Automation

Lit Protocol vs OpenZeppelin

Run automated jobs without hosting the signer.

Compare who runs the scheduler and signer, where the key lives, and who can change an automated job.

By Lit Protocol · Reviewed November 2, 2026

Scope: Lit Triggers running Lit Actions in ChainSecured mode, and OpenZeppelin’s self-hosted Relayer and Monitor, which OpenZeppelin recommends after retiring Defender on July 1, 2026.

Operator authority

Three questions about operator authority.

Operator authority: Lit Triggers and Actions compared with OpenZeppelin
Control	Lit · Triggers + Actions	OpenZeppelin
Who can change the permissions?	Your account wallet approves on Base which Actions can use each PKP wallet. Lit’s 2-of-4 Safe can upgrade the account contracts without a timelock. Trigger settings, such as the schedule and whether a trigger is enabled, are changed through your Lit Triggers login.[3][6][7][8]	You run Relayer and Monitor on your own infrastructure, or OpenZeppelin runs them under its managed service. Whoever administers those servers and their configuration can change the policies, such as allowed receivers and gas price caps.[9][4][10]
Who can approve replacement code?	Each Action version is fixed by its code hash. A new version cannot use a PKP wallet until your account authorizes it. Separately, Lit’s 2-of-4 Safe approves runtime releases, with no timelock.[2][3][7]	You deploy each release of Relayer, Monitor, and your own plugins and scripts. Your deployment process decides who can ship a change.[9][11]
Who can stop access?	Lit runs the Triggers service that decides when each job fires, and the operator can pause signing. The service stores your usage key, so it can also run the Actions that key permits. Your permissions stay on-chain, but execution needs the runtime and key-management system. Recovery requires a separate plan.[12][6][13]	If you host the services, you control their availability. Signing also depends on the key backend you configure, such as a cloud KMS, Vault, or Turnkey.[5]

Who can change the permissions?

Lit · Triggers + Actions: Your account wallet approves on Base which Actions can use each PKP wallet. Lit’s 2-of-4 Safe can upgrade the account contracts without a timelock. Trigger settings, such as the schedule and whether a trigger is enabled, are changed through your Lit Triggers login.[3][6][7][8]
OpenZeppelin: You run Relayer and Monitor on your own infrastructure, or OpenZeppelin runs them under its managed service. Whoever administers those servers and their configuration can change the policies, such as allowed receivers and gas price caps.[9][4][10]

Who can approve replacement code?

Lit · Triggers + Actions: Each Action version is fixed by its code hash. A new version cannot use a PKP wallet until your account authorizes it. Separately, Lit’s 2-of-4 Safe approves runtime releases, with no timelock.[2][3][7]
OpenZeppelin: You deploy each release of Relayer, Monitor, and your own plugins and scripts. Your deployment process decides who can ship a change.[9][11]

Who can stop access?

Lit · Triggers + Actions: Lit runs the Triggers service that decides when each job fires, and the operator can pause signing. The service stores your usage key, so it can also run the Actions that key permits. Your permissions stay on-chain, but execution needs the runtime and key-management system. Recovery requires a separate plan.[12][6][13]
OpenZeppelin: If you host the services, you control their availability. Signing also depends on the key backend you configure, such as a cloud KMS, Vault, or Turnkey.[5]

The Lit advantage

Your on-chain rules govern what jobs can sign

Lit Triggers runs Lit Actions on schedules, webhooks, and on-chain events, so you do not host the scheduler or the signer. A PKP wallet’s key stays in the enclave with the code that checks each transaction, and your account approves on-chain which code can use that wallet.[1][2][3]

How Lit Triggers works

What control means in practice

Self-hosting gives you control of every component and the work of running them. With Lit, you do not operate the servers, and jobs depend on Lit’s runtime and Triggers service. Your account still controls on-chain which code can use each PKP wallet.[9][1][6]

Shared protections

Both can limit what an automated signer sends. OpenZeppelin Relayer supports receiver allowlists and gas price caps. It can sign with keys held in AWS or Google Cloud KMS, HashiCorp Vault, Turnkey, or Coinbase CDP, and OpenZeppelin recommends HSM-backed keys for production.[4][5][2]

Moving off Defender

OpenZeppelin closed Defender sign-ups on June 30, 2025, and retired the platform on July 1, 2026. Defender relayer keys could not be exported, so moving to any new service means new addresses and new role grants. OpenZeppelin also published a guide for porting Defender workflows to Chainlink CRE.[10][14][15]

Sources and review scope

These comparisons use published documentation and the source code linked below. We have not audited or tested the providers’ live systems. Configurations vary, and source code alone does not establish who currently owns a deployed contract or how it is configured.

Get started with crypto

Explore Lit’s security