Security model

Omnisea separates protocol administration from asset ownership. This does not remove cross-chain risk.

Protocol administrator

The router administrator may add permanent peers, configure each route before freezing it, set gas floors and receive values, and update the protocol treasury. Peers and frozen routes cannot be changed or removed. A route carries an asset only after it has been frozen for ROUTE_ACTIVATION_DELAY (5 minutes). Assets without an issuer compliance contract snapshot existing peers when created; newly added peers need explicit approval for existing assets.

The router has no upgrade mechanism and does not appoint a LayerZero delegate. The router itself writes each route's verification settings (send and receive libraries, executor, and a 3-of-5 DVN set) and freezes them, so later changes to LayerZero defaults do not apply. The one change allowed after freezing is a rescue: if DVNs stop verifying, the administrator can set how many of the same five must verify inbound messages on a route, from 1 up to the launch value of 3. It cannot add, remove or replace DVNs. Messages pending on that route then deliver. Holders can also leave through another chain, which the issuer can enable on each side without using the stalled route. See Route outages.

Asset owner

The creator is permanent. Only that wallet can enable additional chains, set bounded fees, update an existing issuer compliance contract, or withdraw creator fees. From the origin it acts on every chain through authenticated LayerZero messages. It can also act directly on the chain concerned, from the same address. Off the origin this relies on the creator controlling that address there too, which a smart account or multisig must ensure by deploying it the same way.

Whether an asset uses an issuer compliance contract is fixed at creation. If it starts without one, one cannot be added later. If it starts with one, issuer compliance checks cannot be removed, but the contract can be replaced. These assets require explicit chain configuration; their compliance contract may block transfers.

Backing and remaining risks

Backing is accounted for per asset. Assets of the same original token share physical vault custody and a token-level solvency check. A rebase or other unusual token behavior can therefore affect more than one asset.

Fee-on-transfer and rebasing tokens are unsupported. Wrapped, non-rebasing tokens are preferable. Token pauses, blocklists, chain outages, compromised peers, verification failures and contract bugs can prevent settlement. Restore is another cross-chain message and can itself be delayed or fail.

This documentation is not an audit or a guarantee of recovery. Verify deployed code, peers and each route's frozen configuration before integrating.