Skip to content

Conversation

@St0rmBr3w
Copy link
Contributor

@St0rmBr3w St0rmBr3w commented Jan 26, 2026

Summary

This PR adds Sui and Starknet support to the devtools packages, enabling lz:oapp:wire to work with Sui and Starknet OFTs.

Sui Changes

  • Add Sui OFT SDK (ua-devtools-sui) with peer, delegate, and enforced options support
  • Add Sui signer and connection factory (devtools-sui)
  • Add Sui EndpointV2 SDK (protocol-devtools-sui)
  • Add Sui support to oft-main example with send and wire tasks

Starknet Changes

  • Add Starknet OFT SDK (ua-devtools-starknet) with enforced options, peer, and delegate support
  • Fix fromHex utility to handle odd-length hex strings (prevents Buffer.from truncation)
  • Fix ByteArray encoding to use raw calldata (prevents UTF-8 re-encoding corruption for bytes >= 128)
  • Add Starknet support to oft-main example with send and wire tasks
  • Update layerzero.config.ts with Starknet contract configuration

Key Bug Fixes

  1. fromHex odd-length handling: Buffer.from(str, 'hex') silently truncates odd-length strings. Fixed by padding with leading '0'.

  2. Starknet ByteArray UTF-8 corruption: starknet.js re-encodes string-based ByteArray as UTF-8, corrupting bytes >= 128 (e.g., 0x80 → 0xc2 0x80). Fixed by using raw calldata construction for enforced options.

Test plan

Sui

  • Deploy Sui OFT via deploy script
  • Run npx hardhat lz:oapp:wire --oapp-config layerzero.config.ts - successfully sets peers and enforced options
  • Test send from Sui to EVM chain

Starknet

  • Deploy Starknet OFT via deploy script
  • Run npx hardhat lz:oapp:wire --oapp-config layerzero.config.ts - successfully sets peers and enforced options
  • Verify enforced options are stored correctly on-chain (no UTF-8 corruption)
  • Test send from Starknet to EVM chain - correctly fails with insufficient balance (no protocol errors)

- Add SuiSigner for transaction signing with sender context
- Add createConnectionFactory and createRpcUrlFactory for RPC connections
- Add OmniSDK base class with transaction serialization
- Add Sui chain type to normalizePeer/denormalizePeer in devtools

Key design decisions:
- Transaction.serialize() used instead of build() to defer sender context
- Signer reconstructs transaction and sets sender during signing
- Connection factory reads from RPC_URL_SUI environment variable
- Add EndpointV2 SDK implementing IEndpointV2 interface
- Add Uln302 SDK for ULN configuration management
- Fix setConfig to call populateSetConfigTransaction (Move result consumption)
- Add graceful handling of missing configurations

Key fixes for lz:oapp:wire:
- setConfigMoveCall returns Call<Param, Result> that must be consumed
- populateSetConfigTransaction() adds necessary follow-up move call
- Missing config queries return defaults instead of throwing
- Add OFT SDK implementing IOApp interface
- Fix setPeer to pad EVM addresses (20 bytes) to 32 bytes
- Fix hasPeer to use areBytes32Equal for normalized comparison
- Add isMissingSuiPeer helper for graceful error handling

Key fixes for lz:oapp:wire:
- EVM addresses must be right-padded with zeros to 32 bytes for Sui
- Address comparison must normalize both addresses before comparing
- Missing peer/enforced_options errors return defaults instead of throwing
- Add Sui Move contracts for OFT token and OFT implementation
- Add Sui send task with proper RPC connection factory usage
- Update layerzero.config.ts with Sui pathway configuration
- Add deploy.json.example showing expected deployment format
- Update .gitignore to exclude deployment artifacts

Configuration notes:
- Enforced options order: [TO_SUI_OPTIONS, TO_EVM_OPTIONS]
- SUI_ENFORCED_OPTIONS uses 5000 gas (sufficient for Sui)
- EVM_ENFORCED_OPTIONS uses 80000 gas (sufficient for EVM)
Document 8 key painpoints discovered while making lz:oapp:wire work:
1. Transaction serialization vs building (defer sender context)
2. Transaction reconstruction during signing
3. Address length normalization (EVM 20-byte to Sui 32-byte)
4. Address comparison must be normalized
5. Move call results must be consumed
6. Graceful handling of missing configuration
7. Enforced options naming convention (by destination)
8. RPC URL factory environment variable usage

Also adds testing checklist for new VM packages and verified
working status with LayerZero Scan transaction links.
@cursor
Copy link

cursor bot commented Jan 26, 2026

PR Summary

Provides a complete, multi-VM OFT reference under examples/oft-main with build, deploy, and wiring workflows.

  • Adds Solana Anchor programs (oft, endpoint-mock) with configs (Anchor.toml, Cargo.*) and helper state/instructions
  • Adds EVM OFT contract (MyOFT.sol) and Hardhat deploy script, plus Foundry/Hardhat configs and tasks wiring
  • Introduces Sui integration: SDK deps, layerzero.config.ts Sui peer usage, and detailed Sui deploy/init steps
  • Documents Starknet OFT mint/burn adapter deployment and configuration
  • Includes comprehensive README, Aptos wiring example (docs/move.layerzero.config.ts) and guide (docs/wiring-to-aptos.md)
  • Adds environment templates, linting/formatting configs, Jest setup, and project scripts in package.json

Written by Cursor Bugbot for commit 283c045. Configure here.

