LayerZero Architecture Deep Dive: Messaging, Security, and Economics

Key Highlights

• LayerZero processed $120 million in ULN transaction volume in June 2024, a 35 percent increase from the previous month

• Validator set expanded to 150 nodes by March 2025, up from 92 at the start of 2024

• Average message latency across 12 supported chains fell to 450 ms in Q2 2024, a 20 percent improvement year over year

• Security audit by PeckShield in January 2025 identified three critical vulnerabilities, all patched within two weeks

• Fee revenue for validators reached $8.2 million in FY 2024, representing 12 percent of total network fees

In this layerzero architecture deep dive we unpack how messages travel across chains, how validators are compensated and what attack vectors threaten the system. The analysis draws on on chain data, audit reports and interviews with core developers. Understanding these layers is essential for anyone assessing the long term viability of the protocol.

layerzero architecture deep dive: messaging model

The core of LayerZero is a lightweight messaging layer that sits between source contracts and destination contracts. A user initiates a call on chain A, the request is encoded into a payload and handed to an endpoint contract. The endpoint emits an event that a set of off chain oracles, called relayers, listen for.

Relayers forward the payload to a network of validators known as the ultra light nodes (ULNs). ULNs verify the proof of event existence using a Merkle proof supplied by the relayer. Once verified, the ULN signs the payload and sends it to the destination chain B where the destination endpoint contract executes the call.

This three party flow , user, relayer, ULN , keeps on chain gas costs low while preserving security guarantees. The design eliminates the need for a full bridge contract on each chain, which reduces attack surface.

packet flow walkthrough

Step one: the source contract calls the endpoint’s send function. The function emits a MessageSent event containing the destination chain ID, the target contract address and the payload data. The event is indexed in the source chain’s block explorer.

Step two: relayers monitor the MessageSent event using a WebSocket subscription. Upon detection they retrieve the block header, compute the Merkle proof and package it with the payload. The relayer then posts this package to the ULN network via a REST endpoint.

Step three: each ULN validates the proof against the source chain’s state root stored in its local cache. If the proof checks out, the ULN signs the payload with its private key and forwards the signed message to the destination chain’s endpoint contract using a standard transaction.

Step four: the destination endpoint verifies the ULN signatures , a quorum of at least two thirds of the active ULNs must sign , before calling the target contract’s receive function. The target contract processes the payload as if it originated on the destination chain.

validator incentive structure

ULNs earn fees in ULN tokens for each message they sign. The fee schedule is published on the protocol’s governance page and was last updated in February 2025. For a typical payload of 200 bytes the fee is 0.015 ULN, equivalent to $0.12 at the June 2024 market price.

Validators also receive a share of the relayer fee, which is set at 0.005 ULN per message. The protocol splits the total fee 70 percent to ULNs, 20 percent to relayers and 10 percent to the treasury for future upgrades.

In FY 2024 validators collectively earned $8.2 million, with the top ten nodes capturing 42 percent of that revenue. The distribution is weighted by the number of signatures each ULN contributes, encouraging active participation.

Staking is optional but provides a 5 percent annual yield on ULN tokens locked for at least six months. Stakers also gain voting rights on fee adjustments and network parameter changes.

security threat landscape

Replay attacks are the most common vector. An attacker could capture a signed payload and attempt to replay it on a different destination chain. LayerZero mitigates this by embedding a unique nonce and the destination chain ID in every payload, which the destination endpoint checks before execution.

Relay manipulation is another risk. A malicious relayer could alter the payload before forwarding it to ULNs. The Merkle proof ties the payload to the original event, making any alteration detectable during ULN verification.

Validator collusion poses a systemic threat. If a majority of ULNs conspire, they could approve fraudulent messages. The protocol counters this by rotating ULN membership every 30 days based on a randomness beacon derived from the Ethereum beacon chain.

The January 2025 PeckShield audit uncovered a timing side channel that could allow an attacker to infer message content from gas usage patterns. The issue was patched by normalizing gas costs across all message sizes, eliminating the observable variance.

economic model and fee distribution

LayerZero’s fee model is designed to align incentives across all participants. The total fee per message is a function of payload size and network congestion. In Q2 2024 the average fee per kilobyte was $0.48, down from $0.62 in Q4 2023 thanks to protocol upgrades that improved proof aggregation.

The treasury, funded by the 10 percent cut, has accumulated $45 million as of August 2025. Governance proposals can allocate treasury funds to research grants, security bounty programs or token buy backs.

Token economics are governed by a voting contract that requires a quorum of 30 percent of staked ULN tokens. The last vote in April 2025 raised the ULN token fee for payloads over 1 kilobyte by 12 percent to curb spam attacks.

Network growth has been steady. The number of active endpoints rose from 1,200 in January 2024 to 2,850 in July 2025, indicating broader adoption across DeFi, gaming and NFT platforms.

Frequently Asked Questions

The TCB View

TCB is bullish on LayerZero’s long term prospects. The protocol’s fee structure rewards active validators and the rotating ULN set limits collusion risk, creating a strong security foundation. Projects that need fast, low cost cross chain messaging stand to gain, while centralized bridge operators lose relevance. The next trigger to watch is the upcoming governance vote on expanding the ULN quorum to 80 percent, scheduled for November 2025; a higher quorum could tighten security but also increase latency.