It is possible for an uninterrupted sequence of undeliverable messages (i.e., messages that will always revert on execution) to cause temporary loss of channel liveness if the sequence is longer than the blockchain iteration limit. This scenario can easily be rectified by the OApp owner calling clear (Table 3) to skip execution of these undeliverable packets. To enforce exactly-once delivery, we flag each packet after it is successfully received. In LayerZero, this is implemented by deleting the verified hash of a packet from the lossless channel after it is delivered and disallowing verification of nonces less than or equal to the lazy inbound nonce.

We illustrate the lossless channel in Figure 5 through a simplified view of the lifecycle of a LayerZero packet. In this example, the OApp asynchronously sends two messages from the source chain to the destination chain, and each packet can be in one of three states: Sent, Verified, or Received. A packet is Sent after the source Endpoint assigns a nonce to the packet, after which the requested DVNs verify it on the destination MessageLib. The packet transitions into the Verified state after an executor calls commitVerification (shown as commit in Figure 5), which checks that the packet has been verified by the OApp Security Stack. Once a packet and all preceding packets have been committed, the executor calls lzReceive to deliver the the packet and, barring reversion of the transaction, packet transitions into the Received state. If one or more preceding nonces have not been committed, the lossless channel will revert to prevent censorship.

3.2 MessageLib The MessageLib Registry is a collection of MessageLibs, each of which are responsible for securely emitting packets on the source chain and verifying them on the destination MessageLib. Each standalone MessageLib implements extrinsic security, necessitating adaptation to underlying environmental changes and precluding a fully immutable design of the MessageLib Registry. MessageLib verifies the payload hash of each packet, committing the verified payload hash to the endpoint after the extrinsic security requirement (e.g., DVN threshold) is fulfilled. To provide extensibility for extrinsic security while protecting existing OApps against in-place updates, we structure the MessageLib Registry as an append-only registry of immutable libraries, each of which can implement any arbitrary verification mechanism so long as it conforms to the protocol interface. This design avoids the trap of validation lock-in that most messaging serDVNA Destikatiok

Verifiable Verifiable Verifiable 0xAAAAAAAA... 0xFF... DVNB DVNB 0xEEEEEEEEE... Source 0xAA... 3 3 Verified 0xDD... Optional 1 1 0xEE... Status 4 0xFFFFFFFFF... Required 4 DVNC DVNA Hash Hash 0xBB... Verifyikg Verifyikg 0xCC... (OptionalThreshold = 2) 0xDDDDDDDD... 2 DVNN DVNC DVNN Nonce 6 6 0xBBBBBBBB... 5 5 2 0xCCCCCCCC... Nonce Figure 6: The Ultra Light Node enforces (onchain) the configured required DVNs, optional DVNs, and OptionalThreshold. Verification is neither lossless nor ordered, and messages can be committed to the channel as soon as the Security Stack is fulfilled. vices fall into, and ensures that LayerZero can be extended to take advantage of the most secure and efficient verification algorithms in every scenario.