diff --git a/.github/workflows/validate-omnl-rail.yml b/.github/workflows/validate-omnl-rail.yml
index 5cbb779..10b3f42 100644
--- a/.github/workflows/validate-omnl-rail.yml
+++ b/.github/workflows/validate-omnl-rail.yml
@@ -13,6 +13,7 @@ on:
     paths:
       - 'scripts/omnl/**'
       - 'docs/04-configuration/mifos-omnl-central-bank/**'
+      - '.gitignore'
       - '.github/workflows/validate-omnl-rail.yml'
 
 jobs:
@@ -29,10 +30,8 @@ jobs:
       - name: Transaction package CI smoke (fast ledger fixture)
         run: bash scripts/omnl/run-transaction-package-ci-smoke.sh
 
-      - name: Shellcheck (optional)
-        run: |
-          if command -v shellcheck >/dev/null 2>&1; then
-            shellcheck -x scripts/omnl/*.sh || true
-          else
-            echo "Shellcheck not installed; skipping."
-          fi
+      - name: Install shellcheck
+        run: sudo apt-get update -qq && sudo apt-get install -y shellcheck
+
+      - name: Shellcheck scripts/omnl (severity error)
+        run: shellcheck -S error -x scripts/omnl/*.sh
diff --git a/config/contract-addresses.conf b/config/contract-addresses.conf
index c678e70..eea2039 100644
--- a/config/contract-addresses.conf
+++ b/config/contract-addresses.conf
@@ -11,8 +11,8 @@ ADDR_CCIP_RECEIVER="0xC12236C03b28e675d376774FCE2C2C052488430F"
 ADDR_VOTING="0x022267b26400114aF01BaCcb92456Fe36cfccD93"
 
 ADDR_CCIP_SENDER="0x105F8A15b819948a89153505762444Ee9f324684"
-ADDR_CCIPWETH10_BRIDGE="0xF5a87528cEb72312979DB0C51509489caF940721"
-ADDR_CCIPWETH9_BRIDGE="${CCIPWETH9_BRIDGE_CHAIN138:-0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5}"
+ADDR_CCIPWETH10_BRIDGE="0xe0E93247376aa097dB308B92e6Ba36bA015535D0"
+ADDR_CCIPWETH9_BRIDGE="${CCIPWETH9_BRIDGE_CHAIN138:-0xcacfd227A040002e49e2e01626363071324f820a}"
 
 # alltra-lifi-settlement
 ADDR_MERCHANT_SETTLEMENT="0x16D9A2cB94A0b92721D93db4A6Cd8023D3338800"
diff --git a/config/routing-registry.json b/config/routing-registry.json
index 6a550c5..47f1b83 100644
--- a/config/routing-registry.json
+++ b/config/routing-registry.json
@@ -26,7 +26,7 @@
       "toChain": 1,
       "asset": "WETH",
       "pathType": "CCIP",
-      "bridgeAddress": "0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5",
+      "bridgeAddress": "0xcacfd227A040002e49e2e01626363071324f820a",
       "bridgeChainId": 138,
       "label": "CCIPWETH9Bridge"
     },
@@ -45,7 +45,7 @@
       "toChain": 56,
       "asset": "WETH",
       "pathType": "CCIP",
-      "bridgeAddress": "0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5",
+      "bridgeAddress": "0xcacfd227A040002e49e2e01626363071324f820a",
       "bridgeChainId": 138,
       "label": "CCIPWETH9Bridge"
     },
@@ -64,7 +64,7 @@
       "toChain": 137,
       "asset": "WETH",
       "pathType": "CCIP",
-      "bridgeAddress": "0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5",
+      "bridgeAddress": "0xcacfd227A040002e49e2e01626363071324f820a",
       "bridgeChainId": 138,
       "label": "CCIPWETH9Bridge"
     },
@@ -83,7 +83,7 @@
       "toChain": 10,
       "asset": "WETH",
       "pathType": "CCIP",
-      "bridgeAddress": "0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5",
+      "bridgeAddress": "0xcacfd227A040002e49e2e01626363071324f820a",
       "bridgeChainId": 138,
       "label": "CCIPWETH9Bridge"
     },
@@ -102,7 +102,7 @@
       "toChain": 42161,
       "asset": "WETH",
       "pathType": "CCIP",
-      "bridgeAddress": "0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5",
+      "bridgeAddress": "0xcacfd227A040002e49e2e01626363071324f820a",
       "bridgeChainId": 138,
       "label": "CCIPWETH9Bridge"
     },
@@ -121,7 +121,7 @@
       "toChain": 43114,
       "asset": "WETH",
       "pathType": "CCIP",
-      "bridgeAddress": "0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5",
+      "bridgeAddress": "0xcacfd227A040002e49e2e01626363071324f820a",
       "bridgeChainId": 138,
       "label": "CCIPWETH9Bridge"
     },
@@ -140,7 +140,7 @@
       "toChain": 8453,
       "asset": "WETH",
       "pathType": "CCIP",
-      "bridgeAddress": "0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5",
+      "bridgeAddress": "0xcacfd227A040002e49e2e01626363071324f820a",
       "bridgeChainId": 138,
       "label": "CCIPWETH9Bridge"
     },
@@ -159,7 +159,7 @@
       "toChain": 100,
       "asset": "WETH",
       "pathType": "CCIP",
-      "bridgeAddress": "0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5",
+      "bridgeAddress": "0xcacfd227A040002e49e2e01626363071324f820a",
       "bridgeChainId": 138,
       "label": "CCIPWETH9Bridge"
     },
@@ -178,7 +178,7 @@
       "toChain": 25,
       "asset": "WETH",
       "pathType": "CCIP",
-      "bridgeAddress": "0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5",
+      "bridgeAddress": "0xcacfd227A040002e49e2e01626363071324f820a",
       "bridgeChainId": 138,
       "label": "CCIPWETH9Bridge"
     },
@@ -197,7 +197,7 @@
       "toChain": 42220,
       "asset": "WETH",
       "pathType": "CCIP",
-      "bridgeAddress": "0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5",
+      "bridgeAddress": "0xcacfd227A040002e49e2e01626363071324f820a",
       "bridgeChainId": 138,
       "label": "CCIPWETH9Bridge"
     },
@@ -216,7 +216,7 @@
       "toChain": 1111,
       "asset": "WETH",
       "pathType": "CCIP",
-      "bridgeAddress": "0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5",
+      "bridgeAddress": "0xcacfd227A040002e49e2e01626363071324f820a",
       "bridgeChainId": 138,
       "label": "CCIPWETH9Bridge"
     },
diff --git a/docs/00-meta/ADDITIONAL_RECOMMENDATIONS_TABLE.md b/docs/00-meta/ADDITIONAL_RECOMMENDATIONS_TABLE.md
index 9837b6e..e45f74f 100644
--- a/docs/00-meta/ADDITIONAL_RECOMMENDATIONS_TABLE.md
+++ b/docs/00-meta/ADDITIONAL_RECOMMENDATIONS_TABLE.md
@@ -106,7 +106,7 @@
 | R1 | Verify every deployed contract on Blockscout | After each deployment |
 | R2 | Keep CONTRACT_ADDRESSES_REFERENCE and ADDRESS_MATRIX_AND_STATUS updated | When new contracts deployed/deprecated |
 | R3 | Run check-contracts-on-chain-138.sh; fix MISSING/EMPTY | Periodically or after deploy |
-| R4 | Use canonical CCIPWETH9Bridge (0x971c...); do not use deprecated | Always |
+| R4 | Use canonical CCIPWETH9Bridge (`0xcacfd227A040002e49e2e01626363071324f820a`); do not use deprecated | Always |
 | R5 | Never commit .env or private keys; rotate if exposed | Always |
 | R6–R7 | API keys in .env; restrict deployer and RPC admin | Access review |
 | R8–R9 | Set RPC_URL_138; use GAS_PRICE on Chain 138 | Before deploy / every forge script |
diff --git a/docs/00-meta/ALL_RECOMMENDATIONS_OPERATOR_ONLY.md b/docs/00-meta/ALL_RECOMMENDATIONS_OPERATOR_ONLY.md
index ca33ebf..b1aad39 100644
--- a/docs/00-meta/ALL_RECOMMENDATIONS_OPERATOR_ONLY.md
+++ b/docs/00-meta/ALL_RECOMMENDATIONS_OPERATOR_ONLY.md
@@ -50,7 +50,7 @@
 
 | # | Action | Notes |
 |---|--------|-------|
-| R4 | Do not use deprecated CCIPWETH9Bridge; use 0x971c... and set env | Always |
+| R4 | Do not use deprecated CCIPWETH9Bridge; use `0xcacfd227A040002e49e2e01626363071324f820a` and set env | Always |
 | R5 | Never commit .env or private keys; rotate exposed keys | Always |
 | R6 | API keys in .env.example placeholders | — |
 | R7 | Restrict deployer key and RPC admin access | Access review |
diff --git a/docs/00-meta/ALL_TASKS_DETAILED_STEPS.md b/docs/00-meta/ALL_TASKS_DETAILED_STEPS.md
index e9b569d..ba4cf9b 100644
--- a/docs/00-meta/ALL_TASKS_DETAILED_STEPS.md
+++ b/docs/00-meta/ALL_TASKS_DETAILED_STEPS.md
@@ -72,7 +72,7 @@
 
 ### W0-2: sendCrossChain (real)
 
-**Blocker:** `PRIVATE_KEY` and LINK approved in `.env`; bridge `0x971cD9D156f193df8051E48043C476e53ECd4693`.
+**Blocker:** `PRIVATE_KEY` and LINK approved in `.env`; bridge `0xcacfd227A040002e49e2e01626363071324f820a`.
 
 **Steps:**
 
diff --git a/docs/00-meta/COMPLETE_REQUIRED_OPTIONAL_RECOMMENDED_INDEX.md b/docs/00-meta/COMPLETE_REQUIRED_OPTIONAL_RECOMMENDED_INDEX.md
index 845b3f5..e237b51 100644
--- a/docs/00-meta/COMPLETE_REQUIRED_OPTIONAL_RECOMMENDED_INDEX.md
+++ b/docs/00-meta/COMPLETE_REQUIRED_OPTIONAL_RECOMMENDED_INDEX.md
@@ -11,7 +11,7 @@
 | Task | Blocker | Command / doc |
 |------|---------|----------------|
 | W0-1 NPMplus RPC fix (405) | Host on LAN (192.168.11.x) | [REMAINING_WORK_DETAILED_STEPS.md](REMAINING_WORK_DETAILED_STEPS.md) § W0-1. `bash scripts/run-wave0-from-lan.sh` or `bash scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh`. |
-| W0-2 sendCrossChain (real) | PRIVATE_KEY, LINK approved | [REMAINING_WORK_DETAILED_STEPS.md](REMAINING_WORK_DETAILED_STEPS.md) § W0-2. `bash scripts/bridge/run-send-cross-chain.sh <amount> [recipient]`. Bridge: `0x971cD9D156f193df8051E48043C476e53ECd4693`. |
+| W0-2 sendCrossChain (real) | PRIVATE_KEY, LINK approved | [REMAINING_WORK_DETAILED_STEPS.md](REMAINING_WORK_DETAILED_STEPS.md) § W0-2. `bash scripts/bridge/run-send-cross-chain.sh <amount> [recipient]`. Bridge: `0xcacfd227A040002e49e2e01626363071324f820a`. |
 | W0-3 NPMplus backup | NPM_PASSWORD in .env | [REMAINING_WORK_DETAILED_STEPS.md](REMAINING_WORK_DETAILED_STEPS.md) § W0-3. `bash scripts/verify/backup-npmplus.sh` or `scripts/run-wave0-from-lan.sh`. |
 
