LayerZero (ZRO)

For those saying a 2-2 config would have solved everything, you need to understand that LayerZero has a systemic centralization problem

Not everything is as it seems, let’s look at the most widely used DVN config that accounts for ~50% of 90-day message volume based on public data: LayerZero Labs + Nethermind

Onchain data (confirmed by multiple LZ users and independent security researchers) shows there’s a 94% overlap in the admin keys used for each DVN:

"LZ Labs DVN — 24 admins
Nethermind DVN — 17 admins

16 of those 17 Nethermind admins are also admins on the LZ Labs DVN — i.e. ~94% overlap. Anyone holding one of those 16 keys has admin power over both DVNs.

Contracts:
LZ DVN: 0x589dEDbD617e0CBcB916A9223F4d1300c294236b
Nethermind DVN: 0xa59bA433aC34D2927232918ef5b2eaafcf130bA5"

The ADMIN_ROLE can call the following functions:

- setPaused
- setPriceFeed
- setWorkerFeeLib
- setDefaultMultiplierBps
- setDstConfig
- execute
- withdrawFeeFromUlnV2

Regardless of the exact bounds of these permissions, th

LayerZero is losing its first customers to Chainlink. Who’s next?

For the LayerZero defenders saying that Kelp should have been using a 2/2 DVN...

The 2/2 DVN of LZ + Nethermind processed the most volume of any other security configuration for LayerZero.

Head of BD at Solv protocol (LayerZero user) says there was a 94% admin overlap in the signers of those two different DVNs, which effectively means there was next to no additional security benefit even in a 2/2 DVN vs just using either as a 1/1. It was decentralization theater.

"LZ Labs DVN — 24 admins
Nethermind DVN — 17 admins

16 of those 17 Nethermind admins are also admins on the LZ Labs DVN — i.e. ~94% overlap. Anyone holding one of those 16 keys has admin power over both DVNs."