If cross-chain transfer flow is rate-limited per path, and a hook function is defined on the direct path but not on the queued-completion path, then any rate-limited transfer bypasses the hook — and the permissionless completion function amplifies this into a full access control gap for hook-dependent invariants.

If governance VAAs are replay-protected only by local domain state, and cross-domain execution state can diverge between source and destination chains, then stale or repeated governance effects may persist unless payload, domain, and sequence are globally bound and verified.

If governance voting weight is calculated from timestamp snapshots, and source chain timestamp is not included in the transfer wire format, then timestamp drift between source and destination chains creates a window where a voter may cast votes based on a future or past balance state — enabling double-vote or weight-amplification under specific finality conditions.

If anomalous transfers are held in a governed delay queue, and Flow Cancel is enabled on the same chain, then small anomalous transfers co-queued with normal transfers may be released early through the cancel path, before the anomaly review window expires.