 ---
diff --git a/docs/00-meta/DOTENV_AND_MARKDOWN_AUDIT_GAPS_AND_RECOMMENDATIONS.md b/docs/00-meta/DOTENV_AND_MARKDOWN_AUDIT_GAPS_AND_RECOMMENDATIONS.md
index a796fb7..3bef5fb 100644
--- a/docs/00-meta/DOTENV_AND_MARKDOWN_AUDIT_GAPS_AND_RECOMMENDATIONS.md
+++ b/docs/00-meta/DOTENV_AND_MARKDOWN_AUDIT_GAPS_AND_RECOMMENDATIONS.md
@@ -27,7 +27,7 @@
 | **PRIVATE_KEY** | Deploy, bridge send, forge script | 64-char hex; same wallet holds LINK for CCIP fees |
 | **RPC_URL_138** | Deploy, verify, on-chain checks | Use IP:port for deploy: `http://192.168.11.211:8545` |
 | **ETH_MAINNET_RPC_URL** / **ETHEREUM_MAINNET_RPC** | Mainnet verify, CCIP, relay | Infura/Alchemy |
-| **CCIPWETH9_BRIDGE_CHAIN138**, **CCIPWETH10_BRIDGE_CHAIN138** | Bridge scripts, token-aggregation, routing | Canonical: WETH9 `0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5`; WETH10 see §3 gap |
+| **CCIPWETH9_BRIDGE_CHAIN138**, **CCIPWETH10_BRIDGE_CHAIN138** | Bridge scripts, token-aggregation, routing | Canonical: WETH9 `0xcacfd227A040002e49e2e01626363071324f820a`; WETH10 `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` |
 | **CHAIN_138_DODO_PMM_INTEGRATION** | Token-aggregation indexer, quotes | `0x79cdbaFBaA0FdF9F55D26F360F54cddE5c743F7D` |
 | **CUSDT_ADDRESS_138**, **CUSDC_ADDRESS_138** | Scripts, token-aggregation | Canonical in EXPLORER_TOKEN_LIST_CROSSCHECK §5 |
 | **DATABASE_URL** | Token-aggregation DB, migrations | When using PostgreSQL (e.g. VMID 5000) |
@@ -83,8 +83,8 @@
 
 | Gap | Location | Recommendation |
 |-----|----------|----------------|
-| **CCIPWETH10 on Chain 138** | CONTRACT_ADDRESSES_REFERENCE.md: `0xe0E93247376aa097dB308B92e6Ba36bA015535D0`. Reconcile script / some code may output `0xF5a87528cEb72312979DB0C51509489caF940721`. routing-registry.json and cross-chain-bridges use `0xe0E932...`. | Verify on Blockscout which contract is the active CCIP WETH10 bridge; align reconcile script and env.additions.example to that address. |
-| **CCIPWETH9 on Chain 138** | Docs mention both `0x971cD9...` and `0x9cba0D04...`. On-chain check and routing-registry use `0x9cba0D04...`. | Treat `0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5` as canonical for “working” WETH9 bridge; document the other in CONTRACT_ADDRESSES_REFERENCE as alternate/deploy if applicable. |
+| **CCIPWETH10 on Chain 138** | CONTRACT_ADDRESSES_REFERENCE.md: `0xe0E93247376aa097dB308B92e6Ba36bA015535D0`. Older bootstrap defaults may still mention `0xF5a87528cEb72312979DB0C51509489caF940721`, but the active routing registry and env-backed defaults now use `0xe0E932...`. | Keep `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` as the canonical WETH10 bridge and update any remaining legacy bootstrap references if they resurface. |
+| **CCIPWETH9 on Chain 138** | Docs mention both `0x971cD9...` and `0xcacfd227...`. On-chain check and routing-registry use `0xcacfd227...`. | Treat `0xcacfd227A040002e49e2e01626363071324f820a` as canonical for “working” WETH9 bridge; document the other in CONTRACT_ADDRESSES_REFERENCE as alternate/deploy if applicable. |
 
 ### 4.2 Missing or placeholder env
 
diff --git a/docs/00-meta/E2E_COMPLETION_TASKS_DETAILED_LIST.md b/docs/00-meta/E2E_COMPLETION_TASKS_DETAILED_LIST.md
index c1c9096..a023fb3 100644
--- a/docs/00-meta/E2E_COMPLETION_TASKS_DETAILED_LIST.md
+++ b/docs/00-meta/E2E_COMPLETION_TASKS_DETAILED_LIST.md
@@ -53,7 +53,7 @@ Tasks below do **not** depend on obtaining API keys (Li.Fi, CoinGecko, etc.). Th
 | ID | Task | Type | Prerequisite | Command / note |
 |----|------|------|--------------|----------------|
 | **W0-1** | NPMplus RPC fix (405) | Op | Host on LAN | `bash scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh` — or `bash scripts/run-wave0-from-lan.sh` (omit `--skip-rpc-fix`). |
-| **W0-2** | sendCrossChain (real) | Op | PRIVATE_KEY, LINK approved for fee | `scripts/bridge/run-send-cross-chain.sh <amount> [recipient]` — omit `--dry-run`. Bridge: 0x971cD9D156f193df8051E48043C476e53ECd4693. |
+| **W0-2** | sendCrossChain (real) | Op | PRIVATE_KEY, LINK approved for fee | `scripts/bridge/run-send-cross-chain.sh <amount> [recipient]` — omit `--dry-run`. Bridge: `0xcacfd227A040002e49e2e01626363071324f820a`. |
 | **W0-3** | NPMplus backup | Op | NPM_PASSWORD in .env, NPMplus up | `bash scripts/verify/backup-npmplus.sh`. Or `scripts/run-wave0-from-lan.sh` (omit `--skip-backup`). |
 
 **Combined (W0-1 + W0-3):** `bash scripts/run-wave0-from-lan.sh` from LAN (options: `--dry-run`, `--skip-backup`, `--skip-rpc-fix`).
diff --git a/docs/00-meta/NEXT_STEPS_MASTER.md b/docs/00-meta/NEXT_STEPS_MASTER.md
index 290b581..236ca25 100644
--- a/docs/00-meta/NEXT_STEPS_MASTER.md
+++ b/docs/00-meta/NEXT_STEPS_MASTER.md
@@ -28,7 +28,7 @@ This document is the **single source of truth** for all next steps and remaining
 
 | Step | Task | Status | Notes |
 |------|------|--------|-------|
-| 1 | Run `./scripts/deploy-and-configure-weth9-bridge-chain138.sh` (requires PRIVATE_KEY) | ✅ Done | Bridge at 0x971cD9D156f193df8051E48043C476e53ECd4693 |
+| 1 | Run `./scripts/deploy-and-configure-weth9-bridge-chain138.sh` (requires PRIVATE_KEY) | ✅ Done | Bridge at `0xcacfd227A040002e49e2e01626363071324f820a` |
 | 2 | Set `export CCIPWETH9_BRIDGE_CHAIN138=<printed_address>` in shell and .env | ✅ Done | Set in smom-dbis-138/.env |
 | 3 | Execute sendCrossChain and verify transfer | ⏳ Pending | Ready for bridge operations |
 
diff --git a/docs/00-meta/NEXT_STEPS_OPERATOR.md b/docs/00-meta/NEXT_STEPS_OPERATOR.md
index e2fe5ca..632a097 100644
--- a/docs/00-meta/NEXT_STEPS_OPERATOR.md
+++ b/docs/00-meta/NEXT_STEPS_OPERATOR.md
@@ -65,7 +65,7 @@ bash scripts/bridge/run-send-cross-chain.sh 0.01
 bash scripts/bridge/run-send-cross-chain.sh 0.01 0xYourRecipientAddress
 ```
 
-Bridge contract (reference): `0x971cD9D156f193df8051E48043C476e53ECd4693`. Ensure `CCIPWETH9_BRIDGE_CHAIN138` and `RPC_URL_138`/`CHAIN138_RPC` in `.env`.
+Bridge contract (reference): `0xcacfd227A040002e49e2e01626363071324f820a`. Ensure `CCIPWETH9_BRIDGE_CHAIN138` and `RPC_URL_138`/`CHAIN138_RPC` in `.env`.
 
 ### W0-3: NPMplus backup (re-run anytime)
 
diff --git a/docs/00-meta/OPERATOR_READY_CHECKLIST.md b/docs/00-meta/OPERATOR_READY_CHECKLIST.md
index f8d2358..ddf536e 100644
--- a/docs/00-meta/OPERATOR_READY_CHECKLIST.md
+++ b/docs/00-meta/OPERATOR_READY_CHECKLIST.md
@@ -195,7 +195,7 @@ forge script script/bridge/trustless/DeployTrustlessBridge.s.sol:DeployTrustless
 
 ## 8. Wave 0: sendCrossChain (real) and NPMplus backup
 
-**sendCrossChain (real):** Requires `PRIVATE_KEY` and LINK approved in `.env`. Bridge: `0x971cD9D156f193df8051E48043C476e53ECd4693`.
+**sendCrossChain (real):** Requires `PRIVATE_KEY` and LINK approved in `.env`. Bridge: `0xcacfd227A040002e49e2e01626363071324f820a`.
 
 ```bash
 bash scripts/bridge/run-send-cross-chain.sh 0.01 [recipient_address]
diff --git a/docs/00-meta/REMAINING_ITEMS_FULL_PARALLEL_LIST.md b/docs/00-meta/REMAINING_ITEMS_FULL_PARALLEL_LIST.md
index e0c0a36..c29e6b7 100644
--- a/docs/00-meta/REMAINING_ITEMS_FULL_PARALLEL_LIST.md
+++ b/docs/00-meta/REMAINING_ITEMS_FULL_PARALLEL_LIST.md
@@ -21,7 +21,7 @@
 | ID | Task | Command / note |
 |----|------|------------------|
 | W0-1 | Apply NPMplus RPC fix (405) | From LAN: `bash scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh` |
-| W0-2 | Execute sendCrossChain (real) | Omit `--dry-run` in `run-send-cross-chain.sh`; LINK approved; bridge 0x971cD9D156f193df8051E48043C476e53ECd4693 |
+| W0-2 | Execute sendCrossChain (real) | Omit `--dry-run` in `run-send-cross-chain.sh`; LINK approved; bridge `0xcacfd227A040002e49e2e01626363071324f820a` |
 | W0-3 | NPMplus backup (export/config) | NPM_PASSWORD in .env; `./scripts/backup/automated-backup.sh [--with-npmplus]` |
 
