Optimism Smart Contracts Audit
OpenZeppelin reviewed Optimism (Optimism Smart Contracts Audit) on 24 Nov 2021: 34 findings, 4 critical; 10 marked fixed, 24 open.
Report hosted on blog.openzeppelin.com.
Statuses are the security firm’s own, from this report. Trustblock does not review code.
Findings34
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 4 |
| High | 1 | 0 | 4 |
| Medium | 3 | 0 | 2 |
| Low | 20 | 0 | 0 |
High[H04] Irrelevant proof contributions are acceptedNot fixed
The report gives no description here.
Medium[M01] Potential mismatch in allowed gas limit for sequenced and queued transactionsNot fixed
The report gives no description here.
Medium[M02] Pre-state root and transaction may not uniquely identify transitionsNot fixed
The report gives no description here.
Medium[M03] Initial state root cannot be challengedNot fixed
The report gives no description here.
Low[L01] Appending transactions to the Canonical Transaction Chain in specific blocks might unexpectedly failNot fixed
The report gives no description here.
Low[L02] Inaccessible code when retrieving Merkle rootsNot fixed
The report gives no description here.
Low[L03] Lack of input validationsNot fixed
The report gives no description here.
Low[L04] Merkle tree elements are overwrittenNot fixed
The report gives no description here.
Low[L05] Misleading and / or erroneous docstrings and commentsNot fixed
The report gives no description here.
Low[L06] Missing and / or incomplete docstringsNot fixed
The report gives no description here.
Show 10 more
Low[L07] Undocumented literal valuesNot fixed
The report gives no description here.
Low[L08] Unspecified behavior of OVM gas refund for revert flagsNot fixed
The report gives no description here.
Low[L09] Nuisance gas proportional to code size is charged unnecessarily when changing an accountNot fixed
The report gives no description here.
Low[L10] Unnecessary handling of single byte returned dataNot fixed
The report gives no description here.
Low[L11] Incorrect state transitioner indexNot fixed
The report gives no description here.
Low[L12] Inconsistent and error-prone storage references in proxy contractsNot fixed
The report gives no description here.
Low[L13] Inconsistent key slicing when computing trie rootNot fixed
The report gives no description here.
Low[L14] Branch node modification in Merkle Trie may deviate from specificationNot fixed
The report gives no description here.
Low[L15] Unnecessary use of assemblyNot fixed
The report gives no description here.
Low[L16] Incorrect parsing of booleans in RLP libraryNot fixed
The report gives no description here.
Show 4 more
Low[L17] Lookup key strings are not centrally definedNot fixed
The report gives no description here.
Low[L18] Lack of allowance front-running mitigation in ERC20 contractNot fixed
The report gives no description here.
Low[L19] Lack of event emissionsNot fixed
The report gives no description here.
Low[L20] Deployment risksNot fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (19)
- contracts/optimistic-ethereum/libraries/bridge/OVM_CrossDomainEnabled.sol
- contracts/optimistic-ethereum/iOVM/chain/iOVM_ChainStorageContainer.sol
- contracts/optimistic-ethereum/libraries/utils/Lib_MerkleTree.sol
- contracts/optimistic-ethereum/OVM/execution/OVM_SafetyChecker.sol
- contracts/optimistic-ethereum/libraries/utils/Lib_RingBuffer.sol
- contracts/optimistic-ethereum/OVM/precompiles/OVM_L2ToL1MessagePasser.sol
- contracts/optimistic-ethereum/libraries/utils/Lib_Math.sol
- contracts/optimistic-ethereum/OVM/bridge/tokens/OVM_L1ERC20Gateway.sol
- contracts/optimistic-ethereum/OVM/execution/OVM_ExecutionManager.sol
- contracts/optimistic-ethereum/OVM/bridge/messaging/OVM_L1CrossDomainMessenger.sol
- contracts/optimistic-ethereum/OVM/precompiles/OVM_DeployerWhitelist.sol
- contracts/optimistic-ethereum/OVM/verification/OVM_StateTransitioner.sol
- contracts/optimistic-ethereum/OVM/bridge/tokens/Abs_L1TokenGateway.sol
- contracts/optimistic-ethereum/libraries/rlp/Lib_RLPReader.sol
- contracts/optimistic-ethereum/OVM/chain/OVM_CanonicalTransactionChain.sol
- contracts/optimistic-ethereum/libraries/trie/Lib_MerkleTrie.sol
- contracts/optimistic-ethereum/OVM/verification/OVM_BondManager.sol
- contracts/optimistic-ethereum/OVM/precompiles/ERC1820Registry.sol
- contracts/optimistic-ethereum/OVM/verification/OVM_FraudVerifier.sol
Part of Optimism’s security record
OptimismSecurity firm
OpenZeppelin67 projects reviewed · 185 reports · latest Aug 2026
See OpenZeppelin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us