feat: audit feedback for ovault by shankars99 · Pull Request #1617 · LayerZero-Labs/devtools

shankars99 · 2025-07-14T21:49:42Z

No description provided.

Signed-off-by: shankar <shankar@layerzerolabs.org>

…ate() Signed-off-by: shankar <shankar@layerzerolabs.org>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Co-authored-by: alexanderliteplo <alexanderliteplo@gmail.com>

…1596)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Signed-off-by: shankar <shankar@layerzerolabs.org>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Signed-off-by: shankar <shankar@layerzerolabs.org> Co-authored-by: ravinagill15 <ravina@layerzerolabs.org>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…oft-solana (#1527)

…n wiring (#1538) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…nge and RE… (#1620)

Co-authored-by: Shankar Subramanian <shankars0899@gmail.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Signed-off-by: shankar <shankar@layerzerolabs.org>

socket-security · 2025-07-20T18:31:46Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@layerzerolabs/lz-evm-v1-0.7@3.0.113
	@layerzerolabs/oapp-evm@0.3.2
	@layerzerolabs/toolbox-foundry@0.1.13
	@layerzerolabs/oft-evm@3.1.4
	@kinobi-so/renderers@0.21.5
	@layerzerolabs/lz-evm-protocol-v2@3.0.113
	@layerzerolabs/lz-evm-messagelib-v2@3.0.113
	kinobi@0.21.5
	@kinobi-so/renderers-js-umi@0.21.7
	rimraf@5.0.10
	@kinobi-so/nodes-from-anchor@0.21.3
	@kinobi-so/nodes@0.21.5
	@layerzerolabs/test-devtools-evm-foundry@6.0.3
	@solana-developers/helpers@2.8.0
	@openzeppelin/contracts-upgradeable@5.4.0
	@openzeppelin/contracts@5.4.0