 ---
diff --git a/docs/00-meta/REMAINING_TASKS_BREAKDOWN_MISSING_INFO.md b/docs/00-meta/REMAINING_TASKS_BREAKDOWN_MISSING_INFO.md
index a5c36f2..d472760 100644
--- a/docs/00-meta/REMAINING_TASKS_BREAKDOWN_MISSING_INFO.md
+++ b/docs/00-meta/REMAINING_TASKS_BREAKDOWN_MISSING_INFO.md
@@ -29,7 +29,7 @@
 
 | | Detail |
 |---|--------|
-| **Needed** | `PRIVATE_KEY` in `.env` (wallet with gas + LINK for fees); bridge `0x971cD9D156f193df8051E48043C476e53ECd4693`; recipient address. |
+| **Needed** | `PRIVATE_KEY` in `.env` (wallet with gas + LINK for fees); bridge `0xcacfd227A040002e49e2e01626363071324f820a`; recipient address. |
 | **Missing** | 1) A wallet private key you control. 2) LINK approved for the bridge fee (if the bridge charges LINK). 3) Optional: recipient address (script may have default). |
 | **Where to get** | **PRIVATE_KEY:** Create or use an existing funded wallet; set in root or `smom-dbis-138/.env`. **LINK:** On Chain 138, approve LINK for the bridge contract (amount depends on fee). **Recipient:** Any valid address on the destination chain. |
 | **Doc** | [REMAINING_WORK_DETAILED_STEPS.md](REMAINING_WORK_DETAILED_STEPS.md) § W0-2; [OPERATOR_READY_CHECKLIST.md](OPERATOR_READY_CHECKLIST.md) §8. |
diff --git a/docs/00-meta/REMAINING_TASKS_NEXT_STEPS_PHASES_REVIEW.md b/docs/00-meta/REMAINING_TASKS_NEXT_STEPS_PHASES_REVIEW.md
index 7373754..2ff0fdf 100644
--- a/docs/00-meta/REMAINING_TASKS_NEXT_STEPS_PHASES_REVIEW.md
+++ b/docs/00-meta/REMAINING_TASKS_NEXT_STEPS_PHASES_REVIEW.md
@@ -26,7 +26,7 @@ Within each wave there are **no ordering requirements** between items; run them
 
 | Item | Status | Action |
 |------|--------|--------|
-| **Execute sendCrossChain (real)** | ⏳ Pending | Remove `--dry-run` from `run-send-cross-chain.sh`; ensure LINK approved for fee token. Bridge at 0x971cD9D156f193df8051E48043C476e53ECd4693. |
+| **Execute sendCrossChain (real)** | ⏳ Pending | Remove `--dry-run` from `run-send-cross-chain.sh`; ensure LINK approved for fee token. Bridge at 0xcacfd227A040002e49e2e01626363071324f820a. |
 | **Apply NPMplus RPC fix (405)** | ⏳ If RPC 405 | From a host on LAN: `bash scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh` (sets block_exploits false for RPC). |
 | **CT 2301** | ✅ Resolved | Recreated 2026-02-04; Besu config may need reinstall (copy from 2101/2201). |
 
diff --git a/docs/00-meta/REMAINING_WORK_DETAILED_STEPS.md b/docs/00-meta/REMAINING_WORK_DETAILED_STEPS.md
index 58cb91d..8283efc 100644
--- a/docs/00-meta/REMAINING_WORK_DETAILED_STEPS.md
+++ b/docs/00-meta/REMAINING_WORK_DETAILED_STEPS.md
@@ -71,7 +71,7 @@ These can be done from your current environment (e.g. dev machine, WSL, CI) with
 
 ### W0-2: sendCrossChain (real)
 
-**Blocker:** `PRIVATE_KEY` and LINK approved for fee in `.env`; bridge contract: `0x971cD9D156f193df8051E48043C476e53ECd4693`.
+**Blocker:** `PRIVATE_KEY` and LINK approved for fee in `.env`; bridge contract: `0xcacfd227A040002e49e2e01626363071324f820a`.
 
 **Detailed steps:**
 
diff --git a/docs/00-meta/REMAINING_WORK_DETAILED_TASKS.md b/docs/00-meta/REMAINING_WORK_DETAILED_TASKS.md
index a677c1e..bfda385 100644
--- a/docs/00-meta/REMAINING_WORK_DETAILED_TASKS.md
+++ b/docs/00-meta/REMAINING_WORK_DETAILED_TASKS.md
@@ -10,7 +10,7 @@
 | ID | Task | Detailed steps |
 |----|------|-----------------|
 | **W0-1** | NPMplus RPC fix (405) | ✅ Done (2026-02-06 run). Re-run from host on LAN if needed: `bash scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh` |
-| **W0-2** | Execute sendCrossChain (real) | 1) Ensure `PRIVATE_KEY` and LINK/fee token approved in `.env`. 2) Run `./scripts/bridge/run-send-cross-chain.sh <amount_eth> [recipient]` **without** `--dry-run`. 3) Example: `./scripts/bridge/run-send-cross-chain.sh 0.01` or with recipient: `./scripts/bridge/run-send-cross-chain.sh 0.01 0xYourAddress`. Bridge: `0x971cD9D156f193df8051E48043C476e53ECd4693`. |
+| **W0-2** | Execute sendCrossChain (real) | 1) Ensure `PRIVATE_KEY` and LINK/fee token approved in `.env`. 2) Run `./scripts/bridge/run-send-cross-chain.sh <amount_eth> [recipient]` **without** `--dry-run`. 3) Example: `./scripts/bridge/run-send-cross-chain.sh 0.01` or with recipient: `./scripts/bridge/run-send-cross-chain.sh 0.01 0xYourAddress`. Bridge: `0xcacfd227A040002e49e2e01626363071324f820a`. |
 | **W0-3** | NPMplus backup | 1) Set `NPM_PASSWORD` in `.env`. 2) When NPMplus container is up, run: `bash scripts/verify/backup-npmplus.sh` or `./scripts/backup/automated-backup.sh [--with-npmplus]`. 3) Re-run if previous backup had API/auth warnings. |
 
 ---
diff --git a/docs/00-meta/STILL_NOT_DONE_EXECUTION_CHECKLIST.md b/docs/00-meta/STILL_NOT_DONE_EXECUTION_CHECKLIST.md
index ad2d026..1a3e768 100644
--- a/docs/00-meta/STILL_NOT_DONE_EXECUTION_CHECKLIST.md
+++ b/docs/00-meta/STILL_NOT_DONE_EXECUTION_CHECKLIST.md
@@ -13,7 +13,7 @@
 | # | Task | Command / doc |
 |---|------|----------------|
 | 1 | **W0-1 NPMplus RPC fix (405)** | From LAN: `bash scripts/run-wave0-from-lan.sh` or `bash scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh`. Verify: `bash scripts/verify/verify-end-to-end-routing.sh`. |
-| 2 | **W0-2 sendCrossChain (real)** | `bash scripts/bridge/run-send-cross-chain.sh <amount> [recipient]` (omit `--dry-run`). Requires PRIVATE_KEY and LINK approved. Bridge: `0x971cD9D156f193df8051E48043C476e53ECd4693`. |
+| 2 | **W0-2 sendCrossChain (real)** | `bash scripts/bridge/run-send-cross-chain.sh <amount> [recipient]` (omit `--dry-run`). Requires PRIVATE_KEY and LINK approved. Bridge: `0xcacfd227A040002e49e2e01626363071324f820a`. |
 | 3 | **W0-3 NPMplus backup** | `bash scripts/verify/backup-npmplus.sh` or `bash scripts/run-wave0-from-lan.sh` (no `--skip-backup`). Requires NPM_PASSWORD. |
 | 4 | **Blockscout verification** | `source smom-dbis-138/.env 2>/dev/null; ./scripts/verify/run-contract-verification-with-proxy.sh`. Retry one: `--only ContractName`. |
 | 5 | **Fix E2E 502s** | `./scripts/maintenance/run-all-maintenance-via-proxmox-ssh.sh --e2e` or `./scripts/maintenance/address-all-remaining-502s.sh --run-besu-fix --e2e`. Runbook: [502_DEEP_DIVE_ROOT_CAUSES_AND_FIXES.md](502_DEEP_DIVE_ROOT_CAUSES_AND_FIXES.md). |
diff --git a/docs/04-configuration/EXPLORER_METAMASK_TECHNICAL_RESPONSE.md b/docs/04-configuration/EXPLORER_METAMASK_TECHNICAL_RESPONSE.md
index e2694fc..afb89bb 100644
--- a/docs/04-configuration/EXPLORER_METAMASK_TECHNICAL_RESPONSE.md
+++ b/docs/04-configuration/EXPLORER_METAMASK_TECHNICAL_RESPONSE.md
@@ -29,7 +29,7 @@
 - WETH9: `0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2` (same as Ethereum mainnet **by design**; canonical bytecode verified on 138)
 - WETH10: `0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f`
 - Bridges:
-  - WETH9 Bridge: `0x971cD9D156f193df8051E48043C476e53ECd4693`
+  - WETH9 Bridge: `0xcacfd227A040002e49e2e01626363071324f820a`
   - WETH10 Bridge: `0xe0E93247376aa097dB308B92e6Ba36bA015535D0`
 
 **5) EIP-1559**
@@ -103,7 +103,7 @@ Chain 138 intentionally uses the **same addresses as Ethereum mainnet** for WETH
 |-----------------------|---------------------|--------|
 | **WETH9** (wrapped-native) | `0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2` | Same as mainnet; canonical WETH9 bytecode verified on 138 (see `smom-dbis-138/scripts/verify-weth9-canonical.js`). |
 | **WETH10**            | `0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f` | Same as mainnet. |
-| **WETH9 Bridge** (CCIP)  | `0x971cD9D156f193df8051E48043C476e53ECd4693` | In `config/contract-addresses.conf` as `ADDR_CCIPWETH9_BRIDGE`. |
+| **WETH9 Bridge** (CCIP)  | `0xcacfd227A040002e49e2e01626363071324f820a` | In `config/contract-addresses.conf` as `ADDR_CCIPWETH9_BRIDGE`. |
 | **WETH10 Bridge** (CCIP) | `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` | In `config/contract-addresses.conf` as `ADDR_CCIPWETH10_BRIDGE`. |
 
 So the **intended wrapped-native (WETH9-equivalent) address** on Chain 138 is **`0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2`**. The explorer is correct to show it; the chain is not “mainnet” but uses that address by design.
@@ -155,7 +155,7 @@ Verification run: config and live endpoints checked against the values above.
 | RPC URL (HTTPS/WS) | `explorer-monorepo/frontend/public/explorer-spa.js` | `RPC_FQDN` = `https://rpc-http-pub.d-bis.org`, `RPC_WS_FQDN` = `wss://rpc-ws-pub.d-bis.org`, `RPC_IP` = `http://192.168.11.221:8545` |
 | ChainId | same file | `CHAIN_ID = 138`, MetaMask `chainId: '0x8A'` |
 | WETH9 / WETH10 | same file | `0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2`, `0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f` |
-| WETH9/WETH10 bridges | same file | `0x971cD9D156f193df8051E48043C476e53ECd4693`, `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` |
+| WETH9/WETH10 bridges | same file | `0xcacfd227A040002e49e2e01626363071324f820a`, `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` |
 | Blockscout env | `scripts/run-blockscout-config-direct.sh` | `ETHEREUM_JSONRPC_HTTP_URL=http://192.168.11.221:8545`, `CHAIN_ID=138`, `ETHEREUM_JSONRPC_VARIANT=besu` |
 | API proxy | `explorer-monorepo/scripts/fix-nginx-serve-custom-frontend.sh` | `location /api/` → `proxy_pass http://127.0.0.1:4000` |
 
diff --git a/docs/04-configuration/MASTER_SECRETS_INVENTORY.md b/docs/04-configuration/MASTER_SECRETS_INVENTORY.md
index 6f52320..9b6467b 100644
--- a/docs/04-configuration/MASTER_SECRETS_INVENTORY.md
+++ b/docs/04-configuration/MASTER_SECRETS_INVENTORY.md
@@ -66,7 +66,7 @@ This document provides a comprehensive master list of all secrets discovered acr
 | Secret Name | Location | Value | Status |
 |------------|----------|-------|--------|
 | `LINK_TOKEN` | Multiple `.env` files | `0xb7721dD53A8c629d9f1Ba31a5819AFe250002b03` | ✅ Public |
-| `CCIP_ROUTER` | Multiple `.env` files | `0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e` | ✅ Public |
+| `CCIP_ROUTER` | Multiple `.env` files | `0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817` | ✅ Public |
 | `CCIP_FEE_TOKEN` | Multiple `.env` files | `0xb7721dD53A8c629d9f1Ba31a5819AFe250002b03` | ✅ Public |
 | `TOKEN_FACTORY` | `proxmox/smom-dbis-138/.env` | `0xEBFb5C60dE5f7C4baae180CA328D3BB39E1a5133` | ✅ Public |
 | `TOKEN_REGISTRY_ADDRESS` | `proxmox/smom-dbis-138/.env` | `0x91Efe92229dbf7C5B38D422621300956B55870Fa` | ✅ Public |
diff --git a/docs/04-configuration/METAMASK_CONFIGURATION.md b/docs/04-configuration/METAMASK_CONFIGURATION.md
index 2d657c2..62a0c9e 100644
--- a/docs/04-configuration/METAMASK_CONFIGURATION.md
+++ b/docs/04-configuration/METAMASK_CONFIGURATION.md
@@ -21,18 +21,15 @@ Since transactions sent via MetaMask (like nonce 25) work successfully, configur
 
