SAN LayerZero Bridge

Pre-Mainnet Security Review

This repository contains the proposed LayerZero V2 bridge for the canonical SAN token between Solana and Robinhood Chain.

The canonical SAN mainnet bridge has not been deployed or activated. No mainnet SAN bridge is currently live. The implementation completed an end-to-end testnet lock → mint → burn → unlock round trip using a separate tSAN test token. All testnet addresses and assets are test-only.

We are publishing the implementation before mainnet deployment to invite independent technical and security review. Community review is not a formal audit, certification, or assurance that the bridge is safe. Cross-chain bridges carry smart-contract, protocol, validator/DVN, sequencer, governance, key- management, and operational risk.

Canonical asset and invariant

Canonical SAN is the existing six-decimal legacy SPL token on Solana:

GQz5ThKHNcuAvMKA8rCPSdoFUoApk9Fi8qB9m3Gqpump

The Solana side uses the official LayerZero OFT Adapter in lock/unlock mode. The Robinhood representation uses a non-upgradeable standard LayerZero OFT with no arbitrary mint entry point.

Core supply invariant, subject to explicit reconciliation of in-flight messages:

Robinhood SAN total supply
    <= Solana OFTStore.tvl_ld
    <= canonical SAN held in the Solana bridge escrow

Proposed production identities:

Item	Value
Canonical SAN mint	GQz5ThKHNcuAvMKA8rCPSdoFUoApk9Fi8qB9m3Gqpump
Production Solana OFT program	9myHzfqsbJfGbYxpCvVCYqLaB4Co1RCo2a8T4QSkTvcD
Solana mainnet LayerZero EID	30168
Robinhood Chain ID	4663
Robinhood LayerZero EID	30416

The OFT Store, SAN escrow, Robinhood SanOFT, peers, multisigs, and production security configuration do not yet exist. Verified application addresses will be published only after a separately authorized deployment and independent read-back.

Security Review Requested

The current immutable production-code audit target is d28762288bb5180ff292f57eef7132191f2037ec, the squash merge of security PR #2. It supersedes a53a86bcc0a18934a19f2889ba61ceb1633fa359 because both bridge applications now initialize paused and the production activation checker and partial-configuration regressions are part of the reviewed code boundary.

Reproducible Solana artifact

Phase 5A.3 produced two byte-identical verifiable builds of the immutable production-code audit target d28762288bb5180ff292f57eef7132191f2037ec.

• ELF SHA-256: b6c6a071143b263579e0d1313a7a9fe88c2a84024d42103c691ee8939d6ce543
• Executable hash: 5068a15a15899e96d2b9a2c331573d490f064f2cd84cf88f43314371ed7d33d6
• ELF size: 571,864 bytes

See docs/PRODUCTION_VERIFIABLE_BUILD.md for the pinned image, exact build command, and reproducibility evidence. Independent artifact approval remains required before Phase 5B.

The fail-closed change prevents bridging throughout incremental deployment, wiring, security configuration, and governance handoff. Activation is still a separate governance action: once both applications are unpaused, the bridge is permissionless and an ordinary holder may race the operator canary. This is a bounded public canary, not an exclusive first-transfer mechanism.

We welcome review from Solana, LayerZero, EVM, bridge, and application-security engineers. Please focus on:

• Solana OFT Adapter custody and escrow-account constraints;
• tvl_ld accounting and the global supply invariant;
• withdraw_fee principal protection and paused-state behavior;
• LayerZero Endpoint, peer, DVN, ULN, Executor, and confirmation configuration;
• local/shared-decimal conversion, dust, slippage, and six-decimal behavior;
• SanOFT bridge-only pause and inbound/outbound rate-limit overrides;
• resistance to arbitrary or unauthenticated minting;
• replay, malformed-message, wrong-peer, and wrong-Endpoint handling;
• Solana program upgrade authority and Store/delegate powers;
• Safe and Squads governance assumptions and authority handoff;
• deployment and wiring tooling, partial execution, and retry safety;
• wrong-chain, wrong-RPC, wrong-EID, and testnet-identity protections;
• missing, bypassed, or incorrectly targeted rate limits; and
• end-to-end preservation of the global supply invariant.

Start with:

• Responsible disclosure
• Auditor handoff
• Exact audit scope
• Audit target and commit map
• Production security review

Potentially exploitable vulnerabilities should be reported privately before public disclosure. Do not post live exploit instructions, private keys, seed phrases, personal data, or sensitive infrastructure details in a public issue. No bug bounty is promised unless a separate written program says otherwise.

Private disclosure: use GitHub Private Vulnerability Reporting. If that flow is unavailable, contact @SanChanSecurity by Telegram direct message to establish a private reporting channel. For public coordination only, contact @SanChanRun on X. Never send vulnerability details through X or public Telegram channels or groups.