View full report

socket-security · 2025-07-20T18:31:47Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click for details)
Warn		`@openzeppelin/contracts-upgradeable@5.4.0` has Unstable ownership. Author: arr00 From: packages/ovault-evm/package.json → `npm/@openzeppelin/contracts-upgradeable@5.4.0` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@openzeppelin/contracts-upgradeable@5.4.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@kinobi-so/errors@0.21.5` is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → `npm/@kinobi-so/nodes@0.21.5` → `npm/@kinobi-so/nodes-from-anchor@0.21.3` → `npm/@kinobi-so/renderers-js-umi@0.21.7` → `npm/kinobi@0.21.5` → `npm/@kinobi-so/renderers@0.21.5` → `npm/@kinobi-so/errors@0.21.5` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@kinobi-so/errors@0.21.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@kinobi-so/node-types@0.21.5` is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → `npm/@kinobi-so/nodes@0.21.5` → `npm/@kinobi-so/nodes-from-anchor@0.21.3` → `npm/@kinobi-so/renderers-js-umi@0.21.7` → `npm/kinobi@0.21.5` → `npm/@kinobi-so/renderers@0.21.5` → `npm/@kinobi-so/node-types@0.21.5` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@kinobi-so/node-types@0.21.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@kinobi-so/nodes-from-anchor@0.21.3` is an Unpopular package. Location: Package overview From: examples/oapp-solana/package.json → `npm/@kinobi-so/nodes-from-anchor@0.21.3` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@kinobi-so/nodes-from-anchor@0.21.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@kinobi-so/nodes@0.21.5` is an Unpopular package. Location: Package overview From: examples/oapp-solana/package.json → `npm/@kinobi-so/nodes@0.21.5` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@kinobi-so/nodes@0.21.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@kinobi-so/renderers-core@0.21.3` is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → `npm/@kinobi-so/renderers-js-umi@0.21.7` → `npm/@kinobi-so/renderers@0.21.5` → `npm/@kinobi-so/renderers-core@0.21.3` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@kinobi-so/renderers-core@0.21.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@kinobi-so/renderers-js-umi@0.21.7` is an Unpopular package. Location: Package overview From: examples/oapp-solana/package.json → `npm/@kinobi-so/renderers-js-umi@0.21.7` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@kinobi-so/renderers-js-umi@0.21.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@kinobi-so/renderers-js@0.21.9` is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → `npm/@kinobi-so/renderers@0.21.5` → `npm/@kinobi-so/renderers-js@0.21.9` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@kinobi-so/renderers-js@0.21.9`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@kinobi-so/renderers-rust@0.21.8` is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → `npm/@kinobi-so/renderers@0.21.5` → `npm/@kinobi-so/renderers-rust@0.21.8` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@kinobi-so/renderers-rust@0.21.8`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@kinobi-so/renderers@0.21.5` is an Unpopular package. Location: Package overview From: examples/oapp-solana/package.json → `npm/@kinobi-so/renderers@0.21.5` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@kinobi-so/renderers@0.21.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@kinobi-so/validators@0.21.5` is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → `npm/@kinobi-so/renderers-js-umi@0.21.7` → `npm/kinobi@0.21.5` → `npm/@kinobi-so/validators@0.21.5` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@kinobi-so/validators@0.21.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`@kinobi-so/visitors@0.21.5` is an Unpopular package. Location: Package overview From: pnpm-lock.yaml → `npm/@kinobi-so/nodes-from-anchor@0.21.3` → `npm/kinobi@0.21.5` → `npm/@kinobi-so/visitors@0.21.5` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@kinobi-so/visitors@0.21.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		`kinobi@0.21.5` is an Unpopular package. Location: Package overview From: examples/oapp-solana/package.json → `npm/kinobi@0.21.5` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/kinobi@0.21.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Signed-off-by: shankar <shankar@layerzerolabs.org> Co-authored-by: Nazreen <nazreen.mohamad@layerzerolabs.org> Co-authored-by: layerzero-bot <131946195+layerzero-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Matthew Krak <krak@layerzerolabs.org> Co-authored-by: DanL0 <159833747+DanL0@users.noreply.github.com> Co-authored-by: alexanderliteplo <alexanderliteplo@gmail.com> Co-authored-by: Alexander Liteplo <65365446+AlexanderLiteplo@users.noreply.github.com> Co-authored-by: Adel Akbar <adel-s@outlook.com> Co-authored-by: ravinagill15 <ravina@layerzerolabs.org> Co-authored-by: Nazreen <10964594+nazreen@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

feat: audit feedback for ovault (#1617)

feat: audit feedback for ovault (#1617) - issue-5: skip removeDust() on slippage check when dstEid=hub - issue-9: token.safeTransfer(..args) instead of transfer - issue-4: refuse msg.value on proxySend() when dstEid is the hub - issue-12: remove duplicated safeERC20 import and library usage - issue-13: initialize() for upgradeable - issue-14: remove unused interface errors - issue-11: remove duplication in retry() and constructor - copy-pasta ERC4626 caution/warning from OpenZeppelin on donation attack - match packages and interface improvements

shankars99 and others added 30 commits July 14, 2025 21:16

issue-5: skip removeDust() on slippage check when dstEid=hub

450e126

Signed-off-by: shankar <shankar@layerzerolabs.org>

issue-9: token.safeTransfer(..args) instead of transfer

1eb9722

Signed-off-by: shankar <shankar@layerzerolabs.org>

issue-4: refuse msg.value on proxySend() when dstEid is the hub

973ccb0

Signed-off-by: shankar <shankar@layerzerolabs.org>

issue-12: remove duplicated safeERC20 import and library usage

c1718c1

Signed-off-by: shankar <shankar@layerzerolabs.org>

issue-13: initialize() for upgradeable

18ba402

Signed-off-by: shankar <shankar@layerzerolabs.org>

issue-14: remove unused interface errors

363b5f9

Signed-off-by: shankar <shankar@layerzerolabs.org>

to match packages

3336b99

Signed-off-by: shankar <shankar@layerzerolabs.org>

issue-11: remove duplication in retry()

