zkSync Layer 1 Diff Audit

OpenZeppelinFiles named in the report

Audit · firm’s term: audit

OpenZeppelin reviewed ZKsync (zkSync Layer 1 Diff Audit) on 13 Dec 2022: 7 findings, 1 critical; all marked fixed.

1 critical finding, fixed
Open the reportOpen ZKsync’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical001
High000
Medium002
Low004
CriticalStorage collision leads to failure of the systemFixed

The report gives no description here.

MediumArbitrary l2Logs length can lead to unprovable blocks and log inclusionFixed

The report gives no description here.

MediumGovernor can immediately execute diamond upgradesFixed

The report gives no description here.

LowLack of explicit proposal idFixed

The report gives no description here.

LowMissing error messages in require statementsFixed

The report gives no description here.

LowReimplementation of library functionalityFixed

The report gives no description here.

LowRequire statement with multiple conditionsFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (24)

  • AllowListed.sol
  • UncheckedMath.sol
  • IGovernance.sol
  • DiamondCut.sol
  • DiamondProxy.sol
  • Base.sol
  • IExecutor.sol
  • DiamondInit.sol
  • Storage.sol
  • SafeCast.sol
  • IAllowList.sol
  • Diamond.sol
  • Executor.sol
  • Getters.sol
  • Config.sol
  • AllowList.sol
  • IGetters.sol
  • IMailbox.sol
  • PriorityQueue.sol
  • IDiamondCut.sol
  • IZkSync.sol
  • Merkle.sol
  • Mailbox.sol
  • Governance.sol

Part of ZKsync’s security record

ZKsync
Audits18 audits by 1 firmLast audit Feb 2025, by OpenZeppelin.
Critical findingsNo open critical findingsAcross the 18 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.
Open ZKsync’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us