LZEndpointDelegate

Git Source

Inherits: ILZEndpointDelegate, ILZEndpointV2Authorized, IVersioned, Policy, PolicyEnablerV2

Title: LZEndpointDelegate

Thin policy that proxies LayerZero V2 OApp-authorized endpoint calls on behalf of a single LZBridgeGateway. It is designed to act as the LayerZero V2 endpoint delegate for an LZBridgeGateway.

This contract holds no protocol state beyond the enable/disable lifecycle inherited from PolicyEnablerV2. Every external mutator is gated by both a role check and the givenEnabled modifier.

Constants

_KEYCODE_ROLES

Pre-computed keycode for the ROLES module dependency.

Avoids the runtime cost of toKeycode("ROLES") at the call site.

Keycode internal constant _KEYCODE_ROLES = Keycode.wrap(0x524F4C4553);

LZ_ENDPOINT

The LayerZero V2 endpoint address this delegate proxies to.

address public immutable override LZ_ENDPOINT;

Returns

Name	Type	Description
<none>	address

GATEWAY

The address of the LZBridgeGateway this delegate acts on behalf of.

address public immutable override GATEWAY;

Returns

Name	Type	Description
<none>	address

Functions

onlyBridgeConfigurator

Reverts if the caller does not hold the bridge_configurator role.

Gated solely by the role; the role is expected to be granted exclusively to LZBridgeAndDelegateConfig (the timelock policy), in which case calls are dispatched through that policy's timelock queue. Any holder that does not itself enforce a timelock on these mutators should only be granted the role temporarily for bootstrap. This contract does not enforce a timelock itself; it is enforced only by the LZBridgeAndDelegateConfig role holder. Granting bridge_configurator to any other address bypasses the timelock for these mutators.

modifier onlyBridgeConfigurator();

_requireBridgeConfigurator

Reverts with ROLESv1.ROLES_RequireRole(BRIDGE_CONFIGURATOR_ROLE) if msg.sender does not hold the bridge_configurator role.

function _requireBridgeConfigurator() private view;

onlyChannelManager

Reverts if the caller holds none of the bridge_channel_manager, bridge_admin, or admin roles.

Gates the inbound-channel management primitives (skip, nilify, burn, clear). The bridge_channel_manager role is an optional dedicated role for these primitives, accepted so channel management can be delegated without granting the broader bridge_admin role.

modifier onlyChannelManager();

_requireChannelManager

Reverts with IPolicyAdmin.NotAuthorised if msg.sender holds none of the bridge_channel_manager, bridge_admin, or admin roles.

function _requireChannelManager() private view;

constructor

Reverts if:

• The kernel address is the zero address.
• The gateway address is the zero address.
• The LZ endpoint reported by the specified gateway is the zero address.

constructor(Kernel kernel_, address gateway_) Policy(kernel_);

Parameters

Name	Type	Description
kernel_	Kernel
gateway_	address

configureDependencies

Define module dependencies for this policy.

function configureDependencies() external override returns (Keycode[] memory dependencies);

Returns

Name	Type	Description
dependencies	Keycode[]	- Keycode array of module dependencies.

VERSION

Returns the version of the contract

function VERSION() external pure override returns (uint8 major, uint8 minor);

Returns

Name	Type	Description
major	uint8	- Major version upgrade indicates breaking change to the interface.
minor	uint8	- Minor version change retains backward-compatible interface.

setSendLibrary

Pins send library for a destination EID.

Reverts if:

• The contract is disabled.
• The caller does not have the bridge_configurator role.
• The gateway has not set this contract as its endpoint delegate.
• The LZ endpoint's setSendLibrary function reverts.

function setSendLibrary(
        uint32 eid_,
        address lib_
    ) external override givenEnabled onlyBridgeConfigurator;

Parameters

Name	Type	Description
eid_	uint32	The destination endpoint ID.
lib_	address	The send library address to pin.

setReceiveLibrary

Pins receive library for a source EID.

Reverts if:

• The contract is disabled.
• The caller does not have the bridge_configurator role.
• The gateway has not set this contract as its endpoint delegate.
• The LZ endpoint's setReceiveLibrary function reverts.

function setReceiveLibrary(
        uint32 eid_,
        address lib_,
        uint256 gracePeriod_
    ) external override givenEnabled onlyBridgeConfigurator;

Parameters

Name	Type	Description
eid_	uint32	The source endpoint ID.
lib_	address	The receive library address to pin.
gracePeriod_	uint256	Grace period for migration (0 for immediate).

setReceiveLibraryTimeout

Sets receive library timeout for migration.

Reverts if:

• The contract is disabled.
• The caller does not have the bridge_configurator role.
• The gateway has not set this contract as its endpoint delegate.
• The LZ endpoint's setReceiveLibraryTimeout function reverts.

function setReceiveLibraryTimeout(
        uint32 eid_,
        address lib_,
        uint256 expiry_
    ) external override givenEnabled onlyBridgeConfigurator;

Parameters

Name	Type	Description
eid_	uint32	The source endpoint ID.
lib_	address	The library address.
expiry_	uint256	The expiry timestamp.

setEndpointConfig

Sets ULN/Executor config on a message library.

