The OpenZeppelin Smart Contract Security Audit
Providing trust and confidence for the world's leading blockchain protocols and onchain financial infrastructure.
Trusted by leading financial institutions and blockchain protocols
In 2015, we pioneered smart contract security by introducing the OpenZeppelin Contracts library, which was soon followed by establishing the industry’s first professionalized security audit group.
We are dedicated to our clients, the security of their code, and instilling trust and confidence within their communities. With an elite team that brings together unparalleled expertise in PhD-level mathematics, cryptography, low-level EVM operations, and finance, we are the gold standard in securing the industry’s most complex and widely-used projects.
Our talent – and the collaborative OpenZeppelin Security Audit approach – is why clients retain us for multi-year relationships.
95% of our clients hire us again
$110B+ Total Value Locked secured
1M+ Lines of code reviewed
Securing the most critical blockchain protocols and applications
- Uniswap Labs
- Audits performed by us
- 9
- High & critical vulns uncovered
- 5
- Relationship started
- 2020
- 1inch
- Audits performed by us
- 19
- High & critical vulns uncovered
- 5
- Relationship started
- 2020
- Synthetix
- Audits performed by us
- 4
- High & critical vulns uncovered
- 31
- Relationship started
- 2020
- ZKsync
- Audits performed by us
- 46
- High & critical vulns uncovered
- 39
- Relationship started
- 2020
- Optimism
- Audits performed by us
- 5
- High & critical vulns uncovered
- 34
- Relationship started
- 2022
- Scroll
- Audits performed by us
- 11
- High & critical vulns uncovered
- 14
- Relationship started
- 2023
- Ion Protocol
- Audits performed by us
- 7
- High & critical vulns uncovered
- 11
- Relationship started
- 2023
- Aave
- Audits performed by us
- 8
- High & critical vulns uncovered
- 5
- Relationship started
- 2019
- Morpho
- Audits performed by us
- 5
- High & critical vulns uncovered
- 2
- Relationship started
- 2023
- UMA
- Audits performed by us
- 33
- High & critical vulns uncovered
- 22
- Relationship started
- 2020
- The Graph
- Audits performed by us
- 43
- High & critical vulns uncovered
- 56
- Relationship started
- 2020
- Ethereum Foundation
- Audits performed by us
- 3
- High & critical vulns uncovered
- 7
- Relationship started
- 2022
- Pimlico
- Audits performed by us
- 1
- High & critical vulns uncovered
- 0
- Relationship started
- 2024
- Origin
- Audits performed by us
- 20
- High & critical vulns uncovered
- 14
- Relationship started
- 2021
- Mountain Protocol
- Audits performed by us
- 2
- High & critical vulns uncovered
- 0
- Relationship started
- 2023
- ANZ
- Audits performed by us
- 2
- High & critical vulns uncovered
- 0
- Relationship started
- 2022
- WisdomTree
- Audits performed by us
- 1
- High & critical vulns uncovered
- 0
- Relationship started
- 2025
- Fireblocks
- Audits performed by us
- 5
- High & critical vulns uncovered
- 2
- Relationship started
- 2022
- The Sandbox
- Audits performed by us
- 17
- High & critical vulns uncovered
- 17
- Relationship started
- 2023
- Decentraland
- Audits performed by us
- 1
- High & critical vulns uncovered
- 0
- Relationship started
- 2018
- Agora
- Audits performed by us
- 9
- High & critical vulns uncovered
- 7
- Relationship started
- 2023
- Lido
- Audits performed by us
- 2
- High & critical vulns uncovered
- 0
- Relationship started
- 2023
- Compound
- Audits performed by us
- 74
- High & critical vulns uncovered
- 33
- Relationship started
- 2019
Data collected as of April 2025
- Uniswap Labs
- Audits performed by us
- 9
- High & critical vulns uncovered
- 5
- Relationship started
- 2020
- 1inch
- Audits performed by us
- 19
- High & critical vulns uncovered
- 5
- Relationship started
- 2020
- Synthetix
- Audits performed by us
- 4
- High & critical vulns uncovered
- 31
- Relationship started
- 2020
Data collected as of April 2025
Our team secures leading decentralized exchanges and aggregators.
Engaging with various platforms including AMMs like Bancor V3 and Balancer, the UniswapX order settlement protocol, the Beefy swap router, and the Panoptic options trading platform, which leverages Uniswap V3 liquidity positions, demonstrating our proficiency in V3 concentrated liquidity mathematics. Furthermore, we've completed over 13 audits for 1inch, the premier DEX aggregator.
- ZKsync
- Audits performed by us
- 46
- High & critical vulns uncovered
- 39
- Relationship started
- 2020
- Optimism
- Audits performed by us
- 5
- High & critical vulns uncovered
- 34
- Relationship started
- 2022
- Scroll
- Audits performed by us
- 11
- High & critical vulns uncovered
- 14
- Relationship started
- 2023
Data collected as of April 2025
We secure L1-L2 bridges, ZK-verifier contracts, and optimistic rollups
We've identified critical vulnerabilities across a range of areas, including fraud-proof verification, cross-domain transactions, fee mismanagement, and reward system abuses.
Notably, critical issues were discovered in the Linea ZK-verifier, the Scroll message-passing bridge, among other ZK-rollups.
- Ion Protocol
- Audits performed by us
- 7
- High & critical vulns uncovered
- 11
- Relationship started
- 2023
- Aave
- Audits performed by us
- 8
- High & critical vulns uncovered
- 5
- Relationship started
- 2019
- Morpho
- Audits performed by us
- 5
- High & critical vulns uncovered
- 2
- Relationship started
- 2023
Data collected as of April 2025
OpenZeppelin is the trusted leader in securing lending protocols like Aave, Morpho, Venus, and Radiant.
Our security researchers have uncovered critical vulnerabilities across leading protocols with billions in TVL - including reward distribution flaws in Radiant Riz, potential bad debt creation in AAVE V3, and potential skipping of bad debt socialization in Morpho Blue. We specialize in securing lending protocols against core risks such as incorrect debt accounting, liquidation edge cases, and interest rate miscalculations to ensure protocol’s security at scale.
- UMA
- Audits performed by us
- 33
- High & critical vulns uncovered
- 22
- Relationship started
- 2020
- The Graph
- Audits performed by us
- 43
- High & critical vulns uncovered
- 56
- Relationship started
- 2020
Data collected as of April 2025
Our team expertise extends across the most sophisticated Oracle systems.
These include Chainlink and UMA Protocol, and Oracle-dependent components used by platforms like Compound and Synthetix Oracle manager, which utilize Pyth, Chainlink, and Uniswap V3 TWAP oracles. As UMA's primary security partner, we've conducted over 10 audits, revealing critical vulnerabilities in its optimistic verification system and cross-chain components. Additionally, we've identified high-severity issues in Polymarket's integration with UMA.
- Ethereum Foundation
- Audits performed by us
- 3
- High & critical vulns uncovered
- 7
- Relationship started
- 2022
- Pimlico
- Audits performed by us
- 1
- High & critical vulns uncovered
- 0
- Relationship started
- 2024
Data collected as of April 2025
Our first-hand experience auditing multiple Account-Abstraction implementations positions us as leaders in Account Abstraction security.
We worked with the Ethereum Foundation on three audits of Account Abstraction’s EIP-4337, identifying over seven high+ severity issues, enhancing Ethereum protocol’s security. Our discoveries encompassed deposit record manipulations, incorrect gas calculations, and invalid aggregated signature verifications, among others. We also audited Pimlico’s ERC20 token paymaster implementation, allowing users to pay transactions in any ERC20. During this audit, our researchers dived deep into the ERC 4337 paymaster reputation rules.
- Origin
- Audits performed by us
- 20
- High & critical vulns uncovered
- 14
- Relationship started
- 2021
- Mountain Protocol
- Audits performed by us
- 2
- High & critical vulns uncovered
- 0
- Relationship started
- 2023
Data collected as of April 2025
We are the security partner for the leading stablecoins.
Back in 2018, we audited Tether, the most used stablecoin in the world. In 2019, our team found a live critical vulnerability affecting MakerDao, the issuer of DAI. Today, we are Origin’s main security partner, performing over 7 audits including the Origin dollar, a yield-bearing decentralized stablecoin. During our engagement with Origin, we added value through multiple findings, including critical findings that would have resulted in yield theft. We also secure Mountain Protocol, issuers of USDM, a yield-bearing rebasing stablecoin backed by T-Bills.
- ANZ
- Audits performed by us
- 2
- High & critical vulns uncovered
- 0
- Relationship started
- 2022
- WisdomTree
- Audits performed by us
- 1
- High & critical vulns uncovered
- 0
- Relationship started
- 2025
- Fireblocks
- Audits performed by us
- 5
- High & critical vulns uncovered
- 2
- Relationship started
- 2022
Data collected as of April 2025
Financial Institutions entering the blockchain space face unique challenges regarding security, compliance, and operations.
We partner with leading financial institutions across North America, Latin America, Europe, and Asia as their trusted blockchain advisors. We also audited and provided operational infrastructure for the issuance of the A$DC Australian Dollar stablecoin by the ANZ Bank.
- The Sandbox
- Audits performed by us
- 17
- High & critical vulns uncovered
- 17
- Relationship started
- 2023
- Decentraland
- Audits performed by us
- 1
- High & critical vulns uncovered
- 0
- Relationship started
- 2018
Data collected as of April 2025
We secure the leading Gaming and NFT protocols. We are the authors of the world’s most widely used implementation of ERC721, used by the most popular protocols working with NFTs.
Our work in NFTs encompasses audits for some of the most widely known issuers and exchanges, including Yuga Labs, creators of BAYC, and OpenSea.
In the gaming space, we are The Sandbox’s security partner, performing over 15 audits to their protocol. Other gaming experience includes Decentraland’s MANA token as well as the PoolTogether protocol, finding critical issues that prevented loss of funds due to user duplication in their prize pools.
