Polygon ZkEVM security review
Hexens reviewed Polygon (Polygon ZkEVM security review) on 27 Feb 2023: 9 findings, 4 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 4 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 3 |
CriticalERC777 RE-ENTRANCY ATTACKFixed
The report gives no description here.
CriticalINCORRECT CTX ASSIGNATION LEADING TO ADDITION OF RANDOM AMOUNT OF ETHER TO THE SEQUENCER BALANCEFixed
The report gives no description here.
CriticalMISSING CONSTRAINT IN PIL LEADING TO EXECUTION FLOW HIJACKFixed
The report gives no description here.
CriticalMISSING CONSTRAINT IN PIL LEADING TO PROVING FAKE INCLUSION IN THE SMTFixed
The report gives no description here.
HighBUG IN MAXMEM HANDLING CAN HALT THE BATCH VERIFICATIONFixed
The report gives no description here.
MediumINCORRECT LIMIT CHECK IN ZKASM ECRECOVER IMPLEMENTATIONFixed
The report gives no description here.
LowDISCREPANCY IN TRANSACTION RLP DECODING BETWEEN ZKEVM AND EVMFixed
The report gives no description here.
LowGASLIMIT AND CHAINID MAX SIZE DIFFERENCE BETWEEN ZKEVM AND EVMFixed
The report gives no description here.
LowRECOMMENDATION TO CHANGE A CONDITIONAL JUMPFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Polygon’s security record
PolygonSecurity firm
Hexens32 projects reviewed · 74 reports · latest Jul 2026
See Hexens’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us