LayerZero Default Security Flaw Exposes $178M In Cross-Chain Assets
A security vulnerability in the default code used by LayerZero to validate cross-chain messages has exposed over $178 million in assets, according to security researchers. The flaw, which affects the protocols Omnichain Fungible Tokens (OFTs), could allow attackers to forge messages and steal funds. How the Vulnerability Works Researcher Fishy Catfish reported that the default code used by LayerZero for message validation could be replaced by the development team, LayerZero Labs, without any time delay. This lack of a timelock creates a structural weakness that could be exploited to forge cross-chain messages, potentially allowing unauthorized transfers of OFTs. Projects at Risk The issue sparked a heated debate in the ETHSecurity communitys Telegram channel. Banteg, a well-known researcher with over 220,000 followers, noted that major projects like Ethena and EtherFi were using this vulnerable default setting until recently. While some projects have updated their configurations, approximately $178 million in assets remain exposed. Operational Security Concerns Fishy Catfish also raised concerns about the project‘s overall security management, citing on-chain data that suggests operational multi-signature keys were used for routine activities like memecoin trading. This is particularly troubling given LayerZero’s history of being targeted by North Korean hacking groups, highlighting the need for stricter operational security practices. Implications for the