Scroll Phase 2 Audit

OpenZeppelinFiles named in the report

Audit · firm’s term: audit

OpenZeppelin reviewed Scroll (Scroll Phase 2 Audit) on 16 Oct 2023: 13 findings, 0 critical; 11 marked fixed, 1 acknowledged, 1 open.

No open critical findings
Open the reportOpen Scroll’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings13

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium014
Low106
HighIncorrect Storage Slot CalculationsFixed

The report gives no description here.

MediumL2MessageQueue Stores Incorrect Value if not Initialized Before AppendingFixed

The report gives no description here.

MediumLack of Storage GapsFixed

The report gives no description here.

MediumSmart Contract Wallets Cannot Withdraw WETHFixed

The report gives no description here.

MediumWETH9 Approval Can Be Front-RunFixed

The report gives no description here.

LowBlock Container Does Not Enforce WhitelistFixed

The report gives no description here.

LowInitialization Not Disabled for Implementation ContractsFixed

The report gives no description here.

LowInitialization Performed Outside of Initialization FunctionFixed

The report gives no description here.

LowLack of Event EmissionsFixed

The report gives no description here.

LowLack of Validation When Updating Maximum Failed Execution TriesFixed

The report gives no description here.

Show 1 more
LowMissing Error Messages in require StatementsFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (29)

  • contracts/src/libraries/token/IScrollERC1155.sol
  • contracts/src/libraries/common/OwnableBase.sol
  • contracts/src/libraries/token/IScrollERC721.sol
  • contracts/src/L1/gateways/IL1ETHGateway.sol
  • contracts/src/L2/predeploys/L2MessageQueue.sol
  • contracts/src/L2/gateways/L2ERC721Gateway.sol
  • contracts/src/libraries/common/AppendOnlyMerkleTree.sol
  • contracts/src/L1/gateways/IL1GatewayRouter.sol
  • contracts/src/L2/predeploys/L1GasPriceOracle.sol
  • contracts/src/L1/gateways/IL1ERC721Gateway.sol
  • contracts/src/L1/gateways/IL1ERC1155Gateway.sol
  • contracts/src/L2/predeploys/WETH9.sol
  • contracts/src/L2/gateways/L2ERC20Gateway.sol
  • contracts/src/L2/gateways/L2ERC1155Gateway.sol
  • contracts/src/L2/predeploys/IL1GasPriceOracle.sol
  • contracts/src/L2/predeploys/IL1BlockContainer.sol
  • contracts/src/L1/gateways/IL1ERC20Gateway.sol
  • contracts/src/L2/predeploys/Whitelist.sol
  • contracts/src/L2/gateways/L2CustomERC20Gateway.sol
  • contracts/src/L2/gateways/L2StandardERC20Gateway.sol
  • contracts/src/libraries/constants/ScrollPredeploy.sol
  • contracts/src/L2/gateways/L2WETHGateway.sol
  • contracts/src/L2/gateways/L2GatewayRouter.sol
  • contracts/src/L2/predeploys/L2TxFeeVault.sol
  • contracts/src/L2/gateways/L2ETHGateway.sol
  • contracts/src/L2/L2ScrollMessenger.sol
  • contracts/src/L2/IL2ScrollMessenger.sol
  • contracts/src/L2/predeploys/L1BlockContainer.sol
  • contracts/src/libraries/FeeVault.sol

Part of Scroll’s security record

Scroll
Audits9 audits by 1 firmLast audit May 2024, by OpenZeppelin.
Critical findingsNo open critical findingsAcross 9 reports.
Open Scroll’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us