This blog outlines our ongoing security updates:
- Updating pathway defaults on Endpoint v1 and v2
- Relayer deprecation
- Updates to verifier client
- Updates to multisig
Updating Pathway Defaults on Endpoint v2
We’ll be updating default configurations on Endpoint v2 on July 9, 2026 at 9:00 AM PT. Defaults on all pathways will move to a minimum 3-of-3 DVN setup, with additional DVNs as available. While 2-of-2 remains a secure configuration, this shift to 3-of-3 reflects a further hardened security posture.
This migration only affects applications using Endpoint v2 with default settings. Teams with pinned libraries will not be affected.
For any application using default settings, we expect roughly 15 minutes of downtime.
Updating Pathway Defaults on Endpoint v1
To ensure that both Endpoint v2 and Endpoint v1 meet the same security standards, we are updating the Endpoint v1 default library to ULNv301 from ULNv2 (which only supports a 2-of-2 configuration) on July 9, 2026 at 9:00 AM PT. This migration only affects applications using Endpoint v1 with default settings. Teams with pinned libraries will not be affected.
For any application using default settings, we expect roughly 15 minutes of downtime.
Relayer Deprecation
We will deprecate the Relayer that services LayerZero v1 (ULNv2) on Monday, August 3rd at 12:00PM PT. This does not mean support for Endpoint v1 is deprecated. Teams currently pinned to ULNv2 in Endpoint v1 will need to re-pin their library to ULNv301. Teams that do not do this will see messaging turn off if they do not act. We’ll reach out to these teams directly in the coming days.
Alternatively, teams that want to stay on ULNv2 can run their own relayer if they wish.
Verifier Client Updates
DVNs that use LayerZero Labs' gas abstraction service (Essence) run a variant of a Verifier client previously called Gasolina. It's written entirely in TypeScript and has undergone three audits since its initial release.
As an additional security hardening measure, we are building a Rust-based Verifier client. Both this and the TypeScript client will be available to all DVNs. The LayerZero Labs DVN will run both simultaneously and require quorum across not just internal and external RPCs, but also across clients.
For clarity, we will also be updating the name to the verifier client as follows:
- The verifier client written in TypeScript formerly known as Gasolina will be renamed to Aegis.
- The verifier client written in Rust will be named Veritas.
Both Veritas and Aegis feature a more robust RPC quorum configuration to allow DVNs to select granular quorums of internal, dedicated-external, and shared-external RPCs.
Multisig
This June we are updating all LayerZero multisigs to a 5 of 7 signing threshold by adding two new signers. This is the first step toward reaching a 7 of 10 threshold by the end of the summer.