skills.rest
BitterSecurity
BitterSecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

LayerZero Integration Patterns

Audits LayerZero V2 OApp, OFT, and compose integrations for cross-chain security vulnerabilities.

66|17|Updated Jan 21, 2026
Search Tags:#security#cross-chain#solidity#smart contract audit#layerzero#oft#oapp
One-click install
npx skills add https://github.com/BitterSecurity/Vigilo --skill layerzero-integration-patterns-bittersecurity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: LayerZero Integration Patterns
Source: https://github.com/BitterSecurity/Vigilo/tree/main/packages/claude/skills/integration-patterns/layerzero
Command: npx skills add https://github.com/BitterSecurity/Vigilo --skill layerzero-integration-patterns-bittersecurity

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Cross-chain smart contracts built on LayerZero V2 frequently contain critical vulnerabilities such as missing peer validation, incorrect peer encoding, unvalidated compose messages, and insufficient executor gas, which can lead to forged messages and loss of funds. ## Core Features & Use Cases - OApp Security Patterns: Provides reference implementations and checklists for validating peers, source chains, and GUIDs in _lzReceive. - OFT Token Auditing: Covers slippage protection, decimal conversion between shared and local decimals, and minimum amount enforcement. - Compose & Gas Analysis: Detects missing OApp validation in _lzCompose and insufficient executor gas in options encoding. - Use Case: During a cross-chain audit, when LayerZero is detected in the target codebase, the cross-chain-auditor agent loads these patterns to systematically check peer configuration, OFT slippage, compose validation, and gas options against known vulnerability classes. ## Quick Start Audit this LayerZero OApp contract for missing peer validation, OFT slippage issues, and compose message vulnerabilities.

Frequently Asked Questions about LayerZero Integration Patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a LayerZero OApp contract for security vulnerabilities?▼

Check that `_lzReceive` validates both the source chain (srcEid) and the sender against the configured peers mapping, and that `_lzCompose` validates the calling OApp address. Missing peer validation allows forged cross-chain messages.

What are common LayerZero OFT token vulnerabilities?▼

Common OFT vulnerabilities include missing slippage protection (no minAmountLD parameter) and decimal conversion errors between shared decimals (usually 6) and local token decimals (often 18), which can cause precision loss on small amounts.

How should LayerZero peers be encoded in Solidity?▼

Peers must be encoded as bytes32(uint256(uint160(address))) to ensure proper left-padding. Using abi.encodePacked or other incorrect encodings causes silent validation failures against the stored peer value.

Why do LayerZero cross-chain messages fail on the destination chain?▼

Messages commonly fail due to insufficient executor gas configured in the options. Use OptionsBuilder with addExecutorLzReceiveOption set high enough (e.g., 200000 gas) to cover the destination _lzReceive callback complexity.

Does LayerZero compose message handling need validation?▼

Yes, _lzCompose must validate that the _oApp parameter matches a trusted OApp address. Without this check, any contract can inject malicious compose calls into the receiver.

Related Skills

Explore More Software Engineering Skills→
labsaistudiolabsaistudio

layerzero

Configure LayerZero V2 OApps for cross-chain messaging between EVM-compatible chains.

Community
Advanced
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
Tekholms-LWTekholms-LW

cross-chain

Explain Apertum cross-chain bridge operations and interoperability patterns for dApp development.

Community
Intermediate
LFDT-NightstreamLFDT-Nightstream
29

de-slopify

Edit documentation prose to remove AI writing artifacts like emdash overuse.

Official
Intermediate