- Agora
- Audits performed by us
- 9
- High & critical vulns uncovered
- 7
- Relationship started
- 2023
- Lido
- Audits performed by us
- 2
- High & critical vulns uncovered
- 0
- Relationship started
- 2023
- Compound
- Audits performed by us
- 74
- High & critical vulns uncovered
- 33
- Relationship started
- 2019
Data collected as of April 2025
Trusted by leading protocols and DAOs, OpenZeppelin sets the standard for decentralized governance security.
We audit governance modules for industry leaders like Compound, Lido and Agora, identifying critical vulnerabilities to ensure proposals, voting, and execution mechanisms are secure. Our security researchers have identified 25+ issues in Lido’s Dual Governance and 27+ issues in Agora’s module-based voting, votable supply, and proposal validation. We’ve been a long-standing security partner for Compound, performing over 70 audits to enhance their security infrastructure and protect substantial on-chain assets.
The OpenZeppelin client centered approach
Client Engagement
We communicate and collaborate with you in every stage to ensure both business and code objectives are achieved securely and efficiently.
Team Structure
- 2+ Blockchain Security Researchers
- Technical Manager
- Project Manager
The team is supported by Cryptographers, Advanced Testing Engineer and Security Analyst based on the project requirements.
Pre-Audit
Our security researchers prepare in advance for the audit by leveraging our internal knowledge base, reviewing your project documentation and running your test suite to deepen our understanding of the codebase. A dedicated technical manager will also consult with you on technical details to optimize audit readiness and quality.
An initial assessment by our proprietary Code Inspector, which detects over 60% of low-severity issues, helps focus our team efforts on identifying the most critical vulnerabilities.
Security Audit
We conduct a comprehensive review of your system's architecture and codebase, with each line of code inspected by at least two security researchers. We adopt a collaborative approach, engaging directly with your team throughout the audit to thoroughly understand the technical design and business logic. When necessary, our researchers engage in advanced testing techniques, including fuzzing and invariant testing, to ensure system integrity.
Finally, we offer tailored recommendations to resolve issues, striking a balance between best practices and your system's specific needs.
Fix Review
The fix review process is as important as the audit itself.
The security researchers meticulously review the fixed issues and engage with the developer in discussing the nuances of your codebase, which leads to gaining a better understanding of your systems.
Upon review, the final audit report is delivered through a dedicated platform, allowing your team to track issues and resolutions, and interact directly with auditors for faster and more efficient communication.
Ongoing Support
Once we have audited your project, we become experts in your code. We keep an open communication channel with your team for any future consultation needs.
The OpenZeppelin Security Audit often results in multi-year collaborative relationships.
We protect blockchain protocols and applications. Language is your choice.
Solidity
The cornerstone of Ethereum smart contracts, powering decentralized applications (DApps) that redefine our digital world.
Our Solidity smart contract audits go beyond mere code review; they are a comprehensive safeguard for your DApp's integrity and user trust.
With a meticulous blend of static analysis, manual inspection, and automated tools, we dissect every line of code to unearth vulnerabilities, review code design and system architecture, and ensure compliance with the latest Ethereum Improvement Proposals (EIPs). Let us fortify your Solidity contracts against the known and the unforeseen.
- Uniswap
- Compound
- Optimism
Uniswap
Compound
OptimismCairo
Cairo—a revolutionary language for creating provably secure smart contracts—brings about a new era of blockchain possibilities, including zk-Rollups and more efficient layer 2 solutions.
Our Cairo smart contract audits are at the forefront of this innovation, offering specialized services to ensure your Cairo contracts are both powerful and impenetrable.
Some examples of issues found include severe protocol issues for Starknet including one which incorrectly allowed anyone to invoke functions only specific users should be able to, as well as a number of other issues such as in the case of the Snapshot protocol, regarding their voting system accounting as well as many others.
Rust
Rust's promise of memory safety and concurrency without compromise makes it a formidable choice for blockchain applications seeking unparalleled security and performance.
Our Rust security audits and reviews harness Rust's strengths to secure your blockchain infrastructure, focusing on Layer 2 networks and other innovative platforms that push the boundaries of scalability and efficiency.
We also delve deep into the auditing of Zero-Knowledge Proofs (ZKP) and other cryptographic primitives, that leverage Rust's inherent safety features but also embody the cutting-edge of blockchain security techniques.
One of the noteworthy findings in this category is a bug which was found in the bus-mapping segment of the Scroll ZK system which could be exploited to censor transactions, impair the Sequencer's functionality, and potentially compromise the L2.
Go
Go, with its simplicity and efficiency, powers some of the most critical infrastructure elements of blockchain networks.
Our Go audit service is designed to address the unique challenges of Go-based blockchain projects.
By combining thorough code reviews and security best practices, we ensure your system stands up to the demands of operational availability, scalability and security.
“Collaborating with OpenZeppelin on our security audit was a productive and positive experience. We appreciated their thoroughness and attention to detail.”
“Huge thanks to OpenZeppelin for being a great partner during the security audit — their expertise and constant support were invaluable for the entire engagement.”