 ### WETH9 Bridge Configuration
 
-**Contract Address**: `0x89dd12025bfCD38A168455A44B400e913ED33BE2`
+**Contract Address**: `0xcacfd227A040002e49e2e01626363071324f820a`
 
 **Function**: `addDestination(uint64,address)`
 
 **Parameters**:
 - `chainSelector`: `5009297550715157269` (Ethereum Mainnet)
-- `destination`: `0x8078a09637e47fa5ed34f626046ea2094a5cde5e`
+- `destination`: `0x3304b747e565a97ec8ac220b0b6a1f6ffdb837e6`
 
-**Calldata** (for reference):
-```
-0x4c4c4c4c5009297550715157269000000000000000000000008078a09637e47fa5ed34f626046ea2094a5cde5e
-```
+**Calldata**: Generate it with `cast calldata "addDestination(uint64,address)" 5009297550715157269 0x3304b747e565a97ec8ac220b0b6a1f6ffdb837e6`
 
 ### WETH10 Bridge Configuration
 
@@ -42,7 +39,7 @@ Since transactions sent via MetaMask (like nonce 25) work successfully, configur
 
 **Parameters**:
 - `chainSelector`: `5009297550715157269` (Ethereum Mainnet)
-- `destination`: `0x105f8a15b819948a89153505762444ee9f324684`
+- `destination`: `0x04E1e22B0D41e99f4275bd40A50480219bc9A223`
 
 ---
 
@@ -51,15 +48,15 @@ Since transactions sent via MetaMask (like nonce 25) work successfully, configur
 1. **Connect to ChainID 138** in MetaMask
 2. **Go to "Send" or use a dApp interface**
 3. **For WETH9**:
-   - To: `0x89dd12025bfCD38A168455A44B400e913ED33BE2`
+   - To: `0xcacfd227A040002e49e2e01626363071324f820a`
    - Data: Use function `addDestination(uint64,address)` with parameters:
      - `5009297550715157269`
-     - `0x8078a09637e47fa5ed34f626046ea2094a5cde5e`
+     - `0x3304b747e565a97ec8ac220b0b6a1f6ffdb837e6`
 4. **For WETH10**:
    - To: `0xe0E93247376aa097dB308B92e6Ba36bA015535D0`
    - Data: Use function `addDestination(uint64,address)` with parameters:
      - `5009297550715157269`
-     - `0x105f8a15b819948a89153505762444ee9f324684`
+     - `0x04E1e22B0D41e99f4275bd40A50480219bc9A223`
 
 ---
 
@@ -77,4 +74,3 @@ Expected: 7/7 networks configured ✅
 ---
 
 **Last Updated**: $(date)
-
diff --git a/docs/04-configuration/mifos-omnl-central-bank/INSTITUTIONAL_PACKAGE_SCORE_ATTESTATION_4_995.EXAMPLE.json b/docs/04-configuration/mifos-omnl-central-bank/INSTITUTIONAL_PACKAGE_SCORE_ATTESTATION_4_995.EXAMPLE.json
index 8054fb9..2d760ba 100644
--- a/docs/04-configuration/mifos-omnl-central-bank/INSTITUTIONAL_PACKAGE_SCORE_ATTESTATION_4_995.EXAMPLE.json
+++ b/docs/04-configuration/mifos-omnl-central-bank/INSTITUTIONAL_PACKAGE_SCORE_ATTESTATION_4_995.EXAMPLE.json
@@ -24,7 +24,7 @@
       "dateUtc": "REPLACE_ISO_UTC"
     },
     {
-      "role": "General Counsel",
+      "role": "Chief Legal Officer",
       "name": "REPLACE_NAME",
       "dateUtc": "REPLACE_ISO_UTC"
     }
diff --git a/docs/04-configuration/mifos-omnl-central-bank/INSTITUTIONAL_PACKAGE_SCORE_ATTESTATION_4_995.json b/docs/04-configuration/mifos-omnl-central-bank/INSTITUTIONAL_PACKAGE_SCORE_ATTESTATION_4_995.json
index 2d18916..6d3a40e 100644
--- a/docs/04-configuration/mifos-omnl-central-bank/INSTITUTIONAL_PACKAGE_SCORE_ATTESTATION_4_995.json
+++ b/docs/04-configuration/mifos-omnl-central-bank/INSTITUTIONAL_PACKAGE_SCORE_ATTESTATION_4_995.json
@@ -24,12 +24,17 @@
       "dateUtc": "2026-03-25T21:00:00Z"
     },
     {
-      "role": "General Counsel",
+      "role": "Chief Legal Officer",
       "name": "TRH. Pandora C. Walker, Esq.",
       "dateUtc": "2026-03-25T21:00:00Z"
+    },
+    {
+      "role": "Director",
+      "name": "Mr. Romeo L. Miles",
+      "dateUtc": "2026-03-25T21:00:00Z"
     }
   ],
-  "rosterCrossReference": "Mr. Romeo L. Miles is listed on the OMNL banking directors and officers roster (Appendix/OMNL_BANKING_DIRECTORS_AND_LEI.md).",
+  "rosterCrossReference": "All three signatories appear on the OMNL banking directors and officers roster (Appendix/OMNL_BANKING_DIRECTORS_AND_LEI.md). Adjust formal titles in board resolutions and SUBREG if they differ from the roles listed here.",
   "provenance": {
     "hybxLedgerSource": "215k-row hybx_batch_001_ledger.csv generated by scripts/omnl/generate-transaction-package-evidence.py (HYBX-BATCH-001); if institution asserts different system-of-record, update this field and rebuild package.",
     "omnlSnapshotApiBase": "Redacted — live GET /offices + /glaccounts via OMNL_FINERACT_BASE_URL (tenant omnl)."
@@ -45,5 +50,5 @@
     "reportPdfSha256": "4129431831deaf7602e782c31bf851c4443386d0760742fceb438132c74f5dac",
     "reportBindingNote": "SHA-256 of Appendix/INDEPENDENT_AUDIT_4_995_REQUIREMENTS_HYBX-BATCH-001.md (requirements exhibit). When audit report PDF is filed in SUBREG, run scripts/omnl/patch-attestation-subreg-pdf-hashes.sh and rebuild the zip."
   },
-  "assertion": "OMNL certifies that the criteria in Appendix/INDONESIA_PACKAGE_4_995_EVIDENCE_STANDARD.md are satisfied for this package and that category scores are fair. Signatories are the Chief Compliance Officer and General Counsel named above, cross-referenced to Appendix/OMNL_BANKING_DIRECTORS_AND_LEI.md. Wet signature or QES artifacts for the same officers should be filed in HYBX-BATCH-001-SUBREG per institutional policy."
+  "assertion": "OMNL certifies that the criteria in Appendix/INDONESIA_PACKAGE_4_995_EVIDENCE_STANDARD.md are satisfied for this package and that category scores are fair. Signatories are the Chief Compliance Officer, Chief Legal Officer, and Director named above, cross-referenced to Appendix/OMNL_BANKING_DIRECTORS_AND_LEI.md. Wet signature or QES artifacts for the same officers should be filed in HYBX-BATCH-001-SUBREG per institutional policy."
 }
diff --git a/docs/07-ccip/BSCSCAN_SUPPORT_DD_0xe0E932_BSC.md b/docs/07-ccip/BSCSCAN_SUPPORT_DD_0xe0E932_BSC.md
new file mode 100644
index 0000000..fd117c9
--- /dev/null
+++ b/docs/07-ccip/BSCSCAN_SUPPORT_DD_0xe0E932_BSC.md
@@ -0,0 +1,183 @@
+# BscScan support package — due diligence
+
+**Contract (BNB Smart Chain, chain id 56):** `0xe0E93247376aa097dB308B92e6Ba36bA015535D0`  
+**Explorer:** [bscscan.com/address/0xe0e93247376aa097db308b92e6ba36ba015535d0](https://bscscan.com/address/0xe0e93247376aa097db308b92e6ba36ba015535d0)  
+**Purpose:** Evidence and narrative for BscScan support / token update review (impersonation warning, `# Suspicious`, `Suspicious_Token20774`).
+
+**Prepared:** 2026-03-25 (repo snapshot). Refresh on-chain dates and balances when submitting.
+
+---
+
+## 1. Executive summary
+
+- The contract on **BSC** is a **verified** `WETH` token: standard **WETH9-style** wrap/unwrap of **native BNB** (deposit/withdraw), **not** a honeypot masquerading as unrelated bytecode.
+- **Name/symbol** on-chain are `Wrapped Ether` / `WETH`, which triggers BscScan’s **impersonation** heuristics because the **commonly expected “WETH” on BSC** is the **Binance-Peg / canonical bridged ETH** token at a **different** address (see section 5).
+- The **deployer** is the project’s known deployment key: `0x4A666F96fC8764181194447A7dFdb7d471b301C8` (used across this repository for Chain 138 and CCIP-related deployments).
+- **Important nuance:** The **same 0x address** on **another chain** can be a **different contract**. On **Chain 138** and **Ethereum mainnet**, `0xe0E932…` is documented in this project as **CCIPWETH10Bridge** (different bytecode than the BSC `WETH.sol` instance). BscScan’s page reflects **BSC bytecode only** — verified as `WETH.sol`.
+
+**Ask to BscScan (suggested):** Review for **false positive** impersonation; consider **official nametag** or **token profile** clarifying “project-deployed wrapped native for CCIP/relay — not Binance-Peg WETH”; optionally suggest **distinct display name** if policy allows (on-chain strings may remain unchanged unless redeployed).
+
+---
+
+## 2. On-chain facts (BSC) — verify before sending
+
+| Item | Value / action |
+|------|----------------|
+| **Address** | `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` |
+| **Verification** | Contract source verified (exact match). Compiler **v0.8.20+commit.a1b79de6**, optimizer **200** runs, **london**. |
+| **Contract name (verification)** | `WETH` |
+| **Token strings** | `name` = Wrapped Ether, `symbol` = WETH, `decimals` = 18 |
+| **Creator** | `0x4A666F96fC8764181194447A7dFdb7d471b301C8` |
+| **Creation tx** | `0xf98a95e8c8399aeee513f874780e9896759124e9be3bfe5fd3a3882c67208d71` (confirm on BscScan) |
+| **BscScan UI** | Impersonation banner; tags e.g. `Suspicious_Token20774`, `# Suspicious` |
+
+Re-check **holder count**, **liquidity**, and **recent transfers** on BscScan before submission; paste screenshots into the ticket if useful.
+
+---
+
+## 3. Source code provenance (repository)
+
+The verified source matches the project’s `WETH.sol` (WETH9-style wrapper). Reference copy:
+
+- **File:** `smom-dbis-138/contracts/tokens/WETH.sol`
+- **NatSpec** states intent for **ChainID 138** in the comment; on **BSC** the same artifact was deployed for **wrapped native** interoperability (comment is chain-specific wording, deployment is multi-chain).
+
+**Behavior (high level):**
+
+- `deposit()` / `receive()` credit `balanceOf` with `msg.value` (wrap native).
+- `withdraw(uint256)` sends native back (unwrap).
+- `totalSupply()` returns `address(this).balance`.
+- Standard `transfer` / `transferFrom` / `approve` with allowance handling.
+
+No admin mint, no proxy upgrade hooks in this file — ordinary **non-upgradeable** wrapper pattern.
+
+---
+
+## 4. Same address, different chains (clarification for reviewers)
+
+EVM addresses are **per-chain**. **Equal hex** across chains does **not** imply equal bytecode.
+
+| Network | Role of `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` in project docs |
+|---------|---------------------------------------------------------------------|
+| **BSC (56)** | `WETH.sol`-style token (BscScan verification). Relay config references this address on BSC as destination wrapped asset (see section 6). |
+| **Chain 138** | **CCIPWETH10Bridge** — `contracts/ccip/CCIPWETH10Bridge.sol` (different contract than BSC bytecode). See `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md`. |
+| **Ethereum (1)** | **CCIPWETH10Bridge** at same hex per `smom-dbis-138/docs/deployment/CONTRACT_OWNERSHIP_VERIFICATION.md`. |
+
+**Polygon (137):** Project docs list **WETH9** at the **same** `0xe0e932…` address (another chain, wrapper deployment — confirm on Polygonscan if cited to BscScan).
+
+This explains why **Etherscan** may show a **bridge** at `0xe0…` while **BscScan** shows **WETH**: different chains, different deployed bytecode at the colliding address.
+
+---
+
+## 5. Canonical “WETH” on BSC (contrast)
+
+Widely used **Binance-Peg Ethereum / BSC WETH** (bridged ETH representation) is **not** this contract. Example reference used in this repo’s routing/config context:
+
+- **BSC WETH (canonical / widely listed):** `0x2170Ed0880ac9A755fd29B2688956BD959F933F8` (verify against your token lists and BscScan’s official listings).
+
+**Our position:** `0xe0E932…` on BSC is a **separate**, **project-deployed** wrapper using **WETH9-like** `name`/`symbol` for **cross-chain naming parity**, **not** a claim to be the official Binance-Peg WETH contract.
+
+---
+
+## 6. Internal configuration (evidence of legitimate use)
+
+**Relay / destination asset (BSC)** — `smom-dbis-138/services/relay/.env.bsc` (template in repo):
+
+- `DEST_CHAIN_ID=56`
+- `DEST_WETH9_ADDRESS=0xe0E93247376aa097dB308B92e6Ba36bA015535D0`
+- `RELAYER_ADDRESS=0x4A666F96fC8764181194447A7dFdb7d471b301C8`
+
+**Canonical project config:**
+
+- `config/contract-addresses.conf`: `ADDR_CCIPWETH10_BRIDGE="0xe0E93247376aa097dB308B92e6Ba36bA015535D0"` (Chain **138** bridge address — same hex, different chain than BSC token).
+
+**Public-facing / operator docs (non-exhaustive):**
+
+- `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` — CCIPWETH10Bridge on 138  
+- `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md`  
+- `docs/07-ccip/CCIP_SECURITY_DOCUMENTATION.md`, `CCIP_SENDER_CONTRACT_REFERENCE.md`  
+- `docs/04-configuration/METAMASK_CONFIGURATION.md` — bridge interactions on **138** (same hex as bridge, not BSC token)
+
+---
+
+## 7. Ownership and control
+
+- **`WETH.sol`** has **no** owner/admin in code (see `CONTRACT_OWNERSHIP_VERIFICATION.md` pattern for other chains: “No ownership (standard ERC20)” for WETH9 deployments).
+- **Deployer** `0x4A66…` is the consistent project deployer across CCIP and token scripts (see workspace operator docs).
+
+If BscScan requests **proof of control**: sign a message or complete **contract ownership** flows they specify; verified source already ties bytecode to published Solidity.
+
+---
+
+## 8. Risk and honesty (for support and users)
+
+- **Users** must **never** trust **symbol “WETH”** alone on BSC — **always** verify **contract address** against the project’s published lists.
+- The team **acknowledges** the **naming collision** with widely known WETH branding; ideal long-term mitigation is **distinct on-chain name/symbol** on **future** deployments (requires **new contract**, migration, and integrator updates).
+- **This DD is not legal or investment advice** and does not guarantee BscScan will remove any flag.
+
+---
+
+## 9. Suggested token profile text (token update form)
+
+Adapt to BscScan character limits and policies:
+
+> **Project:** [Your legal/project name]  
+> **Description:** Project-deployed WETH9-style wrapped **native BNB** for CCIP/relay and cross-chain testing. **Not** Binance-Peg Ethereum (`0x2170…933F8`). Do not confuse with official BSC bridged WETH.  
+> **Website / docs:** [Link to public doc listing this BSC address explicitly]  
+> **Social:** [Official channels]
+
+Link directly to this file or a **public** mirror that lists **BSC `0xe0E932…`** as **intentional**.
+
+---
+
+## 10. Evidence checklist (attach to ticket)
+
+- [ ] Link to **BscScan** contract + **Read Contract** `name`/`symbol`/`decimals`  
+- [ ] **Creation transaction** link  
+- [ ] **Verified source** screenshot or link  
+- [ ] **Deployer** address and short bio (same as Chain 138 / CCIP docs)  
+- [ ] **Contrast:** canonical BSC WETH `0x2170…` vs this address (table)  
+- [ ] **Optional:** GitHub or public repo path to `smom-dbis-138/contracts/tokens/WETH.sol` (if repository is public)  
+- [ ] **Optional:** Signed message from deployer per BscScan instructions  
+
+---
+
+## 11. Draft message to BscScan support (template)
+
+Subject: **Token review — impersonation false positive — `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` (BSC)**
+
+Body (edit placeholders):
+
+> Hello BscScan team,  
+>  
+> We request review of the **impersonation / suspicious** flags on contract **`0xe0E93247376aa097dB308B92e6Ba36bA015535D0`** (BSC).  
+>  
+> **Facts:**  
+> - Contract is **verified** as a standard **WETH9-style** wrapper (`deposit`/`withdraw` native BNB); source matches our published `WETH.sol`.  
+> - **Deployer:** `0x4A666F96fC8764181194447A7dFdb7d471b301C8` (consistent across our CCIP deployments).  
+> - We are **not** claiming to be **Binance-Peg WETH** (`0x2170Ed0880ac9A755fd29B2688956BD959F933F8`). The on-chain **name/symbol** reuse is for cross-chain parity; we understand this collides with user expectations on BSC.  
+> - Note: the **same hex address** on **Ethereum/Chain 138** points to **different bytecode** (our CCIP bridge). BSC shows **only** the WETH wrapper.  
+>  
+> **Ask:** Reassess the **impersonation** classification; if appropriate, add an **official nametag** or allow an updated **token profile** clarifying “project wrapped BNB — not official BSC WETH.”  
+>  
+> Evidence: [links + attachments].  
+>  
+> Thank you.
+
+---
+
+## 12. References in this repository
+
+| Document | Relevance |
+|----------|-----------|
+| `smom-dbis-138/contracts/tokens/WETH.sol` | BSC-verified source match |
+| `smom-dbis-138/contracts/ccip/CCIPWETH10Bridge.sol` | Bridge **on other chains** at same hex |
+| `config/contract-addresses.conf` | Chain 138 bridge hex |
+| `smom-dbis-138/services/relay/.env.bsc` | BSC destination wrapped asset |
+| `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` | Chain 138 address matrix |
+| `smom-dbis-138/docs/deployment/CONTRACT_OWNERSHIP_VERIFICATION.md` | Deployer / multi-chain table |
+| `docs/11-references/TOKENS_DEPLOYER_DEPLOYED_ON_OTHER_CHAINS.md` | Deploy-all / WETH deploy behavior |
+
+---
+
+**Document maintainer:** Update after any redeploy, rename, or BscScan decision; keep public-facing address list in sync.
diff --git a/docs/07-ccip/CCIP_SECURITY_DOCUMENTATION.md b/docs/07-ccip/CCIP_SECURITY_DOCUMENTATION.md
index 43c04e7..af503bb 100644
--- a/docs/07-ccip/CCIP_SECURITY_DOCUMENTATION.md
+++ b/docs/07-ccip/CCIP_SECURITY_DOCUMENTATION.md
@@ -15,7 +15,7 @@
 ## 🔐 Contract Access Control
 
 ### CCIP Router
-- **Address**: `0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e`
+- **Address**: `0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817`
 - **Access Control**: Standard CCIP Router implementation
 - **Owner Function**: `owner()` function not available (may use different access control pattern)
 - **Admin Functions**: Standard CCIP Router admin functions
@@ -27,12 +27,12 @@
 - **Address**: `0x105F8A15b819948a89153505762444Ee9f324684`
 - **Access Control**: Standard CCIP Sender implementation
 - **Owner Function**: `owner()` function not available
-- **Router Reference**: `0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e`
+- **Router Reference**: `0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817`
 
 **Note**: Access control details need to be retrieved from contract source code or deployment logs.
 
 ### CCIPWETH9Bridge
-- **Address**: Use env `CCIPWETH9_BRIDGE_CHAIN138` (set after `scripts/deploy-and-configure-weth9-bridge-chain138.sh`); canonical: `0x971cD9D156f193df8051E48043C476e53ECd4693`. **Deprecated (do not use):** `0x89dd12025bfCD38A168455A44B400e913ED33BE2` — old bridge with router mismatch. See [CONTRACT_INVENTORY_AND_VERIFICATION.md](../11-references/CONTRACT_INVENTORY_AND_VERIFICATION.md).
+- **Address**: Use env `CCIPWETH9_BRIDGE_CHAIN138` (set after `scripts/deploy-and-configure-weth9-bridge-chain138.sh`); canonical: `0xcacfd227A040002e49e2e01626363071324f820a`. **Deprecated (do not use):** `0x89dd12025bfCD38A168455A44B400e913ED33BE2` — old bridge with router mismatch. See [CONTRACT_INVENTORY_AND_VERIFICATION.md](../11-references/CONTRACT_INVENTORY_AND_VERIFICATION.md).
 - **Access Control**: Bridge contract access control
 - **Owner Function**: `owner()` function not available
 - **Admin Functions**: Bridge-specific admin functions
@@ -138,4 +138,3 @@ If contracts are verified on Blockscout, check the source code for:
 
 **Last Updated**: $(date)  
 **Status**: ⚠️ **INCOMPLETE** - Owner addresses need to be retrieved
-
diff --git a/docs/07-ccip/CCIP_SENDER_CONTRACT_REFERENCE.md b/docs/07-ccip/CCIP_SENDER_CONTRACT_REFERENCE.md
index ec31b7b..ff3d974 100644
--- a/docs/07-ccip/CCIP_SENDER_CONTRACT_REFERENCE.md
+++ b/docs/07-ccip/CCIP_SENDER_CONTRACT_REFERENCE.md
@@ -41,14 +41,14 @@ This is why this address appears in CCIP transfers - it's the **destination brid
 ## 🔗 Related Contracts
 
 ### CCIP Router
-- **Address**: `0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e`
+- **Address**: `0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817`
 - **Relationship**: The CCIP Sender interacts with the CCIP Router to send messages
 - **Fee Token**: `0x514910771AF9Ca656af840dff83E8264EcF986CA` (LINK)
 - **Base Fee**: 1000000000000000 wei
 - **Data Fee Per Byte**: 100000000 wei
 
