OAPP-2067 fix(ua-devtools): skip already-pinned libraries with areBytes32Equal by St0rmBr3w · Pull Request #1947 · LayerZero-Labs/devtools

St0rmBr3w · 2026-07-21T16:41:30Z

What does this PR do?

Fixes wire idempotency for message libraries so already-pinned setSendLibrary / setReceiveLibrary configs are not re-proposed.

configureSendLibraries / configureReceiveLibraries (and the oapp-read equivalents) now compare on-chain vs configured library addresses with areBytes32Equal instead of toLowerCase() / strict ===. Checksum or padding mismatches no longer produce a second set*Library that reverts with LZ_SameValue.

Keeps the existing !isDefaultLibrary gate so "lock defaults" behavior is unchanged: when the OApp is still on the endpoint default and config matches the resolved default ULN, the first wire still pins storage.

Why is this change needed?

After libraries are already set on-chain, fragile address equality caused tooling to re-propose the same library. EndpointV2 rejects that with LZ_SameValue, breaking idempotent re-wires.

Note: this is unrelated to #1944 (ULN NIL sentinel pinning). That PR did not touch message-lib skip logic.

Type of Change

How was this tested?

Unit tests added/updated
Integration tests pass
Manual testing performed

Added hardhat regression tests that pin send/receive/read libraries, then re-run configure with lowercase config addresses and expect [] transactions. Package build + lint for @layerzerolabs/ua-devtools pass locally; full hardhat suite left to CI.

Impact/Screenshots

N/A

Checklist

PR is scoped and not too large
Self-review completed
Code follows style guidelines
Tests added for new functionality
Documentation updated
Hard-to-understand code is commented

AI Provenance

Model: Cursor Grok 4.5
Tool: Cursor
Prompt: Investigate Keno's report that old tooling re-proposes already-set setSendLibrary/setReceiveLibrary (likely from fix(protocol-devtools): treat explicitly-empty ULN config values as NIL sentinels #1944), identify the SameValue bug, propose an idempotency fix, then create a PR
Iterations: Plan mode investigation → agent implementation + PR in one follow-up turn

Made with Cursor

Checksum and padding mismatches caused configureSendLibraries / configureReceiveLibraries to re-propose set*Library after pin, which reverts with LZ_SameValue. Keep lock-defaults when still on the endpoint default. Co-authored-by: Cursor <cursoragent@cursor.com>

Unit canary proves main's receive === skip re-proposes when on-chain is checksummed and config is lowercase; send toLowerCase already survives that case. Runs without Hardhat/Docker. Co-authored-by: Cursor <cursoragent@cursor.com>

St0rmBr3w · 2026-07-21T16:46:56Z

Checksum canary (proved against main-style skip logic)

Added packages/ua-devtools/test/oapp/library-checksum-canary.test.ts (no Docker).

Result when temporarily restoring main's skip predicates:

configureReceiveLibraries with checksummed on-chain + lowercase config → FAILS (proposes setReceiveLibrary → would hit LZ_SameValue)
configureSendLibraries with the same casing mismatch → passes on main already (toLowerCase())
Documentation assertion: checksummed === lowercase is false, while areBytes32Equal is true

With this PR's fix: all 3 canary tests pass.

pnpm --filter @layerzerolabs/ua-devtools test:jest -- test/oapp/library-checksum-canary.test.ts

github-actions · 2026-07-21T16:49:52Z

🧪 E2E Test Status

E2E tests are non-blocking and validate real blockchain interactions. Failures may occur due to network issues, RPC rate limits, or external service downtime.

Test Runs (Newest First):

❌ Run #6782 - Failed - 2026-07-21 18:53 (UTC)
❌ Run #6781 - Failed - 2026-07-21 18:24 (UTC)
❌ Run #6780 - Failed - 2026-07-21 18:06 (UTC)
❌ Run #6779 - Failed - 2026-07-21 18:00 (UTC)
❌ Run #6778 - Failed - 2026-07-21 16:49 (UTC)

Unblocks Verify example lockfiles CI (ERR_PNPM_OUTDATED_LOCKFILE) after Version packages bumped example package.json specs. Co-authored-by: Cursor <cursoragent@cursor.com>

socket-security · 2026-07-21T17:57:46Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@layerzerolabs/toolbox-hardhat@0.6.14
	npm/@layerzerolabs/devtools-move@2.0.0
	npm/@layerzerolabs/ua-devtools-solana@9.0.0
	npm/@layerzerolabs/devtools-solana@3.1.0
	npm/@layerzerolabs/protocol-devtools-solana@9.0.0
	npm/@layerzerolabs/metadata-tools@4.0.0

View full report

socket-security · 2026-07-21T17:57:47Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@layerzerolabs/devtools-move` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: examples/oft-adapter-initia/package.json → `npm/@layerzerolabs/devtools-move@2.0.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@layerzerolabs/devtools-move@2.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@layerzerolabs/devtools-move` Location: Package overview From: examples/oft-adapter-initia/package.json → `npm/@layerzerolabs/devtools-move@2.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@layerzerolabs/devtools-move@2.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@layerzerolabs/devtools-solana` Location: Package overview From: examples/oapp-solana/package.json → `npm/@layerzerolabs/devtools-solana@3.1.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@layerzerolabs/devtools-solana@3.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@layerzerolabs/metadata-tools` Location: Package overview From: examples/ovault-evm/package.json → `npm/@layerzerolabs/metadata-tools@4.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@layerzerolabs/metadata-tools@4.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@layerzerolabs/protocol-devtools-solana` Location: Package overview From: examples/oapp-solana/package.json → `npm/@layerzerolabs/protocol-devtools-solana@9.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@layerzerolabs/protocol-devtools-solana@9.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@layerzerolabs/ua-devtools-solana` Location: Package overview From: examples/oapp-solana/package.json → `npm/@layerzerolabs/ua-devtools-solana@9.0.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@layerzerolabs/ua-devtools-solana@9.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Bare areBytes32Equal throws on base58 library addresses after pin. Skip checks now normalize with the OApp local eid first (same pattern as peer equality), keeping lock-defaults and EVM checksum safety. Co-authored-by: Cursor <cursoragent@cursor.com>

…ng canary Release note now documents areBytes32Equal(normalizePeer(local eid)). Send canary adds padded-vs-bare address case that fails on main's toLowerCase() compare. Co-authored-by: Cursor <cursoragent@cursor.com>

Coverage remains in hardhat configure*Libraries idempotency tests. Co-authored-by: Cursor <cursoragent@cursor.com>

tinom9 · 2026-07-21T21:29:40Z

+            })
+        })
+
        describe('configureReceiveLibraryTimeouts', () => {


I believe we also want to run the normalized equality checks on configureReceiveLibraryTimeouts (packages/ua-devtools/src/oapp/config.ts:287).

tinom9 · 2026-07-21T21:29:42Z

+
+`configureSendLibraries` / `configureReceiveLibraries` (and read-library equivalents)
+previously compared addresses with `toLowerCase()` or strict `===`. Checksum or
+padding mismatches caused already-pinned libraries to be re-proposed, which reverts


Do we want to add some simple tests for hex padding and Solana base58 format?

St0rmBr3w and others added 2 commits July 21, 2026 09:41

St0rmBr3w changed the title ~~fix(ua-devtools): skip already-pinned libraries with areBytes32Equal~~ OAPP-2067 fix(ua-devtools): skip already-pinned libraries with areBytes32Equal Jul 21, 2026

chore: regenerate example lockfiles after version packages

e15803f

Unblocks Verify example lockfiles CI (ERR_PNPM_OUTDATED_LOCKFILE) after Version packages bumped example package.json specs. Co-authored-by: Cursor <cursoragent@cursor.com>

St0rmBr3w and others added 3 commits July 21, 2026 11:03

test(ua-devtools): remove library checksum canary unit test

0307d6d

Coverage remains in hardhat configure*Libraries idempotency tests. Co-authored-by: Cursor <cursoragent@cursor.com>

tinom9 reviewed Jul 21, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

OAPP-2067 fix(ua-devtools): skip already-pinned libraries with areBytes32Equal#1947

OAPP-2067 fix(ua-devtools): skip already-pinned libraries with areBytes32Equal#1947
St0rmBr3w wants to merge 6 commits into
mainfrom
krak/fix-library-samevalue-idempotency

St0rmBr3w commented Jul 21, 2026

Uh oh!

St0rmBr3w commented Jul 21, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

tinom9 Jul 21, 2026

Uh oh!

tinom9 Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

St0rmBr3w commented Jul 21, 2026

What does this PR do?

Why is this change needed?

Type of Change

How was this tested?

Impact/Screenshots

Checklist

AI Provenance

Uh oh!

St0rmBr3w commented Jul 21, 2026

Checksum canary (proved against main-style skip logic)

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 E2E Test Status

Uh oh!

socket-security Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tinom9 Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

tinom9 Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jul 21, 2026 •

edited

Loading

socket-security Bot commented Jul 21, 2026 •

edited

Loading

socket-security Bot commented Jul 21, 2026 •

edited

Loading