Reverts if:

• The contract is disabled.
• The caller does not have the bridge_configurator role.
• The gateway has not set this contract as its endpoint delegate.
• The LZ endpoint's setConfig function reverts.

function setEndpointConfig(
        address lib_,
        SetConfigParam[] calldata params_
    ) external override givenEnabled onlyBridgeConfigurator;

Parameters

Name	Type	Description
lib_	address	The message library address.
params_	SetConfigParam[]	Array of config parameters per EID.

skip

On the canonical chain, permanently discarding an inbound OHM mint message via skip does NOT update the gateway's bridgedSupply or its MINTR mint approval. The caller MUST follow up with a corresponding LZBridgeGateway.decreaseBridgedSupply call to keep the bookkeeping consistent. Depending on the cause of the skip, a separate governance proposal may also be required to restore the OHM owed to the affected user.

Reverts if:

• The contract is disabled.
• The caller holds none of the bridge_channel_manager, bridge_admin, or admin roles.
• The gateway has not set this contract as its endpoint delegate.
• The LZ endpoint's skip function reverts.

function skip(
        uint32 srcEid_,
        bytes32 sender_,
        uint64 nonce_
    ) external override givenEnabled onlyChannelManager;

Parameters

Name	Type	Description
srcEid_	uint32	The source endpoint ID.
sender_	bytes32	The sender address (bytes32).
nonce_	uint64	The nonce to skip.

nilify

Nilifies a payload for a source path.

Reverts if:

• The contract is disabled.
• The caller holds none of the bridge_channel_manager, bridge_admin, or admin roles.
• The gateway has not set this contract as its endpoint delegate.
• The LZ endpoint's nilify function reverts.

function nilify(
        uint32 srcEid_,
        bytes32 sender_,
        uint64 nonce_,
        bytes32 payloadHash_
    ) external override givenEnabled onlyChannelManager;

Parameters

Name	Type	Description
srcEid_	uint32	The source endpoint ID.
sender_	bytes32	The sender address (bytes32).
nonce_	uint64	The nonce of the message.
payloadHash_	bytes32	The hash of the payload to nilify.

burn

On the canonical chain, permanently discarding an inbound OHM mint message via burn does NOT update the gateway's bridgedSupply or its MINTR mint approval. The caller MUST follow up with a corresponding LZBridgeGateway.decreaseBridgedSupply call to keep the bookkeeping consistent. Depending on the cause of the burn, a separate governance proposal may also be required to restore the OHM owed to the affected user.

Reverts if:

• The contract is disabled.
• The caller holds none of the bridge_channel_manager, bridge_admin, or admin roles.
• The gateway has not set this contract as its endpoint delegate.
• The LZ endpoint's burn function reverts.

function burn(
        uint32 srcEid_,
        bytes32 sender_,
        uint64 nonce_,
        bytes32 payloadHash_
    ) external override givenEnabled onlyChannelManager;

Parameters

Name	Type	Description
srcEid_	uint32	The source endpoint ID.
sender_	bytes32	The sender address (bytes32).
nonce_	uint64	The nonce of the message.
payloadHash_	bytes32	The hash of the payload to burn.

clear

On the canonical chain, clearing an inbound OHM mint message bypasses the gateway's lzReceive handler, so bridgedSupply is not decremented and the MINTR mint approval is not consumed. The caller MUST follow up with a corresponding LZBridgeGateway.decreaseBridgedSupply call to keep the bookkeeping consistent. Depending on the cause of the clear, a separate governance proposal may also be required to restore the OHM owed to the affected user.

Reverts if:

• The contract is disabled.
• The caller holds none of the bridge_channel_manager, bridge_admin, or admin roles.
• The gateway has not set this contract as its endpoint delegate.
• The LZ endpoint's clear function reverts.

function clear(
        Origin calldata origin_,
        bytes32 guid_,
        bytes calldata message_
    ) external override givenEnabled onlyChannelManager;

Parameters

Name	Type	Description
origin_	Origin	The origin of the message.
guid_	bytes32	The GUID of the message.
message_	bytes	The message bytes.

supportsInterface

The contract advertises support for IEnablerV2, the legacy IEnabler, and any interface advertised by the parent ERC165 implementation. Extension mixins are expected to override this function and add their own interface identifiers.

function supportsInterface(
        bytes4 interfaceId_
    ) public view virtual override(EnablerV2) returns (bool);

Parameters

Name	Type	Description
interfaceId_	bytes4

Returns

Name	Type	Description
<none>	bool

_requireNonzeroAddress

function _requireNonzeroAddress(address address_, string memory parameter_) private pure;

Parameters

Name	Type	Description
address_	address
parameter_	string