order

The getExecutions function sorts and deduplicates the tokens array in-place, which is decoded from calldata. This modifies the order of tokens from the caller's input, resulting in a breaking behavioral change for any code relying on the original token sequence.