Research goal
Compare the security models of LayerZero V2 and Wormhole as of 2026: how each handles message attestation, who runs the verifying nodes, and one concrete vulnerability disclosed against either in the past 18 months.
Completed
6 min 31 sec · 17 tx · 5 signers
Budget
1.000000 USDC
paid · Base Sepolia · KH-signed
LZ V2 GUID
0x0c6eb880…6ad
0G → Base · DVN-attested · ~40s
Lifecycle
Bounty.sol state transitions
Open
+0s
Researching
+157s
Reviewing
+256s
Synthesizing
+389s
Completed
+391s
Stage transactions · 0G Galileo
scroll →
Cross-chain payout
0G → Base via LayerZero V2 · settled by KeeperHub
Paid · 0.7s
Source · 0G Galileo
Bounty.submitSynthesis
Final report root · 0G Storage
0xc013b49b178d0ce16959ae9716a5891532b655b8783ef19936825f50e8889a22
LZ V2 message GUID
0x0c6eb88031ea51b3eaa6c6cbb10fab7fcc419eefc4262925ecd29e284985a6ad
LayerZero V2
DVN-attested · ~40s
Destination · Base Sepolia
PaymentMessenger → PaymentRouter.distribute
distribute tx · Base Sepolia
0xa06717e4495a6df75d1127bd3b61bbc18884c91cca97c04071857589cf00f0b7 ↗Recipients
5
USDC sent
1.000000
Settlement
0.7s
Recipient wallets
Five iNFT operators · paid in one tx
About this run
The data shown on this page is from the original Spike 18 PASS run on 0G Galileo — a clean end-to-end execution where all three sub-tasks were approved by the Critic and the Synthesizer fired the LayerZero V2 message atomically.
The demo video also shows the Critic rejecting a finding for one sub-task. That scene is captured from a separate Spike 18 reject-verification run, where a Researcher is forced (via DEMO_REJECT_TASK_INDEX env var) to emit a finding without a source URL. The Critic's rejection is genuine and on-chain; no contract code is modified for the demo.
Full procedure + on-chain proof: REJECTION_VERIFICATION_RESULT.md ↗