Audit Report (MessageLib)
Paladin reviewed LayerZero (Audit Report (MessageLib)) on 15 Dec 2023: 29 findings, 0 critical; 17 marked fixed, 10 acknowledged, 2 open.
Trustblock does not review code.
Findings29
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 1 | 3 | 1 |
| Low | 1 | 7 | 15 |
MediumConfigurational mismatch can cause messages to never get deliveredAcknowledged
The report gives no description here.
MediumDecentralization flaw: Contract owner can fully brick all outbound messages of all applications using the library by setting a bad treasury or layerZeroTokenAcknowledged
The report gives no description here.
MediumVerifier options might get assigned to wrong verifiers if the verifier list is re-configured while messages are in-flightAcknowledged
The report gives no description here.
LowAvailability flaw: A single optional verifier can brick all sending for an application, even if it is not a mandatory verifierAcknowledged
The report gives no description here.
LowGas optimizationAcknowledged
The report gives no description here.
LowLack of on-chain incentive for executionAcknowledged
The report gives no description here.
LowMessage lib lacks direct on-chain incentive for executors and verifiers to actually do their part, as the fee is collected at the source chain when a transaction is sent outAcknowledged
The report gives no description here.
LowTypographical issueAcknowledged
The report gives no description here.
LowTypographical issuesAcknowledged
The report gives no description here.
LowTypographical issuesAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of LayerZero’s security record
LayerZeroSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us