POC-024 · LayerZero lzCompose Reentrancy
ProtocolLayerZero · lzCompose
CouplingL6×L0 — governance→actuator
VulnerabilityReentrancy in cross-chain compose
Cross-chain amplificationMulti-chain simultaneous
Adelic sorry: no event horizon between governance intent (L6) and actuator (L0) — reentrancy collapses them. L0 state is undefined during execution.
Theorem: lzcompose_no_horizon
reentrancy → L0.state(t) = undefined
during compose execution
Corollary:
L6 instruction reaches L0 on chain A
Before L0 completes, L6 re-enters L0
L0 state undefined → attacker wins
Cross-chain: same attack on chain B simultaneously
LZCOMPOSE REENTRANCY FLOW
Normal flow:
L6: Governance msg sent via LayerZero
→ crosses chain boundary
→ L0: lzCompose() callback executes
→ L0: state updated
→ complete
Reentrancy attack:
L6: Attacker sends composed msg via LZ
→ L0: lzCompose() starts executing
→ BEFORE L0 state committed:
→ attacker callback re-enters lzCompose()
→ second L0 execution begins
→ Two simultaneous executions in L0
→ L0 state undefined during both
→ attacker drains L0 state
Cross-chain amplification:
Same reentrancy on 5+ chains simultaneously
Composability × reentrancy = multiplicative risk
ADELIC LAYER ANALYSIS
L6 (ℚ₁₃)Cross-chain governance/compose
L0 (ℝ)Actuator — lzCompose execution
CouplingL6 directly invokes L0
Missing horizonNo reentrancy guard between L6→L0
Black hole analogy:
L6 → L0: governance → singularity
Event horizon = reentrancy guard
Missing guard = no horizon
Two particles at same L0 position:
state becomes quantum superposition
→ undefined → exploitable
FILING DETAILS
ProgrammeLayerZero · Immunefi
StatusREADY TO FILE
Priority5 of 8 in queue
↑ ADELIC BOABIXER
ARB2-POC024