@socket-security
Copy link

socket-security bot commented Jan 26, 2026

@socket-security
Copy link

socket-security bot commented Jan 26, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Publisher changed: npm cors is now published by ulisesgascon

Author: ulisesgascon

From: examples/oft-main/pnpm-lock.yamlnpm/@layerzerolabs/devtools-evm@3.0.2npm/@layerzerolabs/devtools-evm-hardhat@4.0.4npm/cors@2.8.6

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cors@2.8.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @layerzerolabs/metadata-tools

Location: Package overview

From: examples/oft-main/package.jsonnpm/@layerzerolabs/metadata-tools@3.0.3

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@layerzerolabs/metadata-tools@3.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @layerzerolabs/oft-mint-burn-starknet

Location: Package overview

From: packages/ua-devtools-starknet/package.jsonnpm/@layerzerolabs/oft-mint-burn-starknet@0.2.19

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@layerzerolabs/oft-mint-burn-starknet@0.2.19. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @layerzerolabs/oft-mint-burn-starknet

Location: Package overview

From: examples/oft-main/package.jsonnpm/@layerzerolabs/oft-mint-burn-starknet@0.2.20

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@layerzerolabs/oft-mint-burn-starknet@0.2.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @layerzerolabs/protocol-starknet-v2

Location: Package overview

From: packages/devtools-starknet/package.jsonnpm/@layerzerolabs/protocol-starknet-v2@0.2.19

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@layerzerolabs/protocol-starknet-v2@0.2.19. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Medium
Low adoption: npm @layerzerolabs/protocol-starknet-v2

Location: Package overview

From: examples/oft-main/package.jsonnpm/@layerzerolabs/protocol-starknet-v2@0.2.20

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@layerzerolabs/protocol-starknet-v2@0.2.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@github-actions
Copy link
Contributor

github-actions bot commented Jan 26, 2026

🧪 E2E Test Status

E2E tests are non-blocking and validate real blockchain interactions. Failures may occur due to network issues, RPC rate limits, or external service downtime.

Test Runs (Newest First):

  • Run #6634 - Failed - 2026-01-26 23:51 (UTC)
  • Run #6632 - Failed - 2026-01-26 23:30 (UTC)
  • Run #6631 - Failed - 2026-01-26 22:51 (UTC)
  • Run #6630 - Failed - 2026-01-26 17:43 (UTC)


try {
// Use the SDK to check if configs exist
const [sendConfig, receiveConfig] = await getSolanaUlnConfigPDAs(

try {
// Use the SDK to check if configs exist
const [sendConfig, receiveConfig] = await getSolanaUlnConfigPDAs(
const connection = await connectionFactory(taskArgs.eid)
const umi = createUmi(connection.rpcEndpoint).use(mplToolbox())
const umiWalletSigner = createSignerFromKeypair(umi, umiKeypair)
const web3WalletKeyPair = toWeb3JsKeypair(umiKeypair)
- Add @layerzerolabs/devtools-starknet for Starknet signer/provider
- Add @layerzerolabs/ua-devtools-starknet for Starknet OFT SDK
- Add @layerzerolabs/protocol-devtools-starknet for EndpointV2/ULN302 SDKs
- Fix address comparison in ua-devtools to use areBytes32Equal
- Fix library skip logic to prevent SAME_VALUE errors

Wire task now works correctly for Starknet OFTs with proper
address normalization and idempotent configuration detection.

Note: Send FROM Starknet has protocol-level bug in SendLib contract.
Send TO Starknet works correctly.
Key fixes:
- Fix fromHex to handle odd-length hex strings by padding with leading '0'
  (Buffer.from silently truncates odd-length strings)
- Fix ByteArray encoding in setEnforcedOptions to use raw calldata instead
  of string-based encoding (starknet.js UTF-8 re-encodes bytes >= 128)
- Update sendStarknet to use createRpcUrlFactory() for RPC URL resolution
- Update starknet.js v8 Account constructor format

These fixes resolve the "out of bound" error when sending from Starknet OFT
caused by corrupted enforced options (byte 0x80 becoming UTF-8 0xc2 0x80).
@St0rmBr3w St0rmBr3w changed the title Feat: devtools sui feat: add Sui and Starknet devtools support Jan 26, 2026
hexValue = value
} else if (typeof value === 'bigint') {
hexValue = `0x${value.toString(16)}`
} else if (typeof value === 'object' && value !== null && 'value' in value) {
if (value instanceof Uint8Array || Buffer.isBuffer(value)) {
return `0x${Buffer.from(value).toString('hex')}`
}
if (typeof value === 'object' && value !== null && 'data' in value && 'pending_word' in value) {
if (typeof value === 'bigint') {
return `0x${value.toString(16)}`
}
if (typeof value === 'object' && value !== null && 'value' in value) {
- Refactor layerzero.config.ts with toggle flags for each VM
- Add automatic full mesh pathway generation
- Optional deployment file loading (won't crash if missing)
- Rewrite README with concise multi-VM instructions
- Add endpoint ID reference table
- Add troubleshooting section
- Convert workspace: protocol to version specifiers for published packages
- Remove @layerzerolabs/devtools-{starknet,sui} (not published to npm)
- Remove @layerzerolabs/protocol-devtools-{starknet,sui} (not published)
- Remove @layerzerolabs/ua-devtools-{starknet,sui} (not published)
- Add STRK approval to sendStarknet.ts for LayerZero fee payment
- Regenerate pnpm-lock.yaml with --ignore-workspace flag
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant