Scroll security record
As of 30 Oct 2026, Scroll has 9 audit reports by 1 security firm on Trustblock; the latest is by OpenZeppelin, dated 28 May 2024. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits9
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Scroll Batch Token Bridge Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Scroll EIP-4844 Support Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Scroll ZKTrieVerifier Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Scroll | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Scroll Phase 1 Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Scroll Diff Audit Report | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Scroll GasSwap, Multiple Verifier, Wrapped Ether a | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Scroll USDC Gateway Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Scroll Phase 2 Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
Findings54
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 2 |
| Medium | 4 | 3 | 7 |
| Low | 2 | 10 | 24 |
HighETH Deposits Can Get Stuck if They Are Not Successfully BridgedScroll · OpenZeppelin · 7 Feb 2024Fixed
The report gives no description here.
Open the reportHighIncorrect Storage Slot CalculationsScroll Phase 2 Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportMediumMalicious Actor Can Steal Deposits of Tokens With Sender Hooks or Cause Lock Of FundsScroll Batch Token Bridge Audit · OpenZeppelin · 28 May 2024Fixed
The report gives no description here.
Open the reportMediumMalicious User Can Increase the Gas Cost of VerificationScroll ZKTrieVerifier Audit · OpenZeppelin · 11 Mar 2024Fixed
The report gives no description here.
Open the reportMediumL2MessageQueue Stores Incorrect Value if not Initialized Before AppendingScroll Phase 2 Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportMediumL2USDCGateway Is Missing Rate Limiter FunctionalityScroll USDC Gateway Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportMediumLack of Storage GapsScroll Phase 2 Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportMediumSmart Contract Wallets Cannot Withdraw WETHScroll Phase 2 Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportMediumWETH9 Approval Can Be Front-RunScroll Phase 2 Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowGas InefficienciesScroll Batch Token Bridge Audit · OpenZeppelin · 28 May 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowIncomplete DocstringsScroll EIP-4844 Support Audit · OpenZeppelin · 15 Apr 2024Fixed
The report gives no description here.
Open the reportLowMissing DocstringsScroll EIP-4844 Support Audit · OpenZeppelin · 15 Apr 2024Fixed
The report gives no description here.
Open the reportLowTrie Depth Is Not Explicitly CappedScroll ZKTrieVerifier Audit · OpenZeppelin · 11 Mar 2024Fixed
The report gives no description here.
Open the reportLowImplementation Keeps Functionalities for Deprecated VariablesScroll · OpenZeppelin · 7 Feb 2024Fixed
The report gives no description here.
Open the reportLowAnyone Can Steal ERC-20 Tokens From GasSwapScroll GasSwap, Multiple Verifier, Wrapped Ether a · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowBlock Container Does Not Enforce WhitelistScroll Phase 2 Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowImplicit Limitation of WithdrawalScroll Diff Audit Report · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowInconsistency of Allowing a Trusted ForwarderScroll GasSwap, Multiple Verifier, Wrapped Ether a · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowInconsistency of Reentrancy GuardScroll GasSwap, Multiple Verifier, Wrapped Ether a · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowInitialization Not Disabled for Implementation ContractsScroll Phase 2 Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowInitialization Performed Outside of Initialization FunctionScroll Phase 2 Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowInsufficient Tests When Using BitMapsScroll Diff Audit Report · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowLack of Event EmissionsScroll Phase 2 Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowLack of gap VariableScroll USDC Gateway Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowLack of Validation When Updating Maximum Failed Execution TriesScroll Phase 2 Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowmaxReplayTimes is Not Initialized in L1ScrollMessengerScroll GasSwap, Multiple Verifier, Wrapped Ether a · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowMisleading and Incorrect CommentsScroll GasSwap, Multiple Verifier, Wrapped Ether a · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowMisleading CommentScroll USDC Gateway Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowMissing DocstringsScroll USDC Gateway Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowMissing Error Messages in require StatementsScroll Phase 2 Audit · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportShow 3 more
LowPossible Misleading revert Message When Swapping Non-ERC20Permit TokensScroll GasSwap, Multiple Verifier, Wrapped Ether a · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowPotentially Misleading Verifier EventScroll GasSwap, Multiple Verifier, Wrapped Ether a · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportLowRedundancy of Replaying Messages in L2ScrollMessengerScroll GasSwap, Multiple Verifier, Wrapped Ether a · OpenZeppelin · 16 Oct 2023Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="scroll"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us