LayerZero follow-up: DVN admin can still bypass validation
Quote85 words36 likes
Follow-up on A1 Research's review of LayerZero's reply: the docs contract was swapped days earlier, the new contract came from the same EOA, and an admin can still bypass validation or DOS the connection.
Key claims
New contract deployed by the same EOA
Admin can still bypass validation or DOS the connection
Docs linked the old contract in the mainnet section until days earlier
RR looked into the LayerZero response.
Turns out that:
✦ Contract changed in docs a few days ago.
✦ New contract deployed by same EOA.
✦ Admin still there, can still bypass validation or DOS the connection.
Not sure if brushing it off as a "test" contract does the job here.
I have zero problem with @LayerZero_Labs but the underlying trust assumptions should be clearly communicated to the user imo.
That's what @RedactedRes is trying to achieve. Even if it might be uncomfortable at times.
QUOTING @a1research__
Thank you @PrimordialAA We had another look and some questions remain: The contract you are referring to in your comment was created just a few days ago and was created by the same EOA (1) that we point out in our original post. The "test" contract was even linked in the offi
Thank you @PrimordialAA We had another look and some questions remain: The contract you are referring to in your comment was created just a few days ago and was created by the same EOA (1) that we point out in our original post. The "test" contract was even linked in the offi