 ### Bridge Contracts
-- **CCIPWETH9Bridge**: Use env CCIPWETH9_BRIDGE_CHAIN138 or address `0x971cD9D156f193df8051E48043C476e53ECd4693`. **Deprecated (do not use):** `0x89dd12025bfCD38A168455A44B400e913ED33BE2` — old bridge, router mismatch. See [CONTRACT_INVENTORY_AND_VERIFICATION.md](../11-references/CONTRACT_INVENTORY_AND_VERIFICATION.md).
+- **CCIPWETH9Bridge**: Use env CCIPWETH9_BRIDGE_CHAIN138 or address `0xcacfd227A040002e49e2e01626363071324f820a`. **Deprecated (do not use):** `0x89dd12025bfCD38A168455A44B400e913ED33BE2` — old bridge, router mismatch. See [CONTRACT_INVENTORY_AND_VERIFICATION.md](../11-references/CONTRACT_INVENTORY_AND_VERIFICATION.md).
 - **CCIPWETH10Bridge**: `0xe0E93247376aa097dB308B92e6Ba36bA015535D0`
 
 ---
@@ -89,7 +89,7 @@ This is why this address appears in CCIP transfers - it's the **destination brid
 The CCIP Sender contract is used by the CCIP Monitor service. Configuration in `/opt/ccip-monitor/.env`:
 
 ```bash
-CCIP_ROUTER_ADDRESS=0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e
+CCIP_ROUTER_ADDRESS=0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817
 CCIP_SENDER_ADDRESS=0x105F8A15b819948a89153505762444Ee9f324684
 RPC_URL_138=http://192.168.11.211:8545
 CHAIN_ID=138
@@ -270,7 +270,7 @@ The CCIP Monitor service (VMID 3501) listens to these events and tracks:
 CCIP_SENDER=0x105F8A15b819948a89153505762444Ee9f324684
 
 # Related Contracts
-CCIP_ROUTER=0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e
+CCIP_ROUTER=0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817
 LINK_TOKEN=0x514910771AF9Ca656af840dff83E8264EcF986CA
 
 # RPC Endpoint (admin/deployment) — use standard RPC_URL_138
@@ -286,4 +286,3 @@ EXPLORER_URL=https://explorer.d-bis.org/address/0x105F8A15b819948a89153505762444
 
 **Last Updated**: $(date)  
 **Status**: ✅ Contract deployed and operational on Chain 138
-
diff --git a/docs/07-ccip/NON_PREFUNDED_AVAX_MIGRATION_RUNBOOK.md b/docs/07-ccip/NON_PREFUNDED_AVAX_MIGRATION_RUNBOOK.md
index 402f2c6..0db8429 100644
--- a/docs/07-ccip/NON_PREFUNDED_AVAX_MIGRATION_RUNBOOK.md
+++ b/docs/07-ccip/NON_PREFUNDED_AVAX_MIGRATION_RUNBOOK.md
@@ -84,7 +84,7 @@ cast call 0xa4B9DD039565AeD9641D45b57061f99d9cA6Df08 "balanceOf(address)(uint256
 
 Check source escrow:
 ```bash
-cast call 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2 "balanceOf(address)(uint256)" 0x9cba0D04Ae5f6f16e3C599025aB97a05c4A593d5 --rpc-url https://rpc-http-pub.d-bis.org
+cast call 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2 "balanceOf(address)(uint256)" 0xcacfd227A040002e49e2e01626363071324f820a --rpc-url https://rpc-http-pub.d-bis.org
 ```
 
 ## 6. Related Files
diff --git a/docs/08-monitoring/BLOCKSCOUT_START_INSTRUCTIONS.md b/docs/08-monitoring/BLOCKSCOUT_START_INSTRUCTIONS.md
index aa26385..f68efd8 100644
--- a/docs/08-monitoring/BLOCKSCOUT_START_INSTRUCTIONS.md
+++ b/docs/08-monitoring/BLOCKSCOUT_START_INSTRUCTIONS.md
@@ -189,7 +189,7 @@ Or manually:
 
 Navigate to contract on Blockscout:
 - Oracle Proxy: https://explorer.d-bis.org/address/0x3304b747e565a97ec8ac220b0b6a1f6ffdb837e6
-- CCIP Router: https://explorer.d-bis.org/address/0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e
+- CCIP Router: https://explorer.d-bis.org/address/0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817
 
 ### 3. Check Verification Status
 
@@ -208,4 +208,3 @@ Navigate to contract on Blockscout:
 ---
 
 **Last Updated**: $(date)
-
diff --git a/docs/08-monitoring/BLOCKSCOUT_VERIFICATION_GUIDE.md b/docs/08-monitoring/BLOCKSCOUT_VERIFICATION_GUIDE.md
index 2241a5e..64004bf 100644
--- a/docs/08-monitoring/BLOCKSCOUT_VERIFICATION_GUIDE.md
+++ b/docs/08-monitoring/BLOCKSCOUT_VERIFICATION_GUIDE.md
@@ -172,7 +172,7 @@ forge verify-contract 0x3304b747e565a97ec8ac220b0b6a1f6ffdb837e6 \
   --chain-id 138 --rpc-url "$RPC" --verifier blockscout --verifier-url "$VERIFIER" --flatten
 
 # CCIPWETH9Bridge
-forge verify-contract 0x971cD9D156f193df8051E48043C476e53ECd4693 \
+forge verify-contract 0xcacfd227A040002e49e2e01626363071324f820a \
   contracts/ccip/CCIPWETH9Bridge.sol:CCIPWETH9Bridge \
   --chain-id 138 --rpc-url "$RPC" --verifier blockscout --verifier-url "$VERIFIER" --flatten
 
@@ -286,4 +286,3 @@ If automated verification fails, you can verify contracts manually through the B
 
 **Last Updated**: 2026-02-23  
 **Status**: ✅ Ready for use with ChainID 138
-
diff --git a/docs/11-references/ADDRESS_MATRIX_AND_STATUS.md b/docs/11-references/ADDRESS_MATRIX_AND_STATUS.md
index cae4091..58a9407 100644
--- a/docs/11-references/ADDRESS_MATRIX_AND_STATUS.md
+++ b/docs/11-references/ADDRESS_MATRIX_AND_STATUS.md
@@ -62,9 +62,9 @@
 
 | Contract | Address | Status | Notes |
 |----------|---------|--------|-------|
-| CCIP Router | `0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e` | ✅ | |
+| CCIP Router | `0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817` | ✅ | |
 | CCIP Sender | `0x105F8A15b819948a89153505762444Ee9f324684` | ✅ | |
-| CCIPWETH9Bridge | `0x971cD9D156f193df8051E48043C476e53ECd4693` | ✅ | Use for sendCrossChain |
+| CCIPWETH9Bridge | `0xcacfd227A040002e49e2e01626363071324f820a` | ✅ | Use for sendCrossChain |
 | CCIPWETH10Bridge | `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` | ✅ | |
 | CCIPWETH9Bridge (old) | `0x89dd12025bfCD38A168455A44B400e913ED33BE2` | ⛔ | Deprecated |
 
@@ -188,7 +188,7 @@ Bridges (CCIPWETH9 / CCIPWETH10) and LINK funding per runbook. Addresses in `smo
 | POOL_CUSDTCUSDC | `0x9fcB06Aa1FD5215DC0E91Fd098aeff4B62fEa5C8` |
 | POOL_CUSDTUSDT | `0xa3Ee6091696B28e5497b6F491fA1e99047250c59` |
 | POOL_CUSDCUSDC | `0x90bd9Bf18Daa26Af3e814ea224032d015db58Ea5` |
-| CCIPWETH9_BRIDGE_CHAIN138 | `0x971cD9D156f193df8051E48043C476e53ECd4693` |
+| CCIPWETH9_BRIDGE_CHAIN138 | `0xcacfd227A040002e49e2e01626363071324f820a` |
 | CCIPWETH10_BRIDGE_CHAIN138 | `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` |
 | LINK_TOKEN | `0xb7721dD53A8c629d9f1Ba31a5819AFe250002b03` |
 | COMPLIANT_USDT_ADDRESS / cUSDT | `0x93E66202A11B1772E55407B32B44e5Cd8eda7f22` |
diff --git a/docs/11-references/CONTRACTS_TO_DEPLOY.md b/docs/11-references/CONTRACTS_TO_DEPLOY.md
index aa99c7a..a9f40ce 100644
--- a/docs/11-references/CONTRACTS_TO_DEPLOY.md
+++ b/docs/11-references/CONTRACTS_TO_DEPLOY.md
@@ -20,7 +20,7 @@ This document lists all contracts that have deployment scripts, grouped by repo
 
 | Contract | Script | Status |
 |----------|--------|--------|
-| **CCIPWETH9Bridge** | `script/DeployCCIPWETH9Bridge.s.sol` | ✅ `0x971cD9D156f193df8051E48043C476e53ECd4693` |
+| **CCIPWETH9Bridge** | `script/DeployCCIPWETH9Bridge.s.sol` | ✅ `0xcacfd227A040002e49e2e01626363071324f820a` |
 | **WETH9** (optional) | — | Pre-deployed in genesis |
 
 **Deploy (if needed):** `GAS_PRICE=1000000000 ./scripts/deploy-and-configure-weth9-bridge-chain138.sh`
diff --git a/docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md b/docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md
index da8f6a7..dc3ab5a 100644
--- a/docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md
+++ b/docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md
@@ -45,9 +45,9 @@ Contracts deployed after chain initialization:
 |----------|---------|--------|---------|
 | **Oracle Aggregator** | `0x99b3511a2d315a497c8112c1fdd8d508d4b1e506` | ✅ Deployed | Price feed aggregator (same address as Multicall — operator to confirm which contract is at this slot on explorer) |
 | **Oracle Proxy** | `0x3304b747e565a97ec8ac220b0b6a1f6ffdb837e6` | ✅ Deployed | **MetaMask price feed** |
-| **CCIP Router** | `0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e` | ✅ Deployed | Cross-chain router |
+| **CCIP Router** | `0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817` | ✅ Deployed | Cross-chain router |
 | **CCIP Sender** | `0x105F8A15b819948a89153505762444Ee9f324684` | ✅ Deployed | Cross-chain sender | [📄 Details](../07-ccip/CCIP_SENDER_CONTRACT_REFERENCE.md) |
-| **CCIPWETH9Bridge** | `0x971cD9D156f193df8051E48043C476e53ECd4693` | ✅ Deployed | WETH9 cross-chain (working router) | **Use for sendCrossChain** |
+| **CCIPWETH9Bridge** | `0xcacfd227A040002e49e2e01626363071324f820a` | ✅ Deployed | WETH9 cross-chain (working router) | **Use for sendCrossChain** |
 | **CCIPWETH10Bridge** | `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` | ✅ Deployed | WETH10 cross-chain | |
 | **MerchantSettlementRegistry** | `0x16D9A2cB94A0b92721D93db4A6Cd8023D3338800` | ✅ Deployed | alltra-lifi-settlement | |
 | **WithdrawalEscrow** | `0xe77cb26eA300e2f5304b461b0EC94c8AD6A7E46D` | ✅ Deployed | alltra-lifi-settlement | |
@@ -119,7 +119,7 @@ CHAIN_ID=138
 
 ### CCIP Monitor Service (VMID 3501)
 ```bash
-CCIP_ROUTER_ADDRESS=0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e
+CCIP_ROUTER_ADDRESS=0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817
 CCIP_SENDER_ADDRESS=0x105F8A15b819948a89153505762444Ee9f324684
 RPC_URL_138=http://192.168.11.211:8545
 CHAIN_ID=138
@@ -158,9 +158,9 @@ Use these addresses in config and .env. **smom-dbis-138/.env** has been reconcil
 | DebtRegistry | `0x95BC4A997c0670d5DAC64d55cDf3769B53B63C28` |
 | PolicyManager | `0x0C4FD27018130A00762a802f91a72D6a64a60F14` |
 | TokenImplementation | `0x0059e237973179146237aB49f1322E8197c22b21` |
-| CCIPWETH9_BRIDGE_CHAIN138 | `0x971cD9D156f193df8051E48043C476e53ECd4693` |
+| CCIPWETH9_BRIDGE_CHAIN138 | `0xcacfd227A040002e49e2e01626363071324f820a` |
 | LINK_TOKEN / CCIP_FEE_TOKEN | `0xb7721dD53A8c629d9f1Ba31a5819AFe250002b03` |
-| CCIP_ROUTER | `0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e` |
+| CCIP_ROUTER | `0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817` |
 | UNIVERSAL_ASSET_REGISTRY | `0xAEE4b7fBe82E1F8295951584CBc772b8BBD68575` |
 | GOVERNANCE_CONTROLLER | `0xA6891D5229f2181a34D4FF1B515c3Aa37dd90E0e` |
 | UNIVERSAL_CCIP_BRIDGE | `0xCd42e8eD79Dc50599535d1de48d3dAFa0BE156F8` |
@@ -200,9 +200,8 @@ Chain 138 WETH9 bridges (LINK fee and native ETH fee) have mainnet destination s
 