41e6b52

Signed-off-by: shankar <shankar@layerzerolabs.org>

copy-pasta ERC4626 caution/warning from OpenZepplin on donation attack

373eedb

Signed-off-by: shankar <shankar@layerzerolabs.org>

issue-11: remove duplication in constructor - IOFT.decimalConversionR…

b8258f1

…ate() Signed-off-by: shankar <shankar@layerzerolabs.org>

DEVREL-468 feat: add oapp-solana (#1482)

e35f1c5

🚀 Version packages (#1581)

bf1dd7e

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

DEVREL-518 Feat: add send task to oft (#1561)

a2bf22f

🚀 Version packages (#1597)

1fe24b9

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

INT-406: fix move CLI version checks (#1593)

1f26142

Co-authored-by: alexanderliteplo <alexanderliteplo@gmail.com>

[INT-419] Solana OApp Aptos compatibility patch (#1599)

ad717b6

DEVREL-549 docs: example READMEs specs + examples/oft README revamp (#…

9613fb8

…1596)

🚀 Version packages (#1598)

05abc11

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

[INT-361]: call is enforced for gnosis safe batch txs (#1601)

da3ab51

🚀 Version packages (#1602)

8cf727f

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

hyperevm: native refund ladder improvement (#1607)

4944631

Signed-off-by: shankar <shankar@layerzerolabs.org>

🚀 Version packages (#1608)

1c5a73d

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

🗞️ foundry scripts for LayerZero (#1334)

3711f5a

Signed-off-by: shankar <shankar@layerzerolabs.org> Co-authored-by: ravinagill15 <ravina@layerzerolabs.org>

[INT-297] fix: remove snapshot tests that depend on CLI output (#1612)

59892ad

oapp-solana: fix comment (#1609)

60b23f8

[INT-454] Add chunking of safe multisig batching + LZ_BATCH_SIZE (#1613)

ad7ebd0

🚀 Version packages (#1614)

724f49f

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

feat(examples/lzapp-migration): unified send task + align DevEx with …

4f0415f

…oft-solana (#1527)

DEVREL-126 feat: validate Solana admin address for delegate/owner whe…

543fc54

…n wiring (#1538) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

[INT-499] Patch Update Move.toml with commit hash before breaking cha…

c7bbada

…nge and RE… (#1620)

AlexanderLiteplo and others added 4 commits July 20, 2025 18:30

Aptos framework rev patch (#1623)

d47a15d

Co-authored-by: Shankar Subramanian <shankars0899@gmail.com>

🚀 Version packages (#1622)

acd0b29

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

init: ovault-composer-evm

8a54423

Signed-off-by: shankar <shankar@layerzerolabs.org>

packages

041a6d1

Signed-off-by: shankar <shankar@layerzerolabs.org>

shankars99 merged commit f901e40 into feat/ovault-evm Jul 20, 2025
2 of 8 checks passed

shankars99 deleted the ovault-audit/paladin branch July 20, 2025 18:32

shankars99 added a commit that referenced this pull request Jul 20, 2025

Merge pull request #1617 from LayerZero-Labs/ovault-audit/paladin

c99fc92

feat: audit feedback for ovault (#1617)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: audit feedback for ovault - #1617

feat: audit feedback for ovault#1617
shankars99 merged 34 commits into
feat/ovault-evmfrom
ovault-audit/paladin

shankars99 commented Jul 14, 2025

Uh oh!

socket-security Bot commented Jul 20, 2025

Uh oh!

socket-security Bot commented Jul 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Uh oh!

Conversation

shankars99 commented Jul 14, 2025

Uh oh!

socket-security Bot commented Jul 20, 2025

Uh oh!

socket-security Bot commented Jul 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants