# Lighter

Markdown version of https://l2beat.com/layer2s/projects/lighter

## Summary

**Warning:** There are impactful changes and part of the information might be outdated.

- Total Value Secured: $1.09 B (-8.98% compared to seven days ago; canonically bridged $1.09 B, natively minted $0.00, externally bridged $0.00; 0.00% with additional trust assumptions compared to the tokens involved and the Stage assigned to the project's canonical messaging bridge)
  - **Warning:** The LIT token associated with Lighter accounts for 42.3% of the TVS! (sentiment: warning)
- TVS by asset: ETH & derivatives $21.08 M (1.92%), Stablecoins $611.15 M (55.7%), Other $464.83 M (42.3%)
- Associated tokens: LIT: $464.37 M (42.3% of TVS)
- Past day UOPS: 1.92 K (+29.2% compared to seven days ago)
- Stage: Stage 0 (Appchain)
- Type: ZK Rollup
- Purpose: Exchange
- Host chain: Ethereum
- Last 24h cross-chain volume: $22.10 M
- Last 24h cross-chain transfers: 1.11 K
- Interop protocols used (last 24h volume): [Lighter](https://l2beat.com/interop/protocols/lighter) ($22.07 M), [Relay](https://l2beat.com/interop/protocols/relay) ($33.19 K)
- Tokens by volume (last 24h): [USDC](https://l2beat.com/interop/tokens/9HN5PN/usdc) ($21.61 M), [ETH](https://l2beat.com/interop/tokens/C0Hmkq/eth) ($386.50 K), [LIT](https://l2beat.com/interop/tokens/KxRLBo/lit) ($81.62 K), and 3 more

### Risks

- Sequencer failure: Force via L1 (sentiment: good)
- State validation: Validity proofs (SN) (No execution delay; sentiment: good)
- Data availability: Onchain (SD) (sentiment: good)
- Exit window: None (sentiment: bad)
- Proposer failure: Use escape hatch (sentiment: good)

### About

Lighter is an application-specific zk rollup on a mission to revolutionize trading by building provably fair, secure, and scalable infrastructure for finance.

### Links

- Website: https://lighter.xyz, https://app.lighter.xyz/
- Docs: https://docs.lighter.xyz, https://assets.lighter.xyz/whitepaper.pdf
- Explorer: https://app.lighter.xyz/explorer
- Repository: https://github.com/elliottech
- Social: https://x.com/Lighter_xyz, https://discord.gg/lighterxyz, https://linkedin.com/company/lighter-xyz, https://t.me/lighterxyz_official
- Contracts explorer (Disco): https://disco.l2beat.com/ui/p/lighter

### Badges

- Application-specific chain: This project is built to operate a specific application
- Ethereum with blobs: This project is posting its data to Ethereum as blobs

## Value Secured

The interactive TVS charts are shown on [the HTML page](https://l2beat.com/layer2s/projects/lighter#tvs).

Token by token: [TVS breakdown](https://l2beat.com/layer2s/projects/lighter/tvs-breakdown).

- [TVS chart (JSON)](https://l2beat.com/api/scaling/tvs/lighter)
- [TVS breakdown by token (JSON)](https://l2beat.com/api/scaling/tvs/lighter/breakdown)

## Volume and flows

The interactive flows chart is shown on [the HTML page](https://l2beat.com/layer2s/projects/lighter#interop-flows).

## Activity

The interactive activity chart is shown on [the HTML page](https://l2beat.com/layer2s/projects/lighter#activity).

Data source: Lighter API

- [Activity chart (JSON)](https://l2beat.com/api/scaling/activity/lighter)

## Onchain costs

The section shows the operating costs that L2s pay to Ethereum.

The interactive costs chart is shown on [the HTML page](https://l2beat.com/layer2s/projects/lighter#onchain-costs).

### Tracked transactions

#### Batch submissions

- functionCall: 2025-01-17 21:36 UTC - now; currently used; address: [0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7](https://etherscan.io/address/0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7); selector: 0xe415f0f4; signature: `function commitBatch(tuple(uint64 endBlockNumber, uint32 batchSize, uint64 startTimestamp, uint64 endTimestamp, uint32 priorityRequestCount, bytes32 prefixPriorityRequestHash, bytes32 onChainOperationsHash, bytes32 newStateRoot, bytes32 newValidiumRoot, bytes pubdataCommitments) newBatchData, tuple(uint64 batchNumber, uint64 endBlockNumber, uint32 batchSize, uint64 startTimestamp, uint64 endTimestamp, uint32 priorityRequestCount, bytes32 prefixPriorityRequestHash, bytes32 onChainOperationsHash, bytes32 stateRoot, bytes32 validiumRoot, bytes32 commitment) lastStoredBatch)`

#### Proof submissions

- functionCall: 2025-01-17 05:05 UTC - now; currently used; address: [0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7](https://etherscan.io/address/0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7); selector: 0x23ff50e1; signature: `function verifyBatch(tuple(uint64 batchNumber, uint64 endBlockNumber, uint32 batchSize, uint64 startTimestamp, uint64 endTimestamp, uint32 priorityRequestCount, bytes32 prefixPriorityRequestHash, bytes32 onChainOperationsHash, bytes32 stateRoot, bytes32 validiumRoot, bytes32 commitment) batch, bytes proof)`

#### State updates

- functionCall: 2025-01-17 05:05 UTC - now; currently used; address: [0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7](https://etherscan.io/address/0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7); selector: 0x2d320e28; signature: `function executeBatches(tuple(uint64 batchNumber, uint64 endBlockNumber, uint32 batchSize, uint64 startTimestamp, uint64 endTimestamp, uint32 priorityRequestCount, bytes32 prefixPriorityRequestHash, bytes32 onChainOperationsHash, bytes32 stateRoot, bytes32 validiumRoot, bytes32 commitment)[] batches, bytes[] onChainOperationsPubData)`

## Data posted

This section shows how much data the project publishes to Ethereum over time. It leaves out data posted to other data-availability (DA) layers. The project currently posts data to [Ethereum](https://l2beat.com/projects/ethereum).

The interactive data posted chart is shown on [the HTML page](https://l2beat.com/layer2s/projects/lighter#data-posted).

### Tracked transactions

#### Blob submissions

- DA layer Ethereum: from block 21642011 to 24040916; historical; inbox: [0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7](https://etherscan.io/address/0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7); sequencers: [0xfDb36C132fA19f7774d72fA39c89272D1B954A41](https://etherscan.io/address/0xfDb36C132fA19f7774d72fA39c89272D1B954A41), [0xFBC0dcd6c3518cB529bC1B585dB992A7d40005fa](https://etherscan.io/address/0xFBC0dcd6c3518cB529bC1B585dB992A7d40005fa), [0xfcB73F6405F6B9be91013d9477d81833a69C9c0D](https://etherscan.io/address/0xfcB73F6405F6B9be91013d9477d81833a69C9c0D), [0x1c0F4f6daf0E0f32C5482672fa5342784915df21](https://etherscan.io/address/0x1c0F4f6daf0E0f32C5482672fa5342784915df21)
- DA layer Ethereum: from block 24040917 to now; currently used; inbox: [0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7](https://etherscan.io/address/0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7); sequencers: [0x191fF0EC830F83916A427d169a234c33e48aA79f](https://etherscan.io/address/0x191fF0EC830F83916A427d169a234c33e48aA79f), [0x750bdb90AC72A78308d21eAC78999bBAE31cd63d](https://etherscan.io/address/0x750bdb90AC72A78308d21eAC78999bBAE31cd63d), [0xC0D2853e06F1E145177D5ef08Ab065a76e14354C](https://etherscan.io/address/0xC0D2853e06F1E145177D5ef08Ab065a76e14354C)

## Liveness

This section shows how "live" the project's operators are by displaying how frequently they submit transactions of the selected type. It also highlights anomalies - significant deviations from their typical schedule.

No ongoing anomalies detected.

The interactive liveness chart is shown on [the HTML page](https://l2beat.com/layer2s/projects/lighter#liveness).

### Tracked transactions

#### Batch submissions

- functionCall: 2025-01-17 21:36 UTC - now; currently used; address: [0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7](https://etherscan.io/address/0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7); selector: 0xe415f0f4; signature: `function commitBatch(tuple(uint64 endBlockNumber, uint32 batchSize, uint64 startTimestamp, uint64 endTimestamp, uint32 priorityRequestCount, bytes32 prefixPriorityRequestHash, bytes32 onChainOperationsHash, bytes32 newStateRoot, bytes32 newValidiumRoot, bytes pubdataCommitments) newBatchData, tuple(uint64 batchNumber, uint64 endBlockNumber, uint32 batchSize, uint64 startTimestamp, uint64 endTimestamp, uint32 priorityRequestCount, bytes32 prefixPriorityRequestHash, bytes32 onChainOperationsHash, bytes32 stateRoot, bytes32 validiumRoot, bytes32 commitment) lastStoredBatch)`

#### Proof submissions

- functionCall: 2025-01-17 05:05 UTC - now; currently used; address: [0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7](https://etherscan.io/address/0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7); selector: 0x23ff50e1; signature: `function verifyBatch(tuple(uint64 batchNumber, uint64 endBlockNumber, uint32 batchSize, uint64 startTimestamp, uint64 endTimestamp, uint32 priorityRequestCount, bytes32 prefixPriorityRequestHash, bytes32 onChainOperationsHash, bytes32 stateRoot, bytes32 validiumRoot, bytes32 commitment) batch, bytes proof)`

#### State updates

- functionCall: 2025-01-17 05:05 UTC - now; currently used; address: [0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7](https://etherscan.io/address/0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7); selector: 0x2d320e28; signature: `function executeBatches(tuple(uint64 batchNumber, uint64 endBlockNumber, uint32 batchSize, uint64 startTimestamp, uint64 endTimestamp, uint32 priorityRequestCount, bytes32 prefixPriorityRequestHash, bytes32 onChainOperationsHash, bytes32 stateRoot, bytes32 validiumRoot, bytes32 commitment)[] batches, bytes[] onChainOperationsPubData)`

### Last 30 day anomalies

All liveness anomalies detected for this project in the last 30 days, helping you review recent downtime and availability issues.

- No state updates were performed for 2h 32m (from 2026-10-11 11:16 UTC until 2026-10-11 13:49 UTC). These typically occur every 6m 51s on average.
- No proof submissions were performed for 2h 32m (from 2026-10-11 11:14 UTC until 2026-10-11 13:47 UTC). These typically occur every 3m 43s on average.
- No tx data submissions were performed for 54m 48s (from 2026-10-11 11:07 UTC until 2026-10-11 12:02 UTC). These typically occur every 3m 42s on average.
- No state updates were performed for 3h 2m (from 2026-10-01 16:09 UTC until 2026-10-01 19:11 UTC). These typically occur every 6m 51s on average.
- No proof submissions were performed for 2h 46m (from 2026-10-01 16:06 UTC until 2026-10-01 18:53 UTC). These typically occur every 3m 43s on average.
- No proof submissions were performed for 2h 1m (from 2026-09-20 11:21 UTC until 2026-09-20 13:22 UTC). These typically occur every 3m 43s on average.
- No tx data submissions were performed for 2h 11m (from 2026-09-20 11:08 UTC until 2026-09-20 13:20 UTC). These typically occur every 3m 42s on average.

## Milestones & Incidents

- 2025-10-10 (incident): [Lighter experiences 4.5h of downtime](https://x.com/Lighter_xyz/status/1977252708533911614). Lighter experiences 4.5 hours of downtime due to DB growth issues.
- 2025-10-02: [Lighter launches public mainnet](https://x.com/Lighter_xyz/status/1973508660061180363). Lighter launches public mainnet after 8 months of private beta.

## Risk summary

### Funds can be stolen if

1. a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).

### Funds can be lost if

2. the oracle prices are manipulated.

### Funds can be frozen if

3. the Pause Guardian or the Emergency Guardian pause the system. A pause halts batch processing and withdrawals for up to 24h or 72h respectively, but does not block desert mode.

### MEV can be extracted if

4. the operator exploits their centralized position and frontruns user transactions.

## Risk analysis

### Sequencer failure

Force via L1 (sentiment: good)

Users can force the sequencer to include a transaction by submitting a request through L1. If the sequencer censors or is down for for more than 14d, users can use the exit hatch to withdraw their funds.

### State validation

Validity proofs (SN) (No execution delay; sentiment: good)

SNARKs are succinct zero knowledge proofs that ensure state correctness, but require trusted setup.

### Data availability

Onchain (SD) (sentiment: good)

All of the data (SD = state diffs) needed for proof construction is published onchain.

### Exit window

None (sentiment: bad)

There is no window for users to exit in case of an unwanted upgrade since contracts are instantly upgradable.

### Proposer failure

Use escape hatch (sentiment: good)

Users are able to trustlessly exit by submitting a zero knowledge proof of funds.

## Stage

Lighter is a Stage 0 Appchain ZK Rollup.

### Stage 0

5 requirements met.

- Met: A complete and functional proof system is deployed.
- Met: The project calls itself a rollup.
- Met: State roots are posted to Ethereum L1.
- Met: Inputs for the state transition function are posted to Ethereum L1.
- Met: A source-available node exists that can recreate the state from Ethereum L1 data. Please note that the L2BEAT team has not verified the validity of the node source code. [View code](https://github.com/elliottech/lighter-prover/tree/main)

### Stage 1

4 issues need fixing.

**Principle**

- Issue: Compromising ≥75% of the Security Council should be the only way (other than bugs) for a rollup to indefinitely block an L2→L1 message (e.g. a withdrawal) or push an invalid L2→L1 message (e.g. an invalid withdrawal) with a <7d exit window.

**Guidelines**

- Met: The proof system meets the minimum trusted setup requirements defined in the L2BEAT [trusted setup assessment framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381).
- Met: Prover source code is published.
- Met: Onchain verifiers' smart contracts can be independently regenerated from the verifier source code.
- Issue: Users' withdrawals can be censored by the permissioned operators.
- Issue: Upgrades executed by actors with more centralized control than a Security Council provide less than 7d for users to exit if the permissioned operator is down or censoring.
- Issue: The Security Council is not properly set up.

### Stage 2

2 issues need fixing.

- Issue: Upgrades unrelated to onchain provable bugs provide less than 30d to exit.
- Issue: The Security Council's actions are not confined to onchain provable bugs.

[Learn more about Stages](https://l2beat.com/stages).

Please keep in mind that these stages do not reflect project security, this is an opinionated assessment of project maturity based on subjective criteria, created with a goal of incentivizing projects to push toward better decentralization. Each team may have taken different paths to achieve this goal.

## Data availability

### Data published onchain

Account delta data is published onchain as blobs. A prover migration (gnark/MIMC → plonky2/Poseidon2) at block 23,711,820 left pre-migration blobs undecodable, but Lighter published a full state snapshot at batch #166859 (blobs.zip) that closes the gap. L2BEAT reproduced the snapshot state root from blobs and verified the roll-forward to chain head, confirming the live state is reconstructable from L1.

**References**

- [Lighter Prover v0.0.1 (first public release, Dec 2025)](https://github.com/elliottech/lighter-prover)
- [StateRootUpdate event — gnark to plonky2 migration](https://etherscan.io/tx/0x6a50b2b00444914e5c53df2fb48404078a098f93fc3911e6fcbde1c7b6418225)
- [Desert exit circuit + state snapshot (blobs.zip)](https://github.com/elliottech/lighter-prover/tree/main/desertexit)

Learn more about the DA layer here: [Ethereum](https://l2beat.com/projects/ethereum)

## State validation

Each update to the system state must be accompanied by a ZK proof that ensures that the new state was derived by correctly applying a series of valid transactions to the previous state. This includes user transactions originating from L1 and L2, as well as internal transactions created by L2 operators. In the desert mode, valid proofs of exit must be generated. These proofs are then verified on Ethereum by a smart contract.

### Prover Architecture

[This repo](https://github.com/elliottech/lighter-prover/tree/main) contains the circuits and prover code for both normal and desert operation mode of Lighter. It includes the logic to generate and verify proofs of valid state transition according to the Lighter [matching engine](https://github.com/elliottech/lighter-prover/blob/d0ff2304aea516b22f3a5223881006b6a9af1cc9/circuit/src/matching_engine.rs).

### ZK Circuits

Lighter transition is proven with custom Plonky2 circuits, compiled into ZK Lighter Verifier and Desert Verifier. ZK Lighter verifier implements the perp DEX and spot trading logic and could be found in this [prover repo](https://github.com/elliottech/lighter-prover/tree/main/circuit/src). Desert verifier consists of circuits proving valid L2 -> L1 withdrawals in the desert mode. More details in [ZK Catalog](https://l2beat.com/zk-catalog/lighterprover#proof-system).

### Verification Keys Generation

Lighter wraps its validity proof into a Plonk-based proof system which requires a trusted setup. The verification keys are hardcoded in the verifier contract on-chain. Lighter prover repo contains a [script](https://github.com/elliottech/lighter-prover/blob/main/build_circuits.sh) that regenerates circuits and verification keys.

**References**

- [ZK Lighter verifier verification keys](https://etherscan.io/address/0xE586511973e02b5A3bB9e4290adc4F406Aa8f463#code#F1#L54)
- [Desert verifier verification keys](https://etherscan.io/address/0x866418061d4C1168e1c8E8f6facE79675395E008#code#F1#L55)

### Prover: [Lighter](https://l2beat.com/zk-catalog/lighterprover)

#### Trusted setups

- Gnark (Plonk):
  - Aztec Ignition, risk green (lowest risk) per the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381): Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.
  - Onchain verifiers: [ZkLighterVerifier](https://etherscan.io/address/0xE586511973e02b5A3bB9e4290adc4F406Aa8f463#code) (1 successful (verified by [L2BEAT](https://l2beat.com))), [DesertVerifier](https://etherscan.io/address/0x866418061d4C1168e1c8E8f6facE79675395E008#code) (1 successful (verified by [L2BEAT](https://l2beat.com)))
  - Used in: [Lighter](https://l2beat.com/layer2s/projects/lighter)
  - Verifiers: 2 successful (verified by [L2BEAT](https://l2beat.com))

## Upgrades & Governance

Regular upgrades are initiated by the "network governor" and executed with a 21d delay. The "security council" is allowed to reduce the upgrade delay to zero in case of an emergency. The security council does not currently satisfy the Stage 1 requirements. The network governor also retains the ability to add or remove validators, as well as set Pause and Emergency Guardians that temporarily halt batch processing and withdrawals.

## Ossification & Updates

Each date links the update on the HTML page, which also shows its contract diffs.

### [2026-10-13 13:15 UTC](https://l2beat.com/layer2s/projects/lighter?update=eff7f903) (high severity, 6 changes)

New verifier deployed. The verifier is regenerated from sources.

### [2026-10-02 13:23 UTC](https://l2beat.com/layer2s/projects/lighter?update=104a582f) (high severity, 60 changes)

Governance has added a pause guardian and emergency guardian logic. Both could pause batch commit/verify/execute and withdrawals (Pause Guardian for 2h-24h with 24h cooldown, Emergency Guardian for 24h-72h with 7d cooldown). They are currently set to 0x adderess. Governor could always lift the pause.

New verifier deployed (no sources published yet).

### [2026-09-28 13:09 UTC](https://l2beat.com/layer2s/projects/lighter?update=16a37b66) (high severity, 11 changes)

New verifier deployed, successfully reproduced from sources.

### [2026-09-15 09:31 UTC](https://l2beat.com/layer2s/projects/lighter?update=f3073dbb) (high severity, 17 changes)

New verifier deployed (no sources published yet). Upgraded the main contract: https://disco.l2beat.com/diff/eth:0x8D692294a4824d868e35B3CEcd734aCf41B2342e/eth:0xb9B30C7Ac4eCBf756bc68D7b12c842E415A9cA8e. Added functionality to conveniently change pubkey for master account, minor refactoring.

### [2026-09-10 12:07 UTC](https://l2beat.com/layer2s/projects/lighter?update=21a86659) (high severity, 6 changes)

New verifier deployed (no sources published yet).

### [2026-09-03 10:44 UTC](https://l2beat.com/layer2s/projects/lighter?update=319f3083) (high severity, 9 changes)

New verifier deployed (no sources published yet). Also, 7702 EOA delegation.

### [2026-08-26 09:55 UTC](https://l2beat.com/layer2s/projects/lighter?update=eb7b4d0f) (high severity, 6 changes)

New verifier deployed (no sources published yet).

### [2026-08-24 11:17 UTC](https://l2beat.com/layer2s/projects/lighter?update=2a4ae025) (high severity, 6 changes)

New verifier deployed (no sources published yet).

### [2026-08-20 12:56 UTC](https://l2beat.com/layer2s/projects/lighter?update=4b712872) (3 changes)

Registered 3 new tokens: tether gold, S&P 500 tracker and QQQ tracker.

### [2026-08-10 11:07 UTC](https://l2beat.com/layer2s/projects/lighter?update=6ca52fb0) (high severity, 15 changes)

Lighter contract upgraded: https://disco.l2beat.com/diff/eth:0xE67606837D3d68a679B25B49b8abE5cB4B0Ae483/eth:0x8D692294a4824d868e35B3CEcd734aCf41B2342e (added `PricedOnly` asset margin mode).

New verifier deployed (not reproduced yet).

### [2026-07-24 09:12 UTC](https://l2beat.com/layer2s/projects/lighter?update=3fce832b) (high severity, 11 changes)

New lighter verifier deployed, regenerated from sources.

### [2026-07-20 10:57 UTC](https://l2beat.com/layer2s/projects/lighter?update=3484e5da) (high severity, 18 changes)

Upgraded zk lighter contract (https://disco.l2beat.com/diff/eth:0x22F05515497ce8D78f3898088C474403Ac9C668f/eth:0xaeC5dbA7C62482AAba4D330788366De60db16367). Added `indexPriceDivider` param (idk what it means) and refactored error types in additional ZKLighter contract.

Also upgraded Lighter verifier and Desert verifier, their sources are not published yet.

### [2026-07-13 10:59 UTC](https://l2beat.com/layer2s/projects/lighter?update=22833684) (high severity, 6 changes)

New verifier deployed (no sources published yet).

### [2026-06-04 13:40 UTC](https://l2beat.com/layer2s/projects/lighter?update=a5c2bdc7) (high severity, 11 changes)

New zk lighter verifier deployed, successfully reproduced from sources.

### [2026-05-18 10:47 UTC](https://l2beat.com/layer2s/projects/lighter?update=dccd34b3) (high severity, 19 changes)

Small upgrade of the lighter rollup contract: https://disco.l2beat.com/diff/eth:0x13d4Ed7Db9d2cF73C7A45bfA6e23aa9742e8598C/eth:0xc4F38883af6d07D826A20A581cB21fFc2a58009C, it refactors `performDesert` function.

Also new lighter verifier and desert verifier deployed, succesfully regenerated from the sources.

### [2026-05-12 09:59 UTC](https://l2beat.com/layer2s/projects/lighter?update=4e9b56bc) (high severity, 9 changes)

New verifier deployed (no sources published yet). Also, rotated two multisig members for upgrade master MS.

Config: use the new flattener implementation

### [2026-05-04 10:44 UTC](https://l2beat.com/layer2s/projects/lighter?update=121f63dd) (high severity, 6 changes)

New verifier deployed (no sources published yet).

### [2026-04-27 14:04 UTC](https://l2beat.com/layer2s/projects/lighter?update=f0ac0634) (high severity, 17 changes)

Upgraded the main Rollup contract: https://disco.l2beat.com/diff/eth:0xE315CbEDc21c5beC186bF478D899e91A604a6bC8/eth:0x13d4Ed7Db9d2cF73C7A45bfA6e23aa9742e8598C. Main changes:

- Removed events when creating or updating assets on L2, so this data is removed from disco.
- Expanded registerAsset with new parameters `_priceDecimals`, `loanToValue`, `liquidationThreshold`, `liquidationFactor`, and `liquidationFee` to move to a more collateral-oriented design.
- Some code refactor like additional sanity checks on pubkey and moving asset validation logic into a separate function.

Also upgraded the verifier, sources are not published.

### [2026-04-20 15:08 UTC](https://l2beat.com/layer2s/projects/lighter?update=5b795ab3) (high severity, 6 changes)

New verifier deployed (no sources published yet).

### [2026-04-14 11:29 UTC](https://l2beat.com/layer2s/projects/lighter?update=813318ec) (high severity, 6 changes)

New verifier deployed (no sources published yet).

### [2026-03-30 14:34 UTC](https://l2beat.com/layer2s/projects/lighter?update=83b66f4d) (high severity, 6 changes)

Lighter verifier upgraded.

### [2026-03-12 09:28 UTC](https://l2beat.com/layer2s/projects/lighter?update=0aafdc95) (high severity, 6 changes)

Upgraded Lighter verifier, sources are still not published.

### [2026-03-09 12:08 UTC](https://l2beat.com/layer2s/projects/lighter?update=65748edf) (high severity, 15 changes)

Refactored taker and maker fee handling on the rollup contract: diff on ZkLighter https://disco.l2beat.com/diff/eth:0xdC2877f6C162991B47fC5f7Cc50F85c084B9B408/eth:0xE315CbEDc21c5beC186bF478D899e91A604a6bC8, diff on AdditionalZkLighter: https://disco.l2beat.com/diff/eth:0xF7627A2ab5cD6a5Cdbb84ffa96afE21A136B05d9/eth:0x84E480C589e715D0CE7de004b1EEA69f8D714936.

Updated the verifier, sources are not yet published.

### [2026-02-23 12:36 UTC](https://l2beat.com/layer2s/projects/lighter?update=42874125) (high severity, 6 changes)

Updated zk verifier. The changes are in this commit: https://github.com/elliottech/lighter-prover/commit/dd7d2182f7d9ec29ca452f410a5ffb1f3dc13925.

### [2026-02-17 13:59 UTC](https://l2beat.com/layer2s/projects/lighter?update=9e8022b3) (high severity, 11 changes)

Updated ZK circuits and verifier. Main rollup contract has only 1 line diff in init params commitment:
https://disco.l2beat.com/diff/eth:0x803bd6a0577c083c1EDe82Da455C8e69e697c878/eth:0xdC2877f6C162991B47fC5f7Cc50F85c084B9B408.

ZkLighterVerifier updated with new verification keys (VK_QL_COM and VK_QK_COM):
https://disco.l2beat.com/diff/eth:0xC5d17b2ae295F81209410B00a791720660efc706/eth:0xae6961882D8Ad8d1d6840228CCca471ffffd5EA5.

### [2026-02-13 09:45 UTC](https://l2beat.com/layer2s/projects/lighter?update=ed521fe8) (high severity, 13 changes)

Upgraded zk circuits and the verifier, probably to allow unified collateral for spot and perps: https://x.com/Lighter_xyz/status/2022098082419085536. Main rollup contract has only 1 line diff in init params commitment:
https://disco.l2beat.com/diff/eth:0x8bdccd961Ae8b8B99dBA5FbAd0e5AA92bE8c59Fb/eth:0x803bd6a0577c083c1EDe82Da455C8e69e697c878. Also added AZTEC token for spot and perps.

### [2026-01-29 14:00 UTC](https://l2beat.com/layer2s/projects/lighter?update=a3678747) (high severity, 17 changes)

Diff for Lighter implementation: https://disco.l2beat.com/diff/eth:0xe5FB592Ef1b620909000Af0D5fb55a3593026142/eth:0x8bdccd961Ae8b8B99dBA5FbAd0e5AA92bE8c59Fb, diff for additional lighter implementation: https://disco.l2beat.com/diff/eth:0x9307350AF47B0C0e7f8cA5ED2D57993aF3a6df1d/eth:0xF7627A2ab5cD6a5Cdbb84ffa96afE21A136B05d9.

Refactored some events, added only governance function `setSystemConfig` to set liquidityPoolCooldownPeriod and / or stakingPoolLockupPeriod.

Updated circuits and upgraded the verifier.

### [2026-01-21 10:48 UTC](https://l2beat.com/layer2s/projects/lighter?update=13a4c4d4) (high severity, 6 changes)

Upgraded Lighter verifier.

### [2026-01-12 11:19 UTC](https://l2beat.com/layer2s/projects/lighter?update=9519397f) (high severity, 6 changes)

ZkLighterVerifier implementation upgraded. Sources have not been published yet.

### [2026-01-08 09:31 UTC](https://l2beat.com/layer2s/projects/lighter?update=ad5653e7) (14 changes)

Added two new EOAs to the network governor multisig (2/3 -> 3/5). Also registered LINK, UNI, AAVE, SKY, LDO l2 assets.

### [2026-01-06 09:21 UTC](https://l2beat.com/layer2s/projects/lighter?update=1e1f3162) (high severity, 15 changes)

Added Lighter token market. Changed insurance fund operator to a 3/5 multisig. Updated verifier, probably this PR: https://github.com/elliottech/lighter-prover/pull/2.

### [2025-12-22 13:11 UTC](https://l2beat.com/layer2s/projects/lighter?update=5cec5eae) (high severity, 15 changes)

permissioned actors change (EOA to 2/3 Multisig).

### [2025-12-10 15:29 UTC](https://l2beat.com/layer2s/projects/lighter?update=196b1d79) (high severity, 40 changes)

Added spot markets, and to do this, the ability to deposit other assets other than USDC. Many functions have been modified to support depositing and withdrawing multiple tokens. There are token specific configs that control various aspects of the flow, such as whether withdrawals are enabled. For some reason the token config is actually split between a part that is saved on L1 and one that is updated by sending a message on L2.
- [ZKLighter diff](https://disco.l2beat.com/diff/eth:0x59e71dc90E662F17c4eB156A8cA1BCCD106aCfA0/eth:0xe5FB592Ef1b620909000Af0D5fb55a3593026142)
- [AdditionalZKLighter diff](https://disco.l2beat.com/diff/eth:0xf255FC8738a5c6Ee6E869A5b182a9Cd4F99a2ED6/eth:0x9307350AF47B0C0e7f8cA5ED2D57993aF3a6df1d)
Verifiers have also been updated.

### [2025-11-26 13:55 UTC](https://l2beat.com/layer2s/projects/lighter?update=3c7e3375) (2 changes)

new markets.

### [2025-11-24 11:37 UTC](https://l2beat.com/layer2s/projects/lighter?update=9c40da00) (6 changes)

new markets!

### [2025-11-03 19:00 UTC](https://l2beat.com/layer2s/projects/lighter?update=42d84a81) (12 changes)

As per tg, added a "quote multiplier" to the state through the state upgrade verifier.

### [2025-10-27 18:36 UTC](https://l2beat.com/layer2s/projects/lighter?update=5517b089) (high severity, 15 changes)

- [Lighter](https://disco.l2beat.com/diff/eth:0x1D2624A65F8aaD1c4Bc406b4D2418ba577D218cb/eth:0x4FF23C6cA650166A95D854935a8b012B53ac59Bc): forced txs delay reduced from 18 days to 14 days.
- [AdditionalZKLighter](https://disco.l2beat.com/diff/eth:0x4194D3847a0239d59a87bC82C1870CBE1FA99db1/eth:0xf255FC8738a5c6Ee6E869A5b182a9Cd4F99a2ED6): same as above + small gas optimization.

Moreover the desert verifier is now verified on etherscan.

### [2025-10-23 12:48 UTC](https://l2beat.com/layer2s/projects/lighter?update=d3fcf233) (3 changes)

new markets.

### [2025-10-08 14:17 UTC](https://l2beat.com/layer2s/projects/lighter?update=c03902a6) (6 changes)

Discovery rerun on the same block number with only config-related changes.

## Operator

### Centralized operators

Only the centralized operators can submit batches and verify them with a ZK proof, i.e. advance the state of the protocol.

**Risks**

- MEV can be extracted if the operator exploits their centralized position and frontruns user transactions.

### Users can force their transactions on L1

If the centralized operators fail to include user transactions, users can force them themselves through L1. The possible transaction types that users can force are: deposits, withdrawals, order creation, order cancellation, and burning of pool shares. If the operators do not process forced transactions within 14d, the system can be frozen (desert mode) and users can exit using the latest settled state. All open positions are settled using the latest index price.

## Withdrawals

### Regular exit

The user initiates the withdrawal by submitting a regular transaction on this chain. When the block containing that transaction is settled the funds become available for withdrawal on L1. ZK proofs are required to settle blocks. Finally the user submits an L1 transaction to claim the funds.

**Risks**

- Funds can be frozen if the Pause Guardian or the Emergency Guardian pause the system. A pause halts batch processing and withdrawals for up to 24h or 72h respectively, but does not block desert mode.

### Escape hatch through ZK proofs

If the centralized operators fail to process forced transactions after the deadline, the system can be frozen (desert mode) and users are expected to exit by reconstructing the latest settled state and providing a ZK proof of balance. The desert exit circuit and a full state snapshot at batch #166859 are public, and the deployed DesertVerifier matches a rebuild from that circuit. L2BEAT reproduced the snapshot state root from L1 blobs and verified the roll-forward to chain head.

**References**

- [Desert exit circuit + state snapshot](https://github.com/elliottech/lighter-prover/tree/main/desertexit)

## Other considerations

### External oracles used for index prices

Lighter uses a combination of oracles to determine index prices, with Stork as the primary source. External signatures are currently not verified and the sequencer must be trusted to truthfully report data.

**Risks**

- Funds can be lost if the oracle prices are manipulated.

**References**

- [Lighter docs - Fair Price Marking](https://docs.lighter.xyz/perpetual-futures/fair-price-marking)

## Permissions

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/lighter

### Ethereum

#### Actors

##### Lighter Multisig

Addresses: [0x92b12c9d85BF7bd2EF5d2F53F4cd4Ce0BE432045](https://etherscan.io/address/0x92b12c9d85BF7bd2EF5d2F53F4cd4Ce0BE432045)

A Multisig with 4/7 threshold.
- Can interact with UpgradeGatekeeper
  - can reduce the upgrade delay to zero seconds

Participants (7): [0xD80037fade5d25b9c8B23e5c43bB0577C165Dcf9](https://etherscan.io/address/0xD80037fade5d25b9c8B23e5c43bB0577C165Dcf9), [0xb08564C7fc68C3Ab1cD81300C8Ad150e04411F85](https://etherscan.io/address/0xb08564C7fc68C3Ab1cD81300C8Ad150e04411F85), [0xEc589ee2DF6dd2E7e0873F229d18e024B97d0FA6](https://etherscan.io/address/0xEc589ee2DF6dd2E7e0873F229d18e024B97d0FA6), [0x57ccC925f54aC946C3423808929fE77265c9045d](https://etherscan.io/address/0x57ccC925f54aC946C3423808929fE77265c9045d), [0x0bF05AA3b821Eaa341fAD0a674081A02d3dB169D](https://etherscan.io/address/0x0bF05AA3b821Eaa341fAD0a674081A02d3dB169D), [0x8B0190046D7b366642D4ff091C100d84ec4AB6f6](https://etherscan.io/address/0x8B0190046D7b366642D4ff091C100d84ec4AB6f6), [0x06eD0b0bD3A9e0C517B6cD7C8B851Cc1e8e1a90A](https://etherscan.io/address/0x06eD0b0bD3A9e0C517B6cD7C8B851Cc1e8e1a90A)

##### Lighter Multisig 2

Addresses: [0x97A90Ec950B6BCd9B190b566525B2Bb92A2C03a2](https://etherscan.io/address/0x97A90Ec950B6BCd9B190b566525B2Bb92A2C03a2)

A Multisig with 3/5 threshold.
- Can upgrade **with 21d delay**
  - Lighter [via: UpgradeGatekeeper with 21d delay]
  - Governance [via: UpgradeGatekeeper with 21d delay]
  - ZkLighterVerifier [via: UpgradeGatekeeper with 21d delay]
- Can interact with Governance
  - manage validators, update the address that manages the insurance fund, update the treasury address that collects fees from markets, add and update markets and assets, appoint the Pause and Emergency Guardians and lift their pauses early

Participants (5): [0x2994d343b6b17EC23E9E4a08082184Fd43F763a3](https://etherscan.io/address/0x2994d343b6b17EC23E9E4a08082184Fd43F763a3), [0x67d6c2569AB98A1F535E36b3BaB1FBD825fa536E](https://etherscan.io/address/0x67d6c2569AB98A1F535E36b3BaB1FBD825fa536E), [0xa0B3781B830DF57B1f018C434c58551c2Fc6b3Af](https://etherscan.io/address/0xa0B3781B830DF57B1f018C434c58551c2Fc6b3Af), [0x6FEe6cdD595D12Ec6cD1803474B3615f1D2fb9ed](https://etherscan.io/address/0x6FEe6cdD595D12Ec6cD1803474B3615f1D2fb9ed), [0xF65F409d8f3fa3635287783256394D7eB7aD7835](https://etherscan.io/address/0xF65F409d8f3fa3635287783256394D7eB7aD7835)

##### Safe (0x3dD7…4daE)

Addresses: [0x3dD7c834EAa70c98e1C224808a3c62163b344daE](https://etherscan.io/address/0x3dD7c834EAa70c98e1C224808a3c62163b344daE)

A Multisig with 2/3 threshold.

Participants (3): [0x6160aa8A4CFF0A56816855FE25454698AE2aF99E](https://etherscan.io/address/0x6160aa8A4CFF0A56816855FE25454698AE2aF99E), [0x6FEe6cdD595D12Ec6cD1803474B3615f1D2fb9ed](https://etherscan.io/address/0x6FEe6cdD595D12Ec6cD1803474B3615f1D2fb9ed), [0xAeD34Fa09DCdd340f81991FfDa368F21e79922D0](https://etherscan.io/address/0xAeD34Fa09DCdd340f81991FfDa368F21e79922D0)

##### Safe (0x9ccE…7310)

Addresses: [0x9ccE444F8c60BD570986cd7D0ED7aEc29f127310](https://etherscan.io/address/0x9ccE444F8c60BD570986cd7D0ED7aEc29f127310)

A Multisig with 3/5 threshold.

Participants (5): [0xfDb36C132fA19f7774d72fA39c89272D1B954A41](https://etherscan.io/address/0xfDb36C132fA19f7774d72fA39c89272D1B954A41), [0x8D92A471576577Cda70097154753F0d7f973507f](https://etherscan.io/address/0x8D92A471576577Cda70097154753F0d7f973507f), [0xDe81D3EC2B4F0736F23409Ddac6c095310a46a0E](https://etherscan.io/address/0xDe81D3EC2B4F0736F23409Ddac6c095310a46a0E), [0x6FEe6cdD595D12Ec6cD1803474B3615f1D2fb9ed](https://etherscan.io/address/0x6FEe6cdD595D12Ec6cD1803474B3615f1D2fb9ed), [0xf711cFb0368a62ec06A0cfD1880e9AD5d9FEA23a](https://etherscan.io/address/0xf711cFb0368a62ec06A0cfD1880e9AD5d9FEA23a)

##### 3 EOAs

Addresses: [0x191fF0EC830F83916A427d169a234c33e48aA79f](https://etherscan.io/address/0x191fF0EC830F83916A427d169a234c33e48aA79f) (EOA 1), [0x750bdb90AC72A78308d21eAC78999bBAE31cd63d](https://etherscan.io/address/0x750bdb90AC72A78308d21eAC78999bBAE31cd63d) (EOA 2), [0xC0D2853e06F1E145177D5ef08Ab065a76e14354C](https://etherscan.io/address/0xC0D2853e06F1E145177D5ef08Ab065a76e14354C) (EOA 3)

- Can interact with Governance
  - can commit, verify, execute batches, and revert committed but not yet executed batches

## Smart contracts

**Note:** Contracts presented in this section had their implementations updated since the last time our team looked at this project. The information presented may be inaccurate.

![A diagram of the smart contract architecture](https://l2beat.com/static/images/architecture/lighter.d5220ac1.png)

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/lighter

### Ethereum

#### Lighter (escrow)

Addresses: [0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7](https://etherscan.io/address/0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7#code), [0xE16c893252616dD49913969f145e733b96a3E5A7](https://etherscan.io/address/0xE16c893252616dD49913969f145e733b96a3E5A7#code) (Implementation #1 (Upgradable)), [0xE1A19e35320218E41526ad619cf55985cfF20810](https://etherscan.io/address/0xE1A19e35320218E41526ad619cf55985cfF20810#code) (Implementation #2 (Upgradable)), [0x94da8A995D0D82Ef0fE7E509C6D76c22603B6f67](https://etherscan.io/address/0x94da8A995D0D82Ef0fE7E509C6D76c22603B6f67#code) (Admin)

The main rollup contract. It processes L2 batches, manages token deposits and withdrawals, allows users to submit censorship-resistant L2 transactions and controls desert mode (escape hatch). Logic is split between two contracts because of code-size limits, many operations are delegated to AdditionalZKLighter.
- Roles:
  - **admin**: UpgradeGatekeeper; ultimately Lighter Multisig 2

The following tokens are included in the value secured calculation: USDC, ETH, LIT, LINK, AAVE, UNI, SKY, LDO, AZTEC

Can be upgraded by: Lighter Multisig 2 with 21d delay

#### DesertVerifier

Addresses: [0x866418061d4C1168e1c8E8f6facE79675395E008](https://etherscan.io/address/0x866418061d4C1168e1c8E8f6facE79675395E008#code)

Verifies the zk proofs that let users exit their funds directly on L1 while the system is in desert mode (escape hatch).

#### UpgradeGatekeeper

Addresses: [0x94da8A995D0D82Ef0fE7E509C6D76c22603B6f67](https://etherscan.io/address/0x94da8A995D0D82Ef0fE7E509C6D76c22603B6f67#code)

Governance contract functioning like an upgrade timelock for downstream contracts. The current delay is 21d and can be entirely skipped by Lighter Multisig. In practice every upgrade so far has been fast-tracked: the security council zeroes the notice period right before each upgrade is finished.
- Roles:
  - **getMaster**: Lighter Multisig 2
  - **securityCouncilAddress**: Lighter Multisig

#### ZkLighterVerifier

Addresses: [0xac3Ce44B6ff4E402858C99D5699ff63131572BaA](https://etherscan.io/address/0xac3Ce44B6ff4E402858C99D5699ff63131572BaA#code), [0xE586511973e02b5A3bB9e4290adc4F406Aa8f463](https://etherscan.io/address/0xE586511973e02b5A3bB9e4290adc4F406Aa8f463#code) (Implementation (Upgradable)), [0x94da8A995D0D82Ef0fE7E509C6D76c22603B6f67](https://etherscan.io/address/0x94da8A995D0D82Ef0fE7E509C6D76c22603B6f67#code) (Admin)

The main ZK verifier of Lighter, settles the proofs of correct L2 state transition in the case of normal rollup operation.
- Roles:
  - **admin**: UpgradeGatekeeper; ultimately Lighter Multisig 2

Can be upgraded by: Lighter Multisig 2 with 21d delay

**Warning:** There are impactful changes to the following contracts, and part of the information might be outdated.

#### Governance (impactful change)

Addresses: [0xa464DA0B43f80EE3FfC4795cbbFC78472b5c81A1](https://etherscan.io/address/0xa464DA0B43f80EE3FfC4795cbbFC78472b5c81A1#code), [0xE935fa009Ae2F913A26B4411a901ECF6dBAb6D43](https://etherscan.io/address/0xE935fa009Ae2F913A26B4411a901ECF6dBAb6D43#code) (Implementation (Upgradable)), [0x94da8A995D0D82Ef0fE7E509C6D76c22603B6f67](https://etherscan.io/address/0x94da8A995D0D82Ef0fE7E509C6D76c22603B6f67#code) (Admin)

Manages the list of validators, the network governor and the emergency pause guardians.
- Roles:
  - **admin**: UpgradeGatekeeper; ultimately Lighter Multisig 2
  - **networkGovernor**: Lighter Multisig 2
  - **validators**: EOA 1, EOA 2, EOA 3

Can be upgraded by: Lighter Multisig 2 with 21d delay

The current deployment carries some associated risks:

- Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).