LayerZero Integration Patterns

Audits LayerZero V2 OApp, OFT, and compose integrations for cross-chain security vulnerabilities.

66|17|Updated Jan 21, 2026

Search Tags:#security #cross-chain #solidity #smart contract audit #layerzero #oft #oapp

Ready to run

npx skills add https://github.com/BitterSecurity/Vigilo --skill layerzero-integration-patterns-bittersecurity

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: LayerZero Integration Patterns
Source: https://github.com/BitterSecurity/Vigilo/tree/main/packages/claude/skills/integration-patterns/layerzero
Command: npx skills add https://github.com/BitterSecurity/Vigilo --skill layerzero-integration-patterns-bittersecurity

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Cross-chain smart contracts built on LayerZero V2 frequently contain critical vulnerabilities such as missing peer validation, incorrect peer encoding, unvalidated compose messages, and insufficient executor gas, which can lead to forged messages and loss of funds. ## Core Features & Use Cases - OApp Security Patterns: Provides reference implementations and checklists for validating peers, source chains, and GUIDs in `_lzReceive`. - OFT Token Auditing: Covers slippage protection, decimal conversion between shared and local decimals, and minimum amount enforcement. - Compose & Gas Analysis: Detects missing OApp validation in `_lzCompose` and insufficient executor gas in options encoding. - Use Case: During a cross-chain audit, when LayerZero is detected in the target codebase, the cross-chain-auditor agent loads these patterns to systematically check peer configuration, OFT slippage, compose validation, and gas options against known vulnerability classes. ## Quick Start Audit this LayerZero OApp contract for missing peer validation, OFT slippage issues, and compose message vulnerabilities.

Frequently Asked Questions about LayerZero Integration Patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit a LayerZero OApp contract for security vulnerabilities?▼

Check that `_lzReceive` validates both the source chain (srcEid) and the sender against the configured peers mapping, and that `_lzCompose` validates the calling OApp address. Missing peer validation allows forged cross-chain messages.

What are common LayerZero OFT token vulnerabilities?▼

Common OFT vulnerabilities include missing slippage protection (no minAmountLD parameter) and decimal conversion errors between shared decimals (usually 6) and local token decimals (often 18), which can cause precision loss on small amounts.

How should LayerZero peers be encoded in Solidity?▼

Peers must be encoded as bytes32(uint256(uint160(address))) to ensure proper left-padding. Using abi.encodePacked or other incorrect encodings causes silent validation failures against the stored peer value.

Why do LayerZero cross-chain messages fail on the destination chain?▼

Messages commonly fail due to insufficient executor gas configured in the options. Use OptionsBuilder with addExecutorLzReceiveOption set high enough (e.g., 200000 gas) to cover the destination _lzReceive callback complexity.

Does LayerZero compose message handling need validation?▼

Yes, _lzCompose must validate that the _oApp parameter matches a trusted OApp address. Without this check, any contract can inject malicious compose calls into the receiver.