USDT0 Gasolina DVN Review
Offchain signer case study
Overview
In December 2025 Guardian reviewed Gasolina for USDT0. Gasolina is LayerZero's DVN (decentralized verifier network) service: the offchain signer that verifies cross-chain messages and attests to them before they can be delivered. For USDT0, it is part of the path every omnichain transfer of the stablecoin takes.
Guardian
Guardian provides institutional-grade security for digital asset teams, onchain and off. Every engagement runs two independent teams, backed by Helix, Guardian's AI auditor, and only human-verified findings reach the client.
USDT0
USDT0 is the omnichain deployment of Tether's USDT, built on LayerZero's OFT standard and live on more than 25 chains, with over $150B in volume. Guardian has reviewed its contracts, deployments and infrastructure continuously since January 2025.
Why Guardian?
A stablecoin with sound contracts and a compromised verifier is not a secure stablecoin. By December 2025 Guardian had spent a year reviewing the USDT0 contracts and verifying the DVN configuration of each deployment, so the team already knew what Gasolina was attesting to, and what a wrong attestation would cost.
Scope
Two services from Guardian's offchain menu, run together over two weeks:
- Offchain autonomous systems review of Gasolina's signing and verification logic, data handling, key flows and failure modes
- API security review: authentication, access control, data exposure, input validation and business logic across every endpoint
- The deployed container image, reviewed as it runs rather than only as source
How Guardian approached it
- Attack the attestation. The review asked what it would take to make the signer attest to something untrue: spoofed source data, replayed requests, logic bypasses, unsafe fallbacks and inconsistent state transitions.
- Pentest the interface. In parallel, the API was tested the way an outside attacker would approach it, with token abuse, tampering and injection.
- Read it against the configuration it serves. Findings were weighed against USDT0's actual DVN setup, which Guardian had verified chain by chain.
Results
The review returned nine findings, none of them Critical or High. Every finding was resolved or acknowledged, and the fixes were merged upstream into LayerZero's Gasolina codebase rather than patched in a single deployment.
- Critical: 0
- High: 0
- Medium: 1
- Low: 4
- Informational: 4
For a service in this position, a clean result is the point: independent assurance that the verifier guarding USDT0's cross-chain transfers holds up under attack. Finding details remain private.
Impact
- Independent assurance on a signer that sits in the path of every USDT0 cross-chain transfer
- Hardening fixes shipped upstream in the Gasolina codebase itself
- USDT0's security coverage extended from contracts and deployments to the offchain verifier that connects them
Read the full relationship in the USDT0 client story.
Running signers, verifiers or relayers? Guardian reviews them as autonomous systems, from the source.