zkSync Layer 1 Audit
Audit · firm’s term: audit
OpenZeppelin reviewed ZKsync (zkSync Layer 1 Audit) on 23 Nov 2022: 20 findings, 0 critical; 18 marked fixed, 2 acknowledged.
Report hosted on blog.openzeppelin.com.
Trustblock does not review code.
Findings20
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 4 |
| Low | 0 | 2 | 14 |
MediumCorruption of facets array on selector replacementFixed
The report gives no description here.
MediumFreezable property applies to individual selectors instead of facetsFixed
The report gives no description here.
MediumMerkle library verifies intermediate inputsFixed
The report gives no description here.
MediumProof replayabilityFixed
The report gives no description here.
Low_proveBlock while loop could run out of gasFixed
The report gives no description here.
LowConfusing event emission when executing diamond cut proposalsFixed
The report gives no description here.
LowDiamondInit can be initialized itselfFixed
The report gives no description here.
LowGas optimizationsFixed
The report gives no description here.
LowGetter returns misleading valueFixed
The report gives no description here.
LowInterface and contract function parameter mismatchFixed
The report gives no description here.
Show 8 more
LowLack of DocumentationFixed
The report gives no description here.
LowLack of event informationFixed
The report gives no description here.
LowLack of l2Logs validationFixed
The report gives no description here.
LowPreimage hash collision protection for storage pointersFixed
The report gives no description here.
LowRequire statements with multiple conditionsFixed
The report gives no description here.
LowUnused input to commit blocksFixed
The report gives no description here.
LowUnused L2Messages can be committed to L1Fixed
The report gives no description here.
LowUnverified inputs during block commitmentFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (21)
- ReentrancyGuard.sol
- IGovernance.sol
- DiamondCut.sol
- DiamondProxy.sol
- Base.sol
- IExecutor.sol
- DiamondInit.sol
- Storage.sol
- Diamond.sol
- Executor.sol
- Getters.sol
- Config.sol
- IGetters.sol
- PriorityQueue.sol
- IDiamondCut.sol
- Dependencies.sol
- IZkSync.sol
- Merkle.sol
- Mailbox.sol
- Governance.sol
- UnsafeBytes.sol
Part of ZKsync’s security record
ZKsyncSecurity firm
OpenZeppelin67 projects reviewed · 184 reports · latest Aug 2026
See OpenZeppelin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us