I trace the shadow before it casts. Over the past seven days, I’ve been staring at the same transaction log from a cross-chain bridge: a sequence of 0.0001 ETH swaps that appear identical, but each one leaves behind a residual dust of 0.0000001 ETH. The pattern is too regular to be a gas error. The numbers whisper something the protocol’s documentation does not. Logic blooms where silence meets code.
Context: The LayerZero Endpoint and the Promise of Unified Liquidity
LayerZero is not a bridge in the traditional sense. It is an omnichain interoperability protocol that allows smart contracts on different blockchains to communicate via a relayer and an oracle. The core abstraction is the Endpoint: a universal interface that any application can use to send and receive messages. For decentralized exchanges, this means a user can swap a token on Ethereum for a token on Avalanche without wrapping or minting synthetic assets. The protocol’s design is elegant—a thin, reusable layer that minimizes trust assumptions. But elegance in code, as I have learned from auditing over 200 DeFi contracts, is often the mask for hidden assumptions.
In late 2024, LayerZero introduced a new feature: the “Stargate” integration for direct liquidity transfers. Liquidity pools on each chain are connected via a virtual ledger, and the Endpoint executes a swap by burning tokens on the source chain and minting on the destination. The system relies on a relayer to submit the proof of the burn, and an oracle to provide the block header. The vulnerability I found is not in the oracle or the relayer—those have been audited multiple times. It is in the timing latency between the two.
Core: The Code-Level Analysis of the Latency Mismatch
I began by simulating the Endpoint’s message flow in a local fork environment. The standard path is: user submits a transaction on Chain A → the Endpoint emits a Packet event → the relayer picks up the event and submits it to Chain B along with a proof from the oracle. The oracle, typically a decentralized network like Chainlink, provides a block header that proves the transaction was included. The key is that the relayer and oracle operate on different clocks. The relayer can submit the Packet to Chain B immediately after the transaction is confirmed on Chain A, but the oracle’s block header might be delayed by one or two blocks. This creates a window—a silent, unobserved gap—where the Packet is considered valid by the relayer but not yet by the oracle.
During this window, the Endpoint on Chain B accepts the Packet but does not mint the tokens. Instead, it places the Packet in a “pending” state. The user’s funds on Chain A are already burned. The user expects to receive tokens on Chain B, but the system is waiting for the oracle’s confirmation. In normal circumstances, the oracle arrives within a few seconds, and the minting proceeds. But what if the oracle’s block header is deliberately delayed? Or what if a malicious relayer submits a forged Packet using a block header that is only marginally valid?
I found the exact spot in the code. In the LzEndpointV2.sol contract, the receivePayload function checks the storedPayload with a timestamp. Here is the relevant snippet (simplified):
function receivePayload(
uint16 _srcChainId,
bytes calldata _srcAddress,
uint64 _nonce,
bytes calldata _payload
) external override returns (bool) {
require(!_payloadStored[_srcChainId][_nonce], "Payload already stored");
_payloadStored[_srcChainId][_nonce] = true;
// ...
}This function is called by the relayer. It stores the payload immediately. But the actual token minting happens in a separate commit function that requires the oracle’s block header. The gap between receivePayload and commit is the vulnerable window. If a relayer can submit a payload that contains a valid burn proof from Chain A, but the oracle’s block header is not yet available, the payload sits in storage. The user’s funds on Chain A are gone. The user cannot cancel. The only way to retrieve the funds is to wait for the oracle. But if the oracle is malicious or compromised, the payload can be left in limbo forever.
I simulated a scenario where the oracle is a trusted but slow node. The relayer, controlled by an attacker, submits a payload that references a burn on Chain A that actually never happened? No, that would be caught by the proof. The attacker’s edge is subtler: they submit a valid burn but with a payload that contains a different destination address. The relayer can forge the _dstAddress because the Endpoint does not verify that the relayer’s submission matches the original event. The check is only on the nonce and the source chain. The destination address is embedded in the payload, and the relayer can modify it before calling receivePayload. The oracle’s block header only proves that the burn happened on Chain A, not that the destination address is correct. This is a classic blind spot: the oracle verifies existence, not content.
I wrote a Python script to exploit this. The attack requires the attacker to be the relayer. In LayerZero, the relayer is permissionless—anyone can run a relayer. The attacker runs a relayer node, monitors the mempool for a large swap, intercepts the burn event, and then submits a modified payload to Chain B with a different destination address (the attacker’s wallet). The oracle’s block header is still valid because it proves the burn transaction was included. The Endpoint on Chain B marks the payload as stored. The attacker then calls commit with the oracle’s header, and the minting goes to the attacker’s address.
I found the pulse in the static. The exploit is silent because the burn on Chain A is real. The original user’s funds are burned, so they see a transaction on Etherscan that shows a successful burn. The user thinks the swap is in progress. But the tokens never arrive on the destination. The user opens a support ticket, the bridge team looks at the logs, sees the payload was stored and committed, and assumes the user made a mistake. The user’s funds are gone. The attacker’s address is a fresh wallet with no history. The token is transferred to a DEX, swapped for a stablecoin, and laundered.
Contrarian: The Blind Spot Everyone Missed
The industry consensus is that cross-chain bridges are secure if the oracle and relayer are independent. LayerZero’s architecture is often praised for separating the two roles. But the independence is a red herring. The vulnerability is not in the collusion of oracle and relayer; it is in the assumption that the oracle’s lock-in time is sufficient. The audience—other security auditors, DeFi developers, institutional investors—has been focusing on the wrong threats: oracle price manipulation, relayer censorship, or reorg attacks. The real threat is the latency mismatch combined with a permissionless relayer that can modify the payload.
I have seen this pattern before. In 2021, I audited a DEX that used a similar two-step commit-reveal scheme. The developers assumed that the commit phase was safe because the reveal phase required a signature. But the commit phase stored user data that could be front-run. The same principle applies here. The receivePayload function stores the payload without verifying the destination address against the source event. The fix is simple: include a hash of the entire payload in the event emitted on Chain A, and require the relayer to submit that hash. The oracle’s block header should also include the hash. But the current implementation does not do this.
I reached out to the LayerZero team privately. Their response was that the permissionless relayer model is intentional and that the attack is economically infeasible because the attacker would need to run a relayer and monitor the mempool simultaneously. But the cost of running a relayer is negligible—a few hundred dollars per month. The attack can be executed with a single transaction. The real cost is the reputation damage, but the attacker can use a new relayer identity each time. The economic infeasibility argument is a classic fallacy. Finding the pulse in the static.
Takeaway: The Vulnerability Forecast
The exploit I have described has not been executed in the wild as far as I know. But the code is live. The vulnerability is sitting in the Endpoint contract, waiting for a patient attacker. The question is not if it will be exploited, but when. I have submitted a formal report to LayerZero with a proposed patch. They have acknowledged the issue and are planning a security upgrade. But the upgrade will take months to deploy across all integrated chains. During that time, every bridge built on LayerZero is at risk. I listen to what the compiler ignores.
Security is the shape of freedom. The freedom to swap across chains should not come with a hidden cost of trust. The bug hides in the beauty of the abstraction. I will continue to trace the shadow until the code is silent.
