LayerZero security record
As of 30 Oct 2026, LayerZero has 21 audit reports by 7 security firms on Trustblock; the latest is by Zellic, dated 19 May 2025. Those reports list no open critical findings. It also holds 4 deployed contracts on 1 chain.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits21
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| LayerZero TON OFT security assessment | Security firm: Zellic | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| LayerZero USDT TON security assessment | Security firm: Zellic | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| LayerZero security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Layerzero Zro Claim Contract security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| LayerZeroZROClaim security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
| LayerZero security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Mintable OFT | Security firm: Paladin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · IPFS |
| LayerZero security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| LayerZero security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| LayerZero DVN security assessment | Security firm: Zellic | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| OFT/OApp | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Audit Report (MessageLib) | Security firm: Paladin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · IPFS |
| LayerZero (V2) | Security firm: Paladin | Date: | Scope: 4 addresses on Ethereum | No open critical findings | Open · IPFS |
| Audit Report (Verifier Network) | Security firm: Paladin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · IPFS |
| LayerZero OFT Wrapper Audit (January 19th 2023) se | Security firm: Zellic | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Layerzero Solidity Examples 2 | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Layerzero Solidity Examples | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Layerzero 2 | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| LayerZero | Security firm: Zokyo | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · IPFS |
| Layerzero | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Layerzero Prooflib | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings133
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 2 | 9 |
| Medium | 13 | 11 | 9 |
| Low | 13 | 21 | 53 |
CriticalNumerators are off by oneLayerZeroZROClaim security review · Pashov Audit Group · 15 Jun 2024Fixed
The report gives no description here.
Open the reportCriticalRemote donations are stuckLayerZeroZROClaim security review · Pashov Audit Group · 15 Jun 2024Fixed
The report gives no description here.
Open the reportHighLack of consideration of decimalConversionRate when setting minAmountLD in callback function of ClaimLocalLayerzero Zro Claim Contract security review · Hexens · 18 Jun 2024Fixed
The report gives no description here.
Open the reportHighUnable to claim remotely due to lack of Layer Zero feeLayerzero Zro Claim Contract security review · Hexens · 18 Jun 2024Fixed
The report gives no description here.
Open the reportHigh_lzReceive reverts when there is a fee refundLayerZeroZROClaim security review · Pashov Audit Group · 15 Jun 2024Fixed
The report gives no description here.
Open the reportHighWithdrawDonation can incur max slippageLayerZeroZROClaim security review · Pashov Audit Group · 15 Jun 2024Fixed
The report gives no description here.
Open the reportHighA malicious actor can prevent sending messages through the executor and ULNLayerZero security review · Pashov Audit Group · 15 May 2024Fixed
The report gives no description here.
Open the reportHighArbitrary message forging when supporting new chainsLayerZero DVN security assessment · Zellic · 14 Mar 2024Fixed
The report gives no description here.
Open the reportHighCentralization risk with modifiable routerLayerZero DVN security assessment · Zellic · 14 Mar 2024Fixed
The report gives no description here.
Open the reportHighThe deliver function can be frontrun to prevent normal execution through an insufficient execution gas amountAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportShow 10 more
HighBurn address issueLayerzero 2 · Ackee Blockchain Security · 11 May 2022Fixed
The report gives no description here.
Open the reportMediumDonateRemote cannot be deployed to skip token donationsLayerzero Zro Claim Contract security review · Hexens · 18 Jun 2024Fixed
The report gives no description here.
Open the reportMediumdonateAndClaim() will not work for remote donate and claimLayerZeroZROClaim security review · Pashov Audit Group · 15 Jun 2024Fixed
The report gives no description here.
Open the reportMediumDonateRemote will fail to deploy when any of the stargate tokens is not setLayerZeroZROClaim security review · Pashov Audit Group · 15 Jun 2024Fixed
The report gives no description here.
Open the reportMediumMissing Accounts in lz_receive_types ReturnLayerZero security review · Pashov Audit Group · 15 May 2024Fixed
The report gives no description here.
Open the reportMediumLimited Documentation and SpecificationsOFT/OApp · ChainSecurity · 30 Jan 2024Fixed
The report gives no description here.
Open the reportMediumUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportMediumUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportMediumUsing identical configuration for both sending and receiving is potentially limiting for asymmetric applicationsAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportMediumAdmin can re-enter during the execute function, potentially maliciously executing an operation twiceAudit Report (Verifier Network) · Paladin · 26 Aug 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowFile-path case-sensitivity issue in import statementsLayerZero TON OFT security assessment · Zellic · 19 May 2025Fixed
The report gives no description here.
