Sky LZ Deploy

About Sky LZ Deploy

Sky implements LZ Deploy, five deployer contracts that deploy the OApps of its token, governance and SSR bridges, configure them to the exact state the onboarding spells of lz-init-lib expect, and hand them to governance.

Audit Summary

We have conducted a thorough review of the scope. The most important areas covered in our review are:

• Access control at handoff, since privileges left with the deploying account or with a deployer contract might become a backdoor.
• Functional correctness of the configuration, since a route left on default libraries, on a default DVN set, or with non-zero rate limits would be exposed before governance activates it.
• The two-step deployment of the SSR bridge, since it relies on predicting the receiver’s address before the receiver exists.

We provide this audit report to assist in forming an opinion on the risk profile of LZ Deploy. In summary, we find that the codebase provides a good level of security, if operated under the assumptions documented in System Overview, Trust Model and System Considerations. Note that the gas values of the example scripts are still too low for the Amsterdam hard fork, see Gas values after the Amsterdam hard fork.

It is important to note that security audits are time-boxed and cannot uncover all vulnerabilities. They complement but don’t replace other vital measures to secure a project.