Architecture

Solana canonical SAN holder
        │ outbound: lock SAN, increase tvl_ld
        ▼
LayerZero Solana OFT Adapter escrow
        │ authenticated LayerZero message
        ▼
Robinhood SanOFT: mint only through authenticated credit

Robinhood outbound: burn SanOFT
        │ authenticated LayerZero message
        ▼
Solana inbound: decrease tvl_ld and release escrowed SAN

The proposed security stack uses explicit send/receive libraries, Executors, peers, enforced options, and any-two-of-three DVN verification. Defaults and the deprecated Dead DVN must not be inherited. Phase 5A.4 freezes Robinhood-source depth at 30 L2 blocks and Solana-source depth at 32. Thirty Robinhood blocks are not Ethereum finality, Nitro challenge completion, or proof of finalized L1 posting.

Four rate-limit controls are mandatory: Solana outbound/inbound and Robinhood outbound/inbound. Current unapplied planning profiles per direction and 24-hour refill period are 500,000 SAN for the canary, 30,000,000 SAN for early public operation, 50,000,000 SAN for normal operation, and 100,000,000 SAN for a later mature profile. These are policy values, not live settings or launch authorization, and none has been applied on mainnet.

Testnet evidence

The separate testnet deployment completed one forward and one return transfer:

Solana Devnet tSAN lock
    → Robinhood Testnet tSAN mint
    → Robinhood Testnet tSAN burn
    → Solana Devnet tSAN unlock

The handoff records both source transactions, LayerZero GUIDs, destination transactions, exactly-once delivery evidence, and the separation between tSAN and canonical SAN. Testnet deployment identities and configuration are not a production template.

See Auditor handoff and testnet-to-production review.

Repository map

Area	Location
Architecture and canonical custody model	docs/ARCHITECTURE.md
Solana OFT Adapter program	programs/oft/
Robinhood SanOFT contract	contracts/SanOFT.sol
Production identity/configuration policies	scripts/ and config/mainnet.ts
EVM and Solana runtime tests	test/
Escrow invariant review	docs/ESCROW_SECURITY_REVIEW.md
LayerZero security proposal	docs/SECURITY_CONFIG.md
Rate-limit analysis	docs/PRODUCTION_RATE_LIMITS.md
Governance and handoff	docs/PRODUCTION_GOVERNANCE.md, docs/AUTHORITY_HANDOFF.md
Future inert runbooks	docs/MAINNET_DEPLOYMENT_RUNBOOK.md, docs/MAINNET_WIRING_RUNBOOK.md, docs/MAINNET_CANARY_RUNBOOK.md
Build and artifact evidence	docs/PRODUCTION_VERIFIABLE_BUILD.md, docs/PRODUCTION_EVM_ARTIFACT.md
Activation and in-flight evidence	docs/PRODUCTION_ACTIVATION_CHECKER.md, docs/IN_FLIGHT_EVIDENCE_MODEL.md
Dependency alert triage	docs/DEPENDENCY_ALERT_TRIAGE.md

Historical phase reports are retained as supporting evidence but are not the primary public navigation surface.

Local validation

Required toolchain: Node 22, pnpm, Rust/Cargo 1.84.1, Anchor 0.31.1, Agave/Solana 2.2.20, and Foundry.

pnpm install --frozen-lockfile
pnpm compile
pnpm test
pnpm test:anchor
pnpm test:scripts
pnpm lint
pnpm exec tsc --noEmit
forge test
pnpm san:check-program-id

These commands build and test locally. They do not authorize deployment, wiring, token movement, or any other blockchain transaction. Transaction- capable mainnet task paths are structurally disabled in this revision.

The production-code audit target is commit d28762288bb5180ff292f57eef7132191f2037ec. Later documentation-only commits do not change that code target. Any later production-code, dependency-resolution, build-setting, or security-policy change creates a new audit boundary and requires independent change review.

Current blockers

Before Phase 5B, the project still requires at least:

• independent approval of the reproducible Solana artifact and recorded ELF/executable hashes;
• independent review of the exact production commit and artifacts;
• independent acceptance of the frozen 30-block Robinhood source-depth policy and its explicit non-finality assumptions;
• fresh LayerZero metadata and DVN/Executor review;
• final Squads/Safe identities, signer separation, and recovery policy;
• independent approval of the frozen market/liquidity rate-limit analysis;
• independent review of the Phase 5A.3 common-context checker and in-flight scanner, followed by approval of a live manifest and provider independence;
• a separate explicit authorization for every production transaction.

See production-readiness blockers. No repository content should be interpreted as permission to proceed to mainnet.