Skip to content

Conversation

@St0rmBr3w
Copy link
Contributor

Summary

This PR adds three new packages for Aptos devtools to enable lz:oapp:wire support for Aptos OFTs:

  • @layerzerolabs/devtools-aptos: Core Aptos utilities (connection factory, signer with sequence number tracking, OmniSDK base)
  • @layerzerolabs/protocol-devtools-aptos: EndpointV2 and ULN302 SDKs implementing IEndpointV2 and IUln302 interfaces
  • @layerzerolabs/ua-devtools-aptos: OFT SDK implementing the IOApp interface (setPeer, getPeer, hasPeer, getEndpointSDK, setDelegate)

These packages follow the OmniGraph pattern established by Sui and Starknet devtools packages.

Changes

  • Add packages/devtools-aptos/ with connection factory, signer implementation, and OmniSDK
  • Add packages/protocol-devtools-aptos/ with EndpointV2 and ULN302 SDKs
  • Add packages/ua-devtools-aptos/ with OFT SDK and factory
  • Update pnpm-lock.yaml with new package dependencies

Related PRs

Test Plan

  • All three packages build successfully
  • Integration tests with Aptos testnet (to be added in examples PR)

Add three new packages for Aptos devtools:
- @layerzerolabs/devtools-aptos: Core Aptos utilities (connection, signer, OmniSDK)
- @layerzerolabs/protocol-devtools-aptos: EndpointV2 and ULN302 SDKs
- @layerzerolabs/ua-devtools-aptos: OFT SDK implementing IOApp interface

These packages enable lz:oapp:wire support for Aptos OFTs following the
OmniGraph pattern used by Sui and Starknet.
@cursor
Copy link

cursor bot commented Jan 28, 2026

PR Summary

Introduces first-class Aptos support across devtools and SDKs following the OmniGraph pattern.

  • Adds @layerzerolabs/devtools-aptos with createRpcUrlFactory/createConnectionFactory, OmniSDK base, address utils, and AptosSigner (sequence number tracking, retry on submit)
  • Adds @layerzerolabs/protocol-devtools-aptos implementing IEndpointV2 and IUln302 SDKs (default/send/receive libraries, timeouts, executor/ULN config setters, view helpers); includes createEndpointV2Factory
  • Adds @layerzerolabs/ua-devtools-aptos providing OFT IOApp SDK (owner/delegate, peer management, enforced options) and createOFTFactory
  • Wires exports, build configs, and updates lockfile/deps for Aptos (@aptos-labs/ts-sdk, LZ MoveVM/aptos packages)

Written by Cursor Bugbot for commit 9fd740c. Configure here.

@socket-security
Copy link

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​layerzerolabs/​lz-aptos-sdk-v2@​3.0.156801001009690

View full report

Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 4 potential issues.

// Simple encoding - in practice this would use proper BCS encoding
const encoder = new TextEncoder()
return encoder.encode(JSON.stringify(config))
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Uint8Array corrupted during JSON serialization

High Severity

The encodeExecutorConfig and encodeUlnConfig methods return Uint8Array, but these values are placed in objects that get passed through JSON.stringify. When a Uint8Array is JSON-serialized, it becomes an object with numeric string keys (e.g., {"0":1,"1":2}) rather than an array. When the signer later parses this JSON, it receives a malformed object instead of the expected byte array, causing transactions to fail or behave incorrectly. Other places in the codebase (like setPeer and setEnforcedOptions) correctly use Array.from() to convert Uint8Array before serialization.

Additional Locations (2)

Fix in Cursor Fix in Web

types: ['u32', 'u16', 'u8'],
}),
description: `Setting enforced options for eid ${opt.eid}, msgType ${opt.option.msgType} (1 of ${enforcedOptions.length})`,
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

setEnforcedOptions silently ignores all but first option

High Severity

When setEnforcedOptions receives multiple OAppEnforcedOptionParam entries, only the first option is processed and returned as a transaction. All subsequent options are silently ignored. The IOApp interface contract and other SDK implementations (EVM, Solana) expect all provided options to be handled. This causes configurations to be partially applied without any indication to the caller that options were dropped.

Fix in Cursor Fix in Web

point: this.point,
data: '0x',
description: 'Library registration not required on Aptos',
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Invalid JSON in transaction data causes signer crash

High Severity

Several methods return transactions with data: '0x' (e.g., registerLibrary, setDefaultUlnConfig, setDefaultExecutorConfig, and setEnforcedOptions when the array is empty). However, the AptosSigner.sign and signAndSend methods call JSON.parse(transaction.data) on line 75/115 of the signer. Since '0x' is not valid JSON, this throws a SyntaxError, crashing the signer when attempting to process these "no-op" transactions.

Additional Locations (2)

Fix in Cursor Fix in Web

address: this.endpointAddress ?? this.point.address,
},
this.connectionFactory
)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Endpoint SDK created with wrong contract address

High Severity

In getEndpointSDK(), when endpointAddress is not provided to the OFT constructor, the code falls back to this.point.address (the OFT contract address). This address is then used by EndpointV2 to construct function calls like ${endpointAddress}::endpoint::get_default_receive_library. Since endpoint functions don't exist on the OFT contract, all endpoint-related calls will fail. The createOFTFactory never provides an endpoint address, so all OFTs created through the factory have this bug.

Additional Locations (1)

Fix in Cursor Fix in Web

@St0rmBr3w St0rmBr3w changed the base branch from feat/devtools-sui-packages to feat/devtools-sui-examples January 28, 2026 00:41
@github-actions
Copy link
Contributor

🧪 E2E Test Status

E2E tests are non-blocking and validate real blockchain interactions. Failures may occur due to network issues, RPC rate limits, or external service downtime.

Test Runs (Newest First):

  • Run #6653 - Passed - 2026-01-28 00:41 (UTC)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant