## 2. Proof system Research date: 2026-10-27. These findings concern Lighter Core on Ethereum. Code findings below refer to the project's published source at the linked commit; they are not an independent verification that this revision is deployed on mainnet. - **Validity/ZK proofs:** Lighter describes itself as a zero-knowledge rollup on Ethereum, generating proofs for all operations, including order matching and liquidations, and verifying them publicly on Ethereum. [Project website](https://lighter.xyz/). - **Prover and proof system:** The whitepaper describes an application-specific SNARK prover with custom arithmetic circuits and layered aggregation; the final batch proof is wrapped in a PLONK proof for Ethereum verification (§§2.4, 5). [Whitepaper](https://assets.lighter.xyz/whitepaper.pdf). - **Verifier code:** `ZkLighterVerifier.sol` identifies itself as generated by gnark, with modifications by Elliot Technologies, and as an upgradeable batch verifier. [Verifier source](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighterVerifier.sol#L17-L33). - **Permissioned proposals and proof submission:** Both `commitBatch` and `verifyBatch` call `_requireActiveValidator()`, which checks `governance.isActiveValidator(msg.sender)`. `verifyBatch` requires a previously committed batch and a successful `verifier.Verify` call. Thus the published normal-operation implementation does not allow arbitrary users to propose batches/state roots or submit batch proofs. [Batch contract, commitment](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L438-L447), [proof submission](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L523-L558), [validator check](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L895-L898). - **Who controls that permission:** `Governance.setValidator(address,bool)` is governor-only; `isActiveValidator` rejects addresses absent from the active-validator mapping. Public prover source does not itself remove this submission restriction. [Governance source](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/Governance.sol#L96-L112). - **Finality:** Core documentation calls the Sequencer's confirmation soft finality and says the Ethereum contracts update exchange state once the proposal's proof is verified. The inspected `verifyBatch` performs proof verification without a fraud-challenge waiting period. A numerical proof-generation/proof-finality time and a proof mainnet activation date are **NOT FOUND**. [Core architecture](https://docs.lighter.xyz/about-lighter/technical-architecture-lighter-core), [verification code](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L523-L558). - **Separate EVM design, not evidence of live Core permissionless proving:** EVM architecture describes OpenVM EVM/aggregation circuits and says that in desert mode anyone can advance the EVM chain with one batch proof at a time. However, the EVM introduction explicitly identifies the current environment as a devnet using a private L1 and mocked ZK proofs, with the permissionless escape hatch not fully functional. These statements must be read together. [EVM architecture](https://docs.lighter.xyz/evm/technical-architecture.md), [EVM introduction and limitations](https://docs.lighter.xyz/evm/readme.md). ## 3. Exit window and upgrades - **Governance body:** The priority-transactions documentation calls the governor a multisig controlled by the protocol, responsible for administrative functions managing markets and protocol settings. It gives no signer threshold there. [Priority Transactions](https://docs.lighter.xyz/developers/reference/priority-transactions.md). - **Upgrade authority in code:** `DeployFactory` transfers mastership of the governance, verifier and ZkLighter proxies to `UpgradeGatekeeper`, then transfers the gatekeeper's mastership to the supplied governor. `startUpgrade`, `startPreparation` and `finishUpgrade` require the gatekeeper master. Thus this factory's upgrade path is controlled by the governor through the gatekeeper. [Deployment factory](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/DeployFactory.sol#L87-L108), [UpgradeGatekeeper](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/proxy/UpgradeGatekeeper.sol#L58-L122). - **Default notice/exit window: 21 days, reducible to zero.** `UpgradeableMaster` sets `UPGRADE_NOTICE_PERIOD = 3 weeks`; its comments say this is intended to let users withdraw before a malicious upgrade. Preparation requires the upgrade start timestamp plus the approved notice period to have elapsed. But `cutUpgradeNoticePeriod` allows `securityCouncilAddress` to set the approved period to zero for an active upgrade. Accordingly, the source provides a default exit opportunity, not an unconditional 21-day minimum: the council can eliminate the delay. [UpgradeableMaster](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/UpgradeableMaster.sol#L13-L97). - **Security council representation:** The contract stores one immutable `securityCouncilAddress`; its comment says that address could itself be a multisignature wallet. It does not encode a council membership list or an M-of-N threshold. The identities and thresholds of the deployed governor/council are **NOT FOUND** in the inspected project documentation/source. [Council representation](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/UpgradeableMaster.sol#L32-L44), [deployment parameters](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/DeployFactory.sol#L23-L32). - **Escape-hatch protection:** `isReadyForUpgrade()` returns false when ZkLighter is in desert mode, and `finishUpgrade` requires readiness. [Readiness check](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/UpgradeableMaster.sol#L79-L83), [upgrade completion](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/proxy/UpgradeGatekeeper.sol#L101-L114). ## 4. Data availability - **Ethereum blobs:** Core documentation says state-update proposals carry data blobs containing state-transition details; compressed state data is published directly to Ethereum without relying on third parties. [Core architecture](https://docs.lighter.xyz/about-lighter/technical-architecture-lighter-core). - **What is actually published:** The whitepaper calls this hybrid data availability: only the minimum data needed for secure exits is posted, omitting redundant details. Aggregated account-value changes and market data go into Ethereum blobs; this is not a claim that every order/transaction is published in full (§2.1). [Whitepaper](https://assets.lighter.xyz/whitepaper.pdf). - **Code corroboration:** `commitBatch` accepts only `PubDataMode.Blob`; `_processBlobs` reads `blobhash(i)` and verifies blob commitments. `Config` explicitly identifies the blob point-evaluation precompile as EIP-4844. The inspected batch path does not offer calldata as an alternative DA mode. [Blob-only commitment path](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L438-L447), [blob processing](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L900-L935), [EIP-4844 configuration](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/Config.sol). - **Independent code detail:** The prover repository documents the blob schema, including market prices, funding values and compressed account deltas. A named external DA network/committee for this exit data is **NOT FOUND**; the documented location is Ethereum. [Blob schema](https://github.com/elliottech/lighter-prover/blob/16c0f36d75f2306ee242e26e507e4c237f7f4074/desertexit/README.md), [Core architecture](https://docs.lighter.xyz/about-lighter/technical-architecture-lighter-core). ## 5. Sequencer and forced inclusion - **Sequencing architecture:** The Core documentation describes a Sequencer coordinating FIFO transaction ordering and providing soft finality. The published contract restricts batch commitment to approved validators rather than providing open proposer participation. The inspected sources do not name the current sequencer operating entity, enumerate operators, or document a live decentralized sequencer selection mechanism; those details are **NOT FOUND**. [Core architecture](https://docs.lighter.xyz/about-lighter/technical-architecture-lighter-core), [commit restriction](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L438-L440), [validator administration](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/Governance.sol#L96-L112). - **L1 censorship-resistance path exists:** The project directs users to its Ethereum proxy, `0x3B4D794a66304F130a4Db8F2551B0070dfCf5ca7`, for priority operations even when its API is unavailable. It lists `withdraw`, `cancelAllOrders`, `burnShares` and `createOrder` (described as reduce-only IOC orders), among other functions. [Priority Transactions](https://docs.lighter.xyz/developers/reference/priority-transactions.md). - **Contract implementation:** `ZkLighter.withdraw` and `cancelAllOrders` delegate to `AdditionalZkLighter`; that implementation adds requests to the priority queue. `addPriorityRequest` records expiration as `block.timestamp + PRIORITY_EXPIRATION`, and `Config` fixes `PRIORITY_EXPIRATION` at **14 days**. This is the queue-expiry/escape-hatch threshold, not a guarantee that a censored trade will execute after 14 days. [Proxy-facing operations](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L310-L323), [queueing withdrawal/cancellation](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/AdditionalZkLighter.sol#L487-L533), [expiration calculation](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/AdditionalZkLighter.sol#L650-L670), [14-day constant](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/Config.sol). - **If the operator still refuses:** Anyone can call `activateDesertMode()` once the oldest outstanding request has expired; that function has no validator/governor gate. `performDesert` then verifies an ownership/exit proof and credits a withdrawable balance. [Activation](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L793-L807), [desert exit](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L346-L381). - **Documentation/code qualification:** Core documentation says missed requests automatically trigger the escape hatch. The inspected implementation instead exposes `activateDesertMode()` as a transaction someone must call; passage of time alone does not run that function. [Core escape-hatch description](https://docs.lighter.xyz/about-lighter/technical-architecture-lighter-core), [activation implementation](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L793-L807). - **Order-path wording differs:** The priority-transactions guide describes `createOrder` as reduce-only IOC submission, while the inspected implementation accepts `LimitOrder` or `MarketOrder` enum values at its L1 entry point. These are the respective documented/code interfaces; this review does not establish how their semantics map in the execution circuits. [Guide](https://docs.lighter.xyz/developers/reference/priority-transactions.md), [order implementation](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/AdditionalZkLighter.sol#L535-L581). ## 1. Stage - **Project statement of L2BEAT stage: NOT FOUND.** No stage number or dated stage transition was found in the inspected project introduction, Core architecture, whitepaper or repository README files. [Introduction](https://docs.lighter.xyz/), [Core architecture](https://docs.lighter.xyz/about-lighter/technical-architecture-lighter-core), [whitepaper](https://assets.lighter.xyz/whitepaper.pdf), [contracts README](https://github.com/elliottech/lighter-contracts), [prover README](https://github.com/elliottech/lighter-prover). - **Decentralization-related direction:** The whitepaper says separating transaction ordering from proven execution makes parts of sequencing easier to decentralize; future work includes fair sequencing, transaction encryption and pre-commitment schemes (§§2.3, 8). It supplies no stage-transition schedule. [Whitepaper](https://assets.lighter.xyz/whitepaper.pdf). - **Concrete development limitation:** The EVM documentation describes permissionless proving after desert-mode activation, but the current devnet uses mocked proofs and its permissionless escape hatch is not fully functional. This does not establish a mainnet decentralization milestone or L2BEAT stage change. [EVM architecture](https://docs.lighter.xyz/evm/technical-architecture.md), [devnet limitations](https://docs.lighter.xyz/evm/readme.md). ## Not found - **Numerical Core proof finality/proving latency; exact mainnet proof activation date; an optimistic challenge-period parameter:** NOT FOUND in the inspected [Core architecture](https://docs.lighter.xyz/about-lighter/technical-architecture-lighter-core), [whitepaper](https://assets.lighter.xyz/whitepaper.pdf), [website](https://lighter.xyz/) or [verification implementation](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L523-L558). The described mechanism is validity verification, not a documented fraud-proof challenge process. The [FAQ page](https://lighter.xyz/faq) was also tried; its retrieved text exposed question titles but no answers. - **Governor multisig threshold/signers; council membership and threshold; deployed council/governor identification; current approved upgrade delay and an unconditional mainnet exit window:** NOT FOUND in [Priority Transactions](https://docs.lighter.xyz/developers/reference/priority-transactions.md), [UpgradeableMaster](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/UpgradeableMaster.sol), [DeployFactory](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/DeployFactory.sol) or the [security documentation](https://docs.lighter.xyz/security/security-audits). A constructor-supplied address and a default source-code constant do not identify deployed ownership or current settings. - **Sequencer's named operator, current operator count and live decentralized selection process:** NOT FOUND in [Core architecture](https://docs.lighter.xyz/about-lighter/technical-architecture-lighter-core), [whitepaper](https://assets.lighter.xyz/whitepaper.pdf) or [Governance source](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/Governance.sol). - **An external DA committee/layer for Core's exit data:** NOT FOUND in [Core architecture](https://docs.lighter.xyz/about-lighter/technical-architecture-lighter-core), [whitepaper](https://assets.lighter.xyz/whitepaper.pdf) or [blob-processing source](https://github.com/elliottech/lighter-contracts/blob/5896c8f1425d56bc96675b76eeb142611ceca9a7/contracts/ZkLighter.sol#L900-L935). The sources instead specify Ethereum blobs, with the whitepaper's hybrid-data qualification above. - **Project-authored L2BEAT stage number, stage rationale, stage change in the last six months, or dated decentralization milestones:** NOT FOUND in the [documentation entry point](https://docs.lighter.xyz/), [documentation index](https://docs.lighter.xyz/llms.txt), [Core architecture](https://docs.lighter.xyz/about-lighter/technical-architecture-lighter-core), [whitepaper](https://assets.lighter.xyz/whitepaper.pdf), [EVM introduction](https://docs.lighter.xyz/evm/readme.md), [EVM architecture](https://docs.lighter.xyz/evm/technical-architecture.md), [LIT Utility](https://docs.lighter.xyz/about-lighter/lit-utility), [contracts repository](https://github.com/elliottech/lighter-contracts) or [prover repository](https://github.com/elliottech/lighter-prover). No stage is inferred from the mechanisms above.