ZKsync security record

As of 7 Mar 2025, Trustblock’s record for ZKsync holds 18 audit reports by 1 audit firm (Nov 2022 to Feb 2025). The latest audit is “ZKsync Paymaster Audit” by OpenZeppelin, dated 5 Feb 2025. Those reports list no open critical findings.

Critical findings

No open critical findings

Across the 18 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it. See the findings

Open the latest report Get the label for your site

Record last updated 7 Mar 2025. It holds audits, findings and contracts up to Oct 2026, and incidents up to Sep 2026. Statuses are the audit firms’ own. Trustblock does not review code.

Audits: 18; by 1 firm, Nov 2022 to Feb 2025
Last audit: 5 Feb 2025; by OpenZeppelin
Audit firms: 1; OpenZeppelin

Issues (128)

	Low	Medium	High	Critical	Total
Not fixed	6	4	-	-	10
Acknowledged	9	7	1	-	17
Fixed	74	19	6	2	101
Total	89	30	7	2	128

Audits (18)

#	Name	Auditor	Date	Chains	Issues
11	zkSync GnosisSafeZk Assessment	OpenZeppelin	2024/01/29	zkSync	No open critical findings
12	zkSync Bridge and .transfer & .send Diff Audit	OpenZeppelin	2024/01/29	zkSync	No open critical findings
13	zkSync WETH Bridge Audit	OpenZeppelin	2024/01/29	zkSync	No open critical findings
14	zkSync Fee Model and Token Bridge Audit	OpenZeppelin	2023/03/09	zkSync	No open critical findings
15	zkSync	OpenZeppelin	2023/03/08	zkSync	No open critical findings
16	zkSync Bootloader Audit Report	OpenZeppelin	2023/01/27	zkSync	No open critical findings
17	zkSync Layer 1 Diff Audit	OpenZeppelin	2022/12/13	zkSync	No open critical findings
18	zkSync Layer 1 Audit	OpenZeppelin	2022/11/23	zkSync	No open critical findings

Contracts (125)

#	File Name
121	l1-contracts/src/SecurityCouncil.sol
122	l1-contracts/src/interfaces/ISecurityCouncil.sol
123	l1-contracts/src/interfaces/IStateTransitionManager.sol
124	l1-contracts/src/interfaces/IPausable.sol
125	l1-contracts/src/Guardians.sol

Get your label

Is this your project? Add a free label to your website. It shows the audits published on Trustblock, with the latest firm and date, and links to this page. It updates by itself.

HTML

<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
<div
  data-tb-project-widget
  data-tb-project-slug="zksync-2"
  data-tb-variant="label"
  data-tb-color="light"
></div>

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us

Audits (18)

#	Name	Auditor	Date	Chains	Issues
11	zkSync GnosisSafeZk Assessment	OpenZeppelin	2024/01/29	zkