Skip to content

fix: chunk setConfig to avoid calldata limits on L2s#1934

Closed
St0rmBr3w wants to merge 11 commits intomainfrom
krak/chunk-setconfig-evm
Closed

fix: chunk setConfig to avoid calldata limits on L2s#1934
St0rmBr3w wants to merge 11 commits intomainfrom
krak/chunk-setconfig-evm

Conversation

@St0rmBr3w
Copy link
Contributor

What does this PR do?

Chunks SetConfigParam[] into batches of 10 in EndpointV2.setConfig(), producing multiple smaller transactions instead of one large one. This prevents calldata/gas limit failures when wiring OApps across 20+ destination chains on L2s.

Why is this change needed?

When wiring OApps to many destinations, all config params (ULN + executor per chain) are encoded into a single setConfig calldata. With 20+ chains this exceeds calldata/gas limits on certain EVM L2s (Arbitrum, Optimism, etc.), causing lz:oapp:wire to fail.

The return type is already Promise<OmniTransaction[]> and the upstream consumer in ua-devtools already handles arrays with Array.isArray, so this is a zero-interface-change fix scoped to a single package.

How was this tested?

  • pnpm build passes across all packages (protocol-devtools-evm + downstream consumers)
  • Code review confirmed: chunkArray handles all edge cases (empty, undersized, exact multiples)
  • Verified upstream consumer (buildOmniTransactions) already spreads OmniTransaction[]
  • Verified setUlnConfig, setUlnReadConfig, setExecutorConfig all delegate to setConfig
  • Dry run: npx hardhat lz:oapp:wire --oapp-config <config> --dry-run

Checklist

  • Code follows style guidelines
  • Self-review completed
  • Single-package change — downstream consumers only need to bump @layerzerolabs/protocol-devtools-evm

- Add SuiSigner for transaction signing with sender context
- Add createConnectionFactory and createRpcUrlFactory for RPC connections
- Add OmniSDK base class with transaction serialization
- Add Sui chain type to normalizePeer/denormalizePeer in devtools

Key design decisions:
- Transaction.serialize() used instead of build() to defer sender context
- Signer reconstructs transaction and sets sender during signing
- Connection factory reads from RPC_URL_SUI environment variable
- Add EndpointV2 SDK implementing IEndpointV2 interface
- Add Uln302 SDK for ULN configuration management
- Fix setConfig to call populateSetConfigTransaction (Move result consumption)
- Add graceful handling of missing configurations

Key fixes for lz:oapp:wire:
- setConfigMoveCall returns Call<Param, Result> that must be consumed
- populateSetConfigTransaction() adds necessary follow-up move call
- Missing config queries return defaults instead of throwing
- Add OFT SDK implementing IOApp interface
- Fix setPeer to pad EVM addresses (20 bytes) to 32 bytes
- Fix hasPeer to use areBytes32Equal for normalized comparison
- Add isMissingSuiPeer helper for graceful error handling

Key fixes for lz:oapp:wire:
- EVM addresses must be right-padded with zeros to 32 bytes for Sui
- Address comparison must normalize both addresses before comparing
- Missing peer/enforced_options errors return defaults instead of throwing
- Add @layerzerolabs/devtools-starknet for Starknet signer/provider
- Add @layerzerolabs/ua-devtools-starknet for Starknet OFT SDK
- Add @layerzerolabs/protocol-devtools-starknet for EndpointV2/ULN302 SDKs
- Fix address comparison in ua-devtools to use areBytes32Equal
- Fix library skip logic to prevent SAME_VALUE errors

Wire task now works correctly for Starknet OFTs with proper
address normalization and idempotent configuration detection.

Note: Send FROM Starknet has protocol-level bug in SendLib contract.
Send TO Starknet works correctly.
Key fixes:
- Fix fromHex to handle odd-length hex strings by padding with leading '0'
  (Buffer.from silently truncates odd-length strings)
- Fix ByteArray encoding in setEnforcedOptions to use raw calldata instead
  of string-based encoding (starknet.js UTF-8 re-encodes bytes >= 128)
- Update sendStarknet to use createRpcUrlFactory() for RPC URL resolution
- Update starknet.js v8 Account constructor format

These fixes resolve the "out of bound" error when sending from Starknet OFT
caused by corrupted enforced options (byte 0x80 becoming UTF-8 0xc2 0x80).
- Add isNonEvmDeployment() to skip address checksumming for Sui/Starknet
- Update setPeer() in ua-devtools-sui to handle addresses ≤32 bytes (Starknet is 31 bytes)
…ngeset

- Remove CHANGELOG.md from new sui/starknet packages (will be auto-generated on publish)
- Add changeset for modified existing packages (devtools, metadata-tools, ua-devtools)
Add three new packages for Aptos devtools:
- @layerzerolabs/devtools-aptos: Core Aptos utilities (connection, signer, OmniSDK)
- @layerzerolabs/protocol-devtools-aptos: EndpointV2 and ULN302 SDKs
- @layerzerolabs/ua-devtools-aptos: OFT SDK implementing IOApp interface

These packages enable lz:oapp:wire support for Aptos OFTs following the
OmniGraph pattern used by Sui and Starknet.
Enable Aptos OFT wiring in oft-main example:
- Add INCLUDE_APTOS, APTOS_ENFORCED_OPTIONS in layerzero.config.ts
- Add aptosContract definition and pathway generation
- Update tasks/aptos/index.ts to use real Aptos devtools packages
- Remove Aptos filtering from wire.ts graph processing
- Add Aptos environment variables to .env.example
- Add aptos/deploy.json.example
- Add Aptos devtools packages to package.json
@cursor
Copy link

cursor bot commented Feb 19, 2026

PR Summary

Medium Risk
Touches transaction construction for setConfig, which can affect wiring correctness and on-chain configuration if batching order/contents are wrong, and adds a large new example tree (low runtime impact but adds maintenance surface).

Overview
Updates EVM wiring to avoid L2 calldata/gas limit failures by chunking EndpointV2.setConfig() calls into batches of 10 and returning multiple OmniTransactions instead of one large transaction.

Extends peer address normalization/denormalization to handle Sui and Starknet chain types consistently in tooling (per changesets).

Adds a new examples/oft-main multi-VM OFT example scaffold (env templates, Hardhat/Foundry/Anchor configs, sample EVM contract + deploy script, and wiring docs/config), plus associated ignore/lint/config files and lockfiles.

Written by Cursor Bugbot for commit 53050f2. Configure here.

@socket-security
Copy link

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Medium
Low adoption: npm @layerzerolabs/oft-mint-burn-starknet

Location: Package overview

From: packages/ua-devtools-starknet/package.jsonnpm/@layerzerolabs/oft-mint-burn-starknet@0.2.20

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@layerzerolabs/oft-mint-burn-starknet@0.2.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @layerzerolabs/oft-mint-burn-starknet

Location: Package overview

From: examples/oft-main/package.jsonnpm/@layerzerolabs/oft-mint-burn-starknet@0.2.29

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@layerzerolabs/oft-mint-burn-starknet@0.2.29. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @layerzerolabs/protocol-starknet-v2

Location: Package overview

From: packages/devtools-starknet/package.jsonnpm/@layerzerolabs/protocol-starknet-v2@0.2.20

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@layerzerolabs/protocol-starknet-v2@0.2.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @layerzerolabs/protocol-starknet-v2

Location: Package overview

From: examples/oft-main/package.jsonnpm/@layerzerolabs/protocol-starknet-v2@0.2.29

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@layerzerolabs/protocol-starknet-v2@0.2.29. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

if (value == null) return undefined;
if (typeof value === 'string') return value;
if (typeof value === 'bigint') return '0x' + value.toString(16);
if (typeof value === 'object' && value !== null && 'value' in value) {
hexValue = value
} else if (typeof value === 'bigint') {
hexValue = `0x${value.toString(16)}`
} else if (typeof value === 'object' && value !== null && 'value' in value) {
if (value instanceof Uint8Array || Buffer.isBuffer(value)) {
return `0x${Buffer.from(value).toString('hex')}`
}
if (typeof value === 'object' && value !== null && 'data' in value && 'pending_word' in value) {
if (typeof value === 'bigint') {
return `0x${value.toString(16)}`
}
if (typeof value === 'object' && value !== null && 'value' in value) {

try {
// Use the SDK to check if configs exist
const [sendConfig, receiveConfig] = await getSolanaUlnConfigPDAs(

try {
// Use the SDK to check if configs exist
const [sendConfig, receiveConfig] = await getSolanaUlnConfigPDAs(
const connection = await connectionFactory(taskArgs.eid)
const umi = createUmi(connection.rpcEndpoint).use(mplToolbox())
const umiWalletSigner = createSignerFromKeypair(umi, umiKeypair)
const web3WalletKeyPair = toWeb3JsKeypair(umiKeypair)
@St0rmBr3w St0rmBr3w closed this Feb 19, 2026
@St0rmBr3w St0rmBr3w deleted the krak/chunk-setconfig-evm branch February 19, 2026 16:31
@github-actions
Copy link
Contributor

🧪 E2E Test Status

E2E tests are non-blocking and validate real blockchain interactions. Failures may occur due to network issues, RPC rate limits, or external service downtime.

Test Runs (Newest First):

  • Run #6721 - Failed - 2026-02-19 16:31 (UTC)

@St0rmBr3w St0rmBr3w changed the title [DEVREL-1425] fix: chunk setConfig to avoid calldata limits on L2s fix: chunk setConfig to avoid calldata limits on L2s Feb 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Comments