Open the reportLowInconsistent transfer of funds to receiverLayerZero security review · Hexens · 17 Sep 2024Fixed
The report gives no description here.
Open the reportLowDonations in the native token can be not countedLayerZeroZROClaim security review · Pashov Audit Group · 15 Jun 2024Fixed
The report gives no description here.
Open the reportLowquoteClaimCallback has 0 slippage toleranceLayerZeroZROClaim security review · Pashov Audit Group · 15 Jun 2024Fixed
The report gives no description here.
Open the reportLowSome native tokens can be lost when sending tokens from L3LayerZero security review · Hexens · 7 Jun 2024Fixed
The report gives no description here.
Open the reportLowVariable bridge can be set to immutableLayerZero security review · Hexens · 7 Jun 2024Fixed
The report gives no description here.
Open the reportLowMissing Duplicate Check in required_dvns and optional_dvnsLayerZero security review · Pashov Audit Group · 15 May 2024Fixed
The report gives no description here.
Open the reportLowMissing unique signer check in signers_setter functionLayerZero security review · Pashov Audit Group · 15 May 2024Fixed
The report gives no description here.
Open the reportLowMissing Versioning in Solana OFT ProgramLayerZero security review · Pashov Audit Group · 15 May 2024Fixed
The report gives no description here.
Open the reportLowPotential Impersonation of PDA Account in send Instruction of Endpoint ModuleLayerZero security review · Pashov Audit Group · 15 May 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowCommented Code and Remaining ToDosOFT/OApp · ChainSecurity · 30 Jan 2024Fixed
The report gives no description here.
Open the reportLowOFT Does Not Refund Excess FeesOFT/OApp · ChainSecurity · 30 Jan 2024Fixed
The report gives no description here.
Open the reportLowType Check for User Provided OptionsOFT/OApp · ChainSecurity · 30 Jan 2024Fixed
The report gives no description here.
Open the reportLowdecode does not handle a zero _options lengthAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowGas optimizationAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowGas optimizationAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowGas optimizationsAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowGas optimizationsAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowGas optimizationsAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowGas optimizationsAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowGovernance risk: Apps must make sure to not give infinite allowance to this contract as this could result in the allowance being drained if the LayerZero governance is compromisedAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowTypographical issuesAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowTypographical issuesAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowTypographical issuesAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowTypographical issuesAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowTypographical issuesAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowTypographical issuesAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowTypographical issuesAudit Report (MessageLib) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLowUntitled findingLayerZero (V2) · Paladin · 15 Dec 2023Fixed
The report gives no description here.
Open the reportLow_shouldCheckHash could cause certain functions to not be checked, allowing them to be executed multiple timesAudit Report (Verifier Network) · Paladin · 26 Aug 2023Fixed
The report gives no description here.
Open the reportLowaddress(0) unnecessarily bears the DEFAULT_ADMIN_ROLE which has full control over this contractAudit Report (Verifier Network) · Paladin · 26 Aug 2023Fixed
The report gives no description here.
Open the reportLowSignatures are malleable as low-level ecrecover is usedAudit Report (Verifier Network) · Paladin · 26 Aug 2023Fixed
The report gives no description here.
Open the reportShow 3 more
LowSignatures do not incorporate a domain separator by defaultAudit Report (Verifier Network) · Paladin · 26 Aug 2023Fixed
The report gives no description here.
Open the reportLowTypographical issuesAudit Report (Verifier Network) · Paladin · 26 Aug 2023Fixed
The report gives no description here.
Open the reportLowThe sendOFT function call can be blockedLayerZero OFT Wrapper Audit (January 19th 2023) se · Zellic · 19 Jan 2023Fixed
The report gives no description here.
Open the reportContracts4
| Address | Chain | Source code |
|---|---|---|
| 0xef02bacd67c0ab45510927749009f6b9ffce0631 | Chain: Ethereum | Source code: Verified source |
| 0x148f693af10ddfae81cddb36f4c93b31a90076e1 | Chain: Ethereum | Source code: Verified source |
| 0xd07c30af3ff30d96bdc9c6044958230eb797ddbf | Chain: Ethereum | Source code: Verified source |
| 0x1a44076050125825900e736c501f859c50fe728c | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="layerzero"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us