Scroll Phase 1 Audit

OpenZeppelinFiles named in the report

Audit · firm’s term: audit

OpenZeppelin reviewed Scroll (Scroll Phase 1 Audit) on 16 Oct 2023: 20 findings, 0 critical; 15 marked fixed, 4 acknowledged, 1 open.

No open critical findings
Open the reportOpen Scroll’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings20

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High115
Medium003
Low037
HighIncorrect Batch Hashes Due to Memory CorruptionFixed

The report gives no description here.

HighIncorrect Depth Calculation for Extension Nodes Allows Denial-of-ServiceFixed

The report gives no description here.

HighL2 Standard ERC-20 Token Metadata Can Be Set ArbitrarilyFixed

The report gives no description here.

HighNon-Standard RLP Encoding of Integer ZeroFixed

The report gives no description here.

HighUsers Can Lose Refund by DefaultFixed

The report gives no description here.

MediumEnforced Transactions Signed Off-Chain Are Likely to FailFixed

The report gives no description here.

MediumLack of Upgradeability Storage GapsFixed

The report gives no description here.

MediumWithdrawTrieVerifier Proves Intermediate NodesFixed

The report gives no description here.

LowBatch Events Lack InformationFixed

The report gives no description here.

LowBatch Reverting Can Pause FinalizationFixed

The report gives no description here.

Show 5 more
LowInitialization Not Disabled for Implementation ContractsFixed

The report gives no description here.

LowLack of Logs on Sensitive ActionsFixed

The report gives no description here.

LowLost Funds in Messenger ContractsFixed

The report gives no description here.

LowOutdated OpenZeppelin Library VersionFixed

The report gives no description here.

LowUnpinned Compiler VersionFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (49)

  • contracts/src/interfaces/IERC20Metadata.sol
  • contracts/src/libraries/ScrollMessengerBase.sol
  • contracts/src/L1/rollup/IL1MessageQueue.sol
  • contracts/src/L1/IL1ScrollMessenger.sol
  • contracts/src/libraries/gateway/ScrollGatewayBase.sol
  • contracts/src/L1/gateways/L1WETHGateway.sol
  • contracts/src/L1/gateways/L1ETHGateway.sol
  • contracts/src/L2/gateways/IL2ETHGateway.sol
  • contracts/src/L2/gateways/IL2ERC721Gateway.sol
  • contracts/src/libraries/token/IScrollERC1155.sol
  • contracts/src/libraries/token/IScrollERC721.sol
  • contracts/src/L1/rollup/IScrollChain.sol
  • contracts/src/L2/gateways/IL2GatewayRouter.sol
  • contracts/src/libraries/verifier/PatriciaMerkleTrieVerifier.sol
  • contracts/src/libraries/token/ScrollStandardERC20.sol
  • contracts/src/libraries/common/AddressAliasHelper.sol
  • contracts/src/libraries/token/IScrollStandardERC20Factory.sol
  • contracts/src/L1/rollup/ScrollChain.sol
  • contracts/src/L1/rollup/L1MessageQueue.sol
  • contracts/src/L1/gateways/L1GatewayRouter.sol
  • contracts/src/libraries/codec/BatchHeaderV0Codec.sol
  • contracts/src/libraries/token/IScrollERC20Upgradeable.sol
  • contracts/src/libraries/oracle/SimpleGasOracle.sol
  • contracts/src/L2/gateways/IL2ERC20Gateway.sol
  • contracts/src/libraries/constants/ScrollConstants.sol
  • contracts/src/libraries/token/ScrollStandardERC20Factory.sol
  • contracts/src/libraries/callbacks/IERC677Receiver.sol
  • contracts/src/libraries/verifier/IRollupVerifier.sol
  • contracts/src/L1/gateways/L1ERC1155Gateway.sol
  • contracts/src/L2/gateways/IL2ERC1155Gateway.sol
  • contracts/src/L1/gateways/EnforcedTxGateway.sol
  • contracts/src/External.sol
  • contracts/src/libraries/verifier/WithdrawTrieVerifier.sol
  • contracts/src/libraries/IScrollMessenger.sol
  • contracts/src/libraries/codec/ChunkCodec.sol
  • contracts/src/libraries/gateway/IScrollGateway.sol
  • contracts/src/L1/gateways/L1StandardERC20Gateway.sol
  • contracts/src/libraries/oracle/IGasOracle.sol
  • contracts/src/libraries/common/IWhitelist.sol
  • contracts/src/libraries/token/IScrollERC20.sol
  • contracts/src/L1/rollup/IL2GasPriceOracle.sol
  • contracts/src/L1/gateways/L1ERC721Gateway.sol
  • contracts/src/L1/rollup/L2GasPriceOracle.sol
  • contracts/src/L1/gateways/L1ERC20Gateway.sol
  • contracts/src/L1/L1ScrollMessenger.sol
  • contracts/src/libraries/callbacks/IScrollGatewayCallback.sol
  • contracts/src/libraries/FeeVault.sol
  • contracts/src/interfaces/IWETH.sol
  • contracts/src/L1/gateways/L1CustomERC20Gateway.sol

Part of Scroll’s security record

Scroll
Audits9 audits by 1 firmLast audit May 2024, by OpenZeppelin.
Critical findingsNo open critical findingsAcross 9 reports.
Open Scroll’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us