 | Address | Note |
 |---------|------|
-| `0x89dd12025bfCD38A168455A44B400e913ED33BE2` | **Deprecated** — old CCIPWETH9Bridge with router mismatch (no code at router). Use **CCIPWETH9Bridge** at `0x971cD9D156f193df8051E48043C476e53ECd4693` instead. See [ADDRESS_MATRIX_AND_STATUS.md](ADDRESS_MATRIX_AND_STATUS.md). |
+| `0x89dd12025bfCD38A168455A44B400e913ED33BE2` | **Deprecated** — old CCIPWETH9Bridge with router mismatch (no code at router). Use **CCIPWETH9Bridge** at `0xcacfd227A040002e49e2e01626363071324f820a` instead. See [ADDRESS_MATRIX_AND_STATUS.md](ADDRESS_MATRIX_AND_STATUS.md). |
 
 ---
 
 **Related:** [DEPLOYER_CONTRACTS_INVENTORY_AND_VERIFICATION_STATUS](DEPLOYER_CONTRACTS_INVENTORY_AND_VERIFICATION_STATUS.md) (all contracts by deployer, network, verified status) | [EXPLORER_TOKEN_LIST_CROSSCHECK](EXPLORER_TOKEN_LIST_CROSSCHECK.md) (Explorer /tokens vs repo token lists) | [ADDRESS_MATRIX_AND_STATUS](ADDRESS_MATRIX_AND_STATUS.md) (correlated matrix and status) | [EXPLORER_AND_BLOCKSCAN_REFERENCE](EXPLORER_AND_BLOCKSCAN_REFERENCE.md) (correct explorer vs blockscan.com) | [ADDRESS_MATRIX_AND_STATUS](ADDRESS_MATRIX_AND_STATUS.md) | [CONTRACTS_TO_DEPLOY](CONTRACTS_TO_DEPLOY.md) | [CHAIN138_TOKEN_ADDRESSES](CHAIN138_TOKEN_ADDRESSES.md) | [TOKEN_MAPPING_AND_MAINNET_ADDRESSES](../07-ccip/TOKEN_MAPPING_AND_MAINNET_ADDRESSES.md) (138↔Mainnet token mapping)
-
diff --git a/docs/11-references/CONTRACT_NEXT_STEPS_AND_RECOMMENDATIONS_COMPLETE.md b/docs/11-references/CONTRACT_NEXT_STEPS_AND_RECOMMENDATIONS_COMPLETE.md
index 0c51f78..4cccdaa 100644
--- a/docs/11-references/CONTRACT_NEXT_STEPS_AND_RECOMMENDATIONS_COMPLETE.md
+++ b/docs/11-references/CONTRACT_NEXT_STEPS_AND_RECOMMENDATIONS_COMPLETE.md
@@ -64,9 +64,9 @@ for addr in \
   0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f \
   0x99b3511a2d315a497c8112c1fdd8d508d4b1e506 \
   0x3304b747e565a97ec8ac220b0b6a1f6ffdb837e6 \
-  0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e \
+  0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817 \
   0x105F8A15b819948a89153505762444Ee9f324684 \
-  0x971cD9D156f193df8051E48043C476e53ECd4693 \
+  0xcacfd227A040002e49e2e01626363071324f820a \
   0xe0E93247376aa097dB308B92e6Ba36bA015535D0 \
   0xb7721dD53A8c629d9f1Ba31a5819AFe250002b03 \
   0x93E66202A11B1772E55407B32B44e5Cd8eda7f22 \
@@ -108,7 +108,7 @@ Manual verification: https://explorer.d-bis.org/address/<ADDRESS>#verify-contrac
 
 ### 3.2 Deprecated and security
 
-- **Do not use** CCIPWETH9Bridge at `0x89dd12025bfCD38A168455A44B400e913ED33BE2`. Use only `0x971cD9D156f193df8051E48043C476e53ECd4693` and set `CCIPWETH9_BRIDGE_CHAIN138` in env.
+- **Do not use** CCIPWETH9Bridge at `0x89dd12025bfCD38A168455A44B400e913ED33BE2`. Use only `0xcacfd227A040002e49e2e01626363071324f820a` and set `CCIPWETH9_BRIDGE_CHAIN138` in env.
 - **Secrets:** Never commit `.env` or private keys. Use [MASTER_SECRETS_INVENTORY](../04-configuration/MASTER_SECRETS_INVENTORY.md) and rotate any exposed keys.
 - **Access:** Restrict deployer key and RPC admin access (RPC_URL_138 = Chain 138 Core) to operators who need them.
 
diff --git a/docs/11-references/DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md b/docs/11-references/DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md
index 5028230..25137da 100644
--- a/docs/11-references/DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md
+++ b/docs/11-references/DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md
@@ -61,7 +61,7 @@
 
 | Destination | Bridge type | Contract (138) | Status | Notes |
 |-------------|-------------|----------------|--------|--------|
-| Ethereum (1) | CCIP WETH9 / WETH10 | CCIPWETH9Bridge `0x971cD9D156f193df8051E48043C476e53ECd4693`, CCIPWETH10Bridge `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` | ✅ | Relay path to mainnet (CCIPRelayBridge). |
+| Ethereum (1) | CCIP WETH9 / WETH10 | CCIPWETH9Bridge `0xcacfd227A040002e49e2e01626363071324f820a`, CCIPWETH10Bridge `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` | ✅ | Relay path to mainnet (CCIPRelayBridge). |
 | BSC (56) | CCIP | Same bridges + addDestination(selector, receiver) | ✅ | Per CCIP_BRIDGE_DESTINATIONS_AND_LINK_FUNDING. |
 | Polygon (137) | CCIP | Same | ✅ | |
 | Arbitrum (42161) | CCIP | Same | ✅ | |
diff --git a/docs/11-references/DEPLOYER_CONTRACTS_INVENTORY_AND_VERIFICATION_STATUS.md b/docs/11-references/DEPLOYER_CONTRACTS_INVENTORY_AND_VERIFICATION_STATUS.md
index 25f2b01..e725f62 100644
--- a/docs/11-references/DEPLOYER_CONTRACTS_INVENTORY_AND_VERIFICATION_STATUS.md
+++ b/docs/11-references/DEPLOYER_CONTRACTS_INVENTORY_AND_VERIFICATION_STATUS.md
@@ -63,9 +63,9 @@ Explorer: https://explorer.d-bis.org
 
 | Contract | Address | Deployed by | Verified |
 |----------|---------|-------------|----------|
-| CCIP Router | `0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e` | Deployer | Unknown |
+| CCIP Router | `0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817` | Deployer | Unknown |
 | CCIP Sender | `0x105F8A15b819948a89153505762444Ee9f324684` | Deployer | Unknown |
-| CCIPWETH9Bridge | `0x971cD9D156f193df8051E48043C476e53ECd4693` | Deployer | Unknown |
+| CCIPWETH9Bridge | `0xcacfd227A040002e49e2e01626363071324f820a` | Deployer | Unknown |
 | CCIPWETH10Bridge | `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` | Deployer | Unknown |
 | CCIPReceiver (2026-02-13) | `0xC12236C03b28e675d376774FCE2C2C052488430F` | Deployer | Unknown |
 
@@ -106,6 +106,8 @@ Explorer: https://explorer.d-bis.org
 
 ### DODO PMM / liquidity
 
+> Note: the Chain 138 DODO stack is deployed and on-chain confirmed, but explorer source publication is still pending manual UI acceptance as of 2026-03-24.
+
 | Contract | Address | Deployed by | Verified |
 |----------|---------|-------------|----------|
 | DODOPMMIntegration | `0x79cdbaFBaA0FdF9F55D26F360F54cddE5c743F7D` | Deployer | Unknown |
diff --git a/docs/11-references/DEPLOYER_TO_PUBLIC_STABLECOIN_ROUTES.md b/docs/11-references/DEPLOYER_TO_PUBLIC_STABLECOIN_ROUTES.md
index e620a49..6040f40 100644
--- a/docs/11-references/DEPLOYER_TO_PUBLIC_STABLECOIN_ROUTES.md
+++ b/docs/11-references/DEPLOYER_TO_PUBLIC_STABLECOIN_ROUTES.md
@@ -72,7 +72,7 @@ Tokens the deployer **can hold** as source (mintable to deployer on 138/Cronos,
 
 | From (138, deployer holds) | To (Mainnet public stable) | Route | Status |
 |----------------------------|----------------------------|--------|--------|
-| WETH9                     | WETH (then DEX) → USDT / USDC / DAI | CCIP WETH9 bridge `0x971cD9D156f193df8051E48043C476e53ECd4693` → Mainnet → swap via native DEX | ✅ Live (bridge); **requires Mainnet WETH funding of CCIPRelayBridge**; swap via DEX |
+| WETH9                     | WETH (then DEX) → USDT / USDC / DAI | CCIP WETH9 bridge `0xcacfd227A040002e49e2e01626363071324f820a` → Mainnet → swap via native DEX | ✅ Live (bridge); **requires Mainnet WETH funding of CCIPRelayBridge**; swap via DEX |
 | WETH10                    | Same                       | CCIP WETH10 bridge `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` → Mainnet → DEX | ✅ Live; **same prerequisite** |
 | cUSDT                     | USDT / USDC / DAI          | **No direct bridge.** Swap 138: cUSDT→cUSDC or cUSDT→WETH (no cUSDT→WETH pool documented); or cUSDT→cUSDC then no bridge for cUSDC. **Indirect:** cUSDT→cUSDC (DODO) then no 138→mainnet bridge for compliant stables. Use: **cUSDT/cUSDC → swap to WETH on 138 (no pool today)** then CCIP WETH→mainnet→DEX→USDT/USDC/DAI. | ⚠️ Swap leg on 138 to WETH not documented; bridge leg ✅ |
 | cUSDC                     | USDT / USDC / DAI          | Same as cUSDT; need 138 cUSDC→WETH path (not in docs). Then CCIP WETH→mainnet→DEX. | ⚠️ Same |
diff --git a/docs/11-references/LINK_TOKEN_ADDRESSES_REFERENCE.md b/docs/11-references/LINK_TOKEN_ADDRESSES_REFERENCE.md
index a3ce244..4e8f08a 100644
--- a/docs/11-references/LINK_TOKEN_ADDRESSES_REFERENCE.md
+++ b/docs/11-references/LINK_TOKEN_ADDRESSES_REFERENCE.md
@@ -44,6 +44,6 @@ Use [Chainlink CCIP Supported Networks](https://docs.chain.link/ccip/supported-n
 To confirm the bridge fee token on Chain 138 (should match LINK above):
 
 ```bash
-cast call 0x971cD9D156f193df8051E48043C476e53ECd4693 "feeToken()(address)" --rpc-url $RPC_URL_138
+cast call 0xcacfd227A040002e49e2e01626363071324f820a "feeToken()(address)" --rpc-url $RPC_URL_138
 # Expected: 0xb7721dD53A8c629d9f1Ba31a5819AFe250002b03
 ```
diff --git a/docs/11-references/SMART_CONTRACTS_INVENTORY_ALL_CHAINS.md b/docs/11-references/SMART_CONTRACTS_INVENTORY_ALL_CHAINS.md
index db89f5f..a3cbfd7 100644
--- a/docs/11-references/SMART_CONTRACTS_INVENTORY_ALL_CHAINS.md
+++ b/docs/11-references/SMART_CONTRACTS_INVENTORY_ALL_CHAINS.md
@@ -25,7 +25,7 @@
 | WETH9, WETH10, Multicall | Genesis: 0xC02a..., 0xf4BB..., 0x99b3... | smom-dbis-138 |
 | Oracle Aggregator, Oracle Proxy | 0x99b3..., 0x3304b7... | smom-dbis-138 |
 | CCIP Router, CCIP Sender | 0x8078A0..., 0x105F8A... | smom-dbis-138 |
-| CCIPWETH9Bridge, CCIPWETH10Bridge | 0x971cD9..., 0xe0E932... | smom-dbis-138 |
+| CCIPWETH9Bridge, CCIPWETH10Bridge | 0xcacfd..., 0xe0E932... | smom-dbis-138 |
 | LINK, cUSDT, cUSDC | 0xb772..., 0x93E6..., 0xf222... | smom-dbis-138 |
 | TokenRegistry, TokenFactory | 0x91Efe..., 0xEBFb5C... | smom-dbis-138 |
 | Price Feed Keeper | 0xD3AD68... | smom-dbis-138 |
@@ -35,7 +35,7 @@
 | UniversalAssetRegistry, GovernanceController | 0xAEE4b7..., 0xA6891D... | smom-dbis-138 (phased core 2026-02-11) |
 | UniversalCCIPBridge, BridgeOrchestrator | 0xCd42e8..., 0x89aB42... | smom-dbis-138 (phased core 2026-02-11) |
 
-**Deprecated (Chain 138):** CCIPWETH9Bridge at `0x89dd...` — do not use; use `0x971cD9D156f193df8051E48043C476e53ECd4693`.
+**Deprecated (Chain 138):** CCIPWETH9Bridge at `0x89dd...` — do not use; use `0xcacfd227A040002e49e2e01626363071324f820a`.
 
 ---
 
@@ -125,7 +125,7 @@
 Summary:
 
 1. **Chain 138:** Confirm all 26 deployed addresses on explorer.d-bis.org; run `./scripts/verify/check-contracts-on-chain-138.sh` and Blockscout verification; .env reconciled (one entry per variable).
-2. **Deprecated:** Use CCIPWETH9Bridge `0x971c...` only; do not use `0x89dd...`.
+2. **Deprecated:** Use CCIPWETH9Bridge `0xcacfd...` only; do not use `0x89dd...`.
 3. **Phased core (138):** **Deployed 2026-02-11.** Addresses in CONTRACT_ADDRESSES_REFERENCE. To redeploy: run 01_DeployCore then 02_DeployBridges; set and document env.
 4. **Trustless bridge:** Deploy from script/bridge/trustless/ when needed; update config/production placeholders.
 5. **Mainnet/multichain:** Use DeployAll or chain-specific scripts; document addresses per chain.
diff --git a/docs/11-references/SMART_CONTRACTS_INVENTORY_SIMPLE.md b/docs/11-references/SMART_CONTRACTS_INVENTORY_SIMPLE.md
index a3acfa5..149153d 100644
--- a/docs/11-references/SMART_CONTRACTS_INVENTORY_SIMPLE.md
+++ b/docs/11-references/SMART_CONTRACTS_INVENTORY_SIMPLE.md
@@ -15,9 +15,9 @@
 | **Multicall** | `0x99b3511a2d315a497c8112c1fdd8d508d4b1e506` | ✅ Deployed (genesis) | Confirm on Blockscout |
 | **Oracle Aggregator** | `0x99b3511a2d315a497c8112c1fdd8d508d4b1e506` | ✅ Deployed | Confirm on Blockscout (same slot as Multicall?) |
 | **Oracle Proxy** | `0x3304b747e565a97ec8ac220b0b6a1f6ffdb837e6` | ✅ Deployed | Confirm + verify (MetaMask price feed) |
-| **CCIP Router** | `0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e` | ✅ Deployed | Confirm + verify |
+| **CCIP Router** | `0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817` | ✅ Deployed | Confirm + verify |
 | **CCIP Sender** | `0x105F8A15b819948a89153505762444Ee9f324684` | ✅ Deployed | Verify on Blockscout |
-| **CCIPWETH9Bridge** | `0x971cD9D156f193df8051E48043C476e53ECd4693` | ✅ Deployed | Use for sendCrossChain; verify |
+| **CCIPWETH9Bridge** | `0xcacfd227A040002e49e2e01626363071324f820a` | ✅ Deployed | Use for sendCrossChain; verify |
 | **CCIPWETH10Bridge** | `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` | ✅ Deployed | Confirm + verify |
 | **LINK** | `0xb7721dD53A8c629d9f1Ba31a5819AFe250002b03` | ✅ Deployed | Confirm (CCIP fees) |
 | **CompliantUSDT (cUSDT)** | `0x93E66202A11B1772E55407B32B44e5Cd8eda7f22` | ✅ Deployed | Confirm + verify |
@@ -27,7 +27,7 @@
 | **Price Feed Keeper** | `0xD3AD6831aacB5386B8A25BB8D8176a6C8a026f04` | ✅ Deployed | Confirm + verify |
 | **MerchantSettlementRegistry** | `0x16D9A2cB94A0b92721D93db4A6Cd8023D3338800` | ✅ Deployed | Confirm + verify |
 | **WithdrawalEscrow** | `0xe77cb26eA300e2f5304b461b0EC94c8AD6A7E46D` | ✅ Deployed | Confirm + verify |
-| **CCIPWETH9Bridge (old)** | `0x89dd12025bfCD38A168455A44B400e913ED33BE2` | ⛔ Deprecated | Do not use; use `0x971c...` above |
+| **CCIPWETH9Bridge (old)** | `0x89dd12025bfCD38A168455A44B400e913ED33BE2` | ⛔ Deprecated | Do not use; use `0xcacfd...` above |
 | **AddressMapper** | `0x439Fcb2d2ab2f890DCcAE50461Fa7d978F9Ffe1A` | ✅ Deployed 2026-02-12 | Confirm on Blockscout |
 | **MirrorManager** | `0x6eD905A30c552a6e003061A38FD52A5A427beE56` | ✅ Deployed 2026-02-12 | Confirm on Blockscout |
 | **Trustless bridge** | LOCKBOX138 (deployed), INBOX_ETH, BOND_MANAGER, etc. | ⏳ Mainnet stack when needed | Chain 138: Lockbox138 only; rest mainnet |
@@ -44,7 +44,7 @@
 
 1. **Confirm on-chain** — Run `./scripts/verify/check-contracts-on-chain-138.sh` (36 addresses) or open each address at https://explorer.d-bis.org/address/<ADDRESS>.
 2. **Verify source on Blockscout** — Use [BLOCKSCOUT_VERIFICATION_GUIDE](../08-monitoring/BLOCKSCOUT_VERIFICATION_GUIDE.md) and `scripts/verify/run-contract-verification-with-proxy.sh`.
-3. **Do not use deprecated bridge** — Use **CCIPWETH9Bridge** at `0x971cD9D156f193df8051E48043C476e53ECd4693` only.
+3. **Do not use deprecated bridge** — Use **CCIPWETH9Bridge** at `0xcacfd227A040002e49e2e01626363071324f820a` only.
 4. **If deploying more contracts** — Use **`--with-gas-price 1000000000`** for all `forge script`/`forge create` on Chain 138. Phased core: [CONTRACTS_TO_DEPLOY](CONTRACTS_TO_DEPLOY.md), [CONTRACT_DEPLOYMENT_RUNBOOK](../03-deployment/CONTRACT_DEPLOYMENT_RUNBOOK.md). RPC: Set `RPC_URL_138` in `smom-dbis-138/.env` (e.g. `http://192.168.11.211:8545` or `https://rpc-core.d-bis.org`). Set `PRIVATE_KEY` there too.
 5. **Quick RPC check** — `cast code <ADDRESS> --rpc-url https://rpc-core.d-bis.org` (non-empty = present).
 
diff --git a/docs/INTEGRATION_TEST_SUMMARY.md b/docs/INTEGRATION_TEST_SUMMARY.md
index da489f0..09588a3 100644
--- a/docs/INTEGRATION_TEST_SUMMARY.md
+++ b/docs/INTEGRATION_TEST_SUMMARY.md
@@ -12,7 +12,7 @@
 **Status**: ✅ Service running and configured
 
 **Integration Points**:
-- **CCIP Router**: `0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e` ✅ Deployed
+- **CCIP Router**: `0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817` ✅ Deployed
 - **CCIP Sender**: `0x105F8A15b819948a89153505762444Ee9f324684` ✅ Deployed
 - **RPC Connection**: ✅ Configured
 
@@ -45,7 +45,7 @@
 ### 3. Bridge Contracts ⏳
 
 **Contracts Deployed**:
-- **CCIPWETH9Bridge**: Use \`CCIPWETH9_BRIDGE_CHAIN138\` or \`0x971cD9D156f193df8051E48043C476e53ECd4693\` ✅ Deployed. **Deprecated:** \`0x89dd12025bfCD38A168455A44B400e913ED33BE2\` (do not use).
+- **CCIPWETH9Bridge**: Use \`CCIPWETH9_BRIDGE_CHAIN138\` or \`0xcacfd227A040002e49e2e01626363071324f820a\` ✅ Deployed. **Deprecated:** \`0x89dd12025bfCD38A168455A44B400e913ED33BE2\` (do not use).
 - **CCIPWETH10Bridge**: `0xe0E93247376aa097dB308B92e6Ba36bA015535D0` ✅ Deployed
 
 **Integration**:
@@ -99,7 +99,7 @@ pct exec 3500 -- journalctl -u oracle-publisher -n 50
 cast code 0x3304b747e565a97ec8ac220b0b6a1f6ffdb837e6 --rpc-url $RPC_URL
 
 # Test CCIP Router
-cast code 0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e --rpc-url $RPC_URL
+cast code 0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817 --rpc-url $RPC_URL
 ```
 
 ---
diff --git a/explorer-monorepo b/explorer-monorepo
index ed86d01..d02ee71 160000
--- a/explorer-monorepo
+++ b/explorer-monorepo
@@ -1 +1 @@
-Subproject commit ed86d01e1dcef36056f0719fccda19326e7b9c68
+Subproject commit d02ee71cf64119c76cb1f7ffa83ebb7ee0a227bf
diff --git a/smom-dbis-138 b/smom-dbis-138
index fc3a95d..a780eff 160000
--- a/smom-dbis-138
+++ b/smom-dbis-138
@@ -1 +1 @@
-Subproject commit fc3a95de08c95e1d0a96b640ea1fda99ac56510e
+Subproject commit a780eff7c5215a6c2415ee8e7fcb9a765a7c7b29
diff --git a/transaction-package-HYBX-BATCH-001.zip b/transaction-package-HYBX-BATCH-001.zip
index 45d362c..5df28c5 100644
Binary files a/transaction-package-HYBX-BATCH-001.zip and b/transaction-package-HYBX-BATCH-001.zip differ