Optimism Smart Contracts Audit
Audit · firm’s term: audit
OpenZeppelin reviewed Optimism (Optimism Smart Contracts Audit) on 24 Nov 2021: 34 findings, 4 critical; 10 marked fixed, 24 open.
Report hosted on blog.openzeppelin.com.
Trustblock does not review code.
Findings34
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 4 |
| High | 1 | 0 | 4 |
| Medium | 3 | 0 | 2 |
| Low | 20 | 0 | 0 |
High[H04] Irrelevant proof contributions are acceptedOpen
The report gives no description here.
Medium[M01] Potential mismatch in allowed gas limit for sequenced and queued transactionsOpen
The report gives no description here.
Medium[M02] Pre-state root and transaction may not uniquely identify transitionsOpen
The report gives no description here.
Medium[M03] Initial state root cannot be challengedOpen
The report gives no description here.
Low[L01] Appending transactions to the Canonical Transaction Chain in specific blocks might unexpectedly failOpen
The report gives no description here.
Low[L02] Inaccessible code when retrieving Merkle rootsOpen
The report gives no description here.
Low[L03] Lack of input validationsOpen
The report gives no description here.
Low[L04] Merkle tree elements are overwrittenOpen
The report gives no description here.
Low[L05] Misleading and / or erroneous docstrings and commentsOpen
The report gives no description here.
Low[L06] Missing and / or incomplete docstringsOpen
The report gives no description here.
Show 10 more
Low[L07] Undocumented literal valuesOpen
The report gives no description here.
Low[L08] Unspecified behavior of OVM gas refund for revert flagsOpen
The report gives no description here.
Low[L09] Nuisance gas proportional to code size is charged unnecessarily when changing an accountOpen
The report gives no description here.
Low[L10] Unnecessary handling of single byte returned dataOpen
The report gives no description here.
Low[L11] Incorrect state transitioner indexOpen
The report gives no description here.
Low[L12] Inconsistent and error-prone storage references in proxy contractsOpen
The report gives no description here.
Low[L13] Inconsistent key slicing when computing trie rootOpen
The report gives no description here.
Low[L14] Branch node modification in Merkle Trie may deviate from specificationOpen
The report gives no description here.
Low[L15] Unnecessary use of assemblyOpen
The report gives no description here.
Low[L16] Incorrect parsing of booleans in RLP libraryOpen
The report gives no description here.
Show 4 more
Low[L17] Lookup key strings are not centrally definedOpen
The report gives no description here.
Low[L18] Lack of allowance front-running mitigation in ERC20 contractOpen
The report gives no description here.
Low[L19] Lack of event emissionsOpen
The report gives no description here.
Low[L20] Deployment risksOpen
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (19)
- contracts/optimistic-ethereum/libraries/bridge/OVM_CrossDomainEnabled.sol
- contracts/optimistic-ethereum/iOVM/chain/iOVM_ChainStorageContainer.sol
- contracts/optimistic-ethereum/libraries/utils/Lib_MerkleTree.sol
- contracts/optimistic-ethereum/OVM/execution/OVM_SafetyChecker.sol
- contracts/optimistic-ethereum/libraries/utils/Lib_RingBuffer.sol
- contracts/optimistic-ethereum/OVM/precompiles/OVM_L2ToL1MessagePasser.sol
- contracts/optimistic-ethereum/libraries/utils/Lib_Math.sol
- contracts/optimistic-ethereum/OVM/bridge/tokens/OVM_L1ERC20Gateway.sol
- contracts/optimistic-ethereum/OVM/execution/OVM_ExecutionManager.sol
- contracts/optimistic-ethereum/OVM/bridge/messaging/OVM_L1CrossDomainMessenger.sol
- contracts/optimistic-ethereum/OVM/precompiles/OVM_DeployerWhitelist.sol
- contracts/optimistic-ethereum/OVM/verification/OVM_StateTransitioner.sol
- contracts/optimistic-ethereum/OVM/bridge/tokens/Abs_L1TokenGateway.sol
- contracts/optimistic-ethereum/libraries/rlp/Lib_RLPReader.sol
- contracts/optimistic-ethereum/OVM/chain/OVM_CanonicalTransactionChain.sol
- contracts/optimistic-ethereum/libraries/trie/Lib_MerkleTrie.sol
- contracts/optimistic-ethereum/OVM/verification/OVM_BondManager.sol
- contracts/optimistic-ethereum/OVM/precompiles/ERC1820Registry.sol
- contracts/optimistic-ethereum/OVM/verification/OVM_FraudVerifier.sol
Part of Optimism’s security record
OptimismSecurity firm
OpenZeppelin67 projects reviewed · 184 reports · latest Aug 2026
See OpenZeppelin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us