zkSync Upgrade System Audit

OpenZeppelinFiles named in the report

Audit · firm’s term: audit

Part of OpenZeppelin’s series

OpenZeppelin reviewed ZKsync (zkSync Upgrade System Audit) on 29 Jan 2024: 11 findings, 0 critical; none marked fixed.

No open critical findings
Open the reportOpen ZKsync’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High100
Medium400
Low600
HighNot Setting L2 Upgrade Block Number Prevents Future UpgradesOpen

The report gives no description here.

MediumInadequate Test CoverageOpen

The report gives no description here.

MediumInsufficient Validation of L2 Upgrade TransactionOpen

The report gives no description here.

MediumL2 Upgrade Timing Will Precede L1 UpgradeOpen

The report gives no description here.

MediumReverted L2 Upgrade Block Forces Recommitment of Preceding Blocks with Incorrect ValuesOpen

The report gives no description here.

LowComplexUpgrader Does Not Revert on delegatecall to an EOAOpen

The report gives no description here.

LowInconsistent VerifierOpen

The report gives no description here.

LowLack of Handling for Unrecognized L2 Logs SendersOpen

The report gives no description here.

LowMissing DocstringsOpen

The report gives no description here.

LowMissing or Misleading DocumentationOpen

The report gives no description here.

Show 1 more
LowMissing Post-update HookOpen

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (16)

  • IGovernance.sol
  • BytecodeCompressor.sol
  • bootloader.yul
  • L2ContractHelper.sol
  • DefaultUpgrade.sol
  • Storage.sol
  • Diamond.sol
  • BaseZkSyncUpgrade.sol
  • ComplexUpgrader.sol
  • Executor.sol
  • Getters.sol
  • Config.sol
  • IComplexUpgrader.sol
  • ContractDeployer.sol
  • Constants.sol
  • Governance.sol

Part of ZKsync’s security record

ZKsync
Audits18 audits by 1 firmLast audit Feb 2025, by OpenZeppelin.
Critical findingsNo open critical findingsAcross the 18 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.
Open ZKsync’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us