Assessment reports>Example String-Passing Solana OApp>Threat Model>Instruction: LzReceive

Instruction: LzReceive

This instruction is invoked to process an incoming message. The call can be performed by anyone. The OApp invokes the LayerZero endpoint to verify that the incoming message is legitimate and is not being replayed.

If the endpoint CPI succeeds, the incoming message is decoded and stored in the singleton Store account, after which execution ends.

Input parameters

The instruction receives as argument an instance of the LzReceiveParams struct defined by the LayerZero SDK:

pub struct LzReceiveParams { pub src_eid: u32, pub sender: [u8; 32], pub nonce: u64, pub guid: [u8; 32], pub message: Vec, pub extra_data: Vec, }
  • src_eid: This is the identifier of the source endpoint.

  • sender: This is the address of the remote message sender.

  • nonce: This is the nonce used to prevent message replay and out-of-sequence delivery.

  • guid: This is the globally unique (across all LayerZero OApps on all chains) identifier of the message.

  • message: This is the incoming message payload.

  • extra_data: This is unused.

Accounts

The instruction is intended to process the accounts returned by the LzReceiveTypes instruction.

The following accounts are directly required by the instruction:

  • store: Singleton account storing the OApp configuration.

    • PDA: Yes, with seed STORE_SEED.

    • Mutable: Yes.

  • peer: Account representing the configuration of one allowlisted remote contract.

    • PDA: Yes, with seeds PEER_SEED, store.key(), and params.src_eid.

The rest of the remaining accounts supplied to the instruction are passed to the LayerZero endpoint Clear CPI.

CPI

This instruction performs a CPI call to the LayerZero endpoint to invoke the Clear instruction, which verifies the incoming message and marks it as processed (advancing the nonce associated with the channel).

The ClearParams struct passed as argument to the CPI is initialized as follows:

  • receiver: ctx.accounts.store.key().

  • src_eid: params.src_eid.

  • sender: params.sender.

  • nonce: params.nonce.

  • guid: params.guid.

  • message: params.message.

Zellic © 2025Back to top ↑