SecureOApp

Secure-by-default LayerZero OApp/OFT SDK. A drop-in replacement for LayerZero's OApp/OFT templates that refuses to deploy with insecure DVN configurations. You can't ship a 1/1 bridge through this SDK.

v0.1 preview — unaudited. Use at your own risk on mainnet. The SecureConfigBase contract has 50 Foundry tests (including fuzz + cross-stack parity vs. the TS validator) but has not undergone a third-party audit. The DVN registry ships seed data verified against LayerZero's live metadata on 2026-04-21; it is expected to drift and is updated via PRs. Report issues via GitHub security advisories.

---

Why

40% of LayerZero OApps run 1/1 DVN configurations because it is the default in LayerZero's own quickstart. Kelp DAO lost $292M on April 18, 2026 to this exact config. Single-verifier bridges are a known, documented failure mode. SecureOApp inverts the default: safe is the path of least resistance, insecure requires explicit override with documented justification.

Read the launch post: docs/kelp-post-mortem.md.

Quick start

# Scaffold a new OApp project with secure defaults
npx secure-oapp init my-oapp
cd my-oapp

# Validate the config before deploying
npx secure-oapp validate --profile standard

# Deploy — will refuse if DVN config is insecure
npx secure-oapp deploy --profile standard --network base-sepolia

# Compare fees across profiles
npx secure-oapp quote --from base-sepolia --to arbitrum-sepolia

Or import the contract directly:

import { SecureOApp } from "@secure-oapp/contracts/SecureOApp.sol";

contract MyOApp is SecureOApp {
    constructor(address endpoint, address owner, bytes32 profile)
        SecureOApp(endpoint, owner, profile) {}
}

Security profiles

Profile	Required DVNs	ZK required	Intended use
standard	2 of 3	Yes (1)	Default for most OApps
paranoid	3 of 5	Yes (2)	LRTs, stablecoins, high-TVL bridges
lite	2 of 2	No	Low-value testnets, L2-to-L2 utility msgs

Details: docs/PROFILES.md.

Packages

• contracts/ — Foundry project. SecureOApp.sol, SecureOFT.sol, DVNValidator.sol, DVNRegistry.sol.
• packages/core/ — @secure-oapp/core. Profiles, DVN registry, config validator, security.md generator.
• packages/cli/ — secure-oapp CLI. init, deploy, validate, quote.
• packages/hardhat-plugin/ — @secure-oapp/hardhat Hardhat plugin.
• examples/oft-standard/ — Example OFT using the standard profile, Base Sepolia ↔ Arbitrum Sepolia.

Development

pnpm install
pnpm build
pnpm test             # TS packages
pnpm test:contracts   # Foundry

Requires Node >= 18.17, pnpm >= 9, Foundry (for contracts).

Status

v0.1 preview. See docs/kelp-post-mortem.md for the launch context and docs/THREAT_MODEL.md for what this project defends against.

Contributing

DVN registry additions welcome — see docs/CONTRIBUTING.md. For security issues, docs/SECURITY.md.

License

MIT. Published as a public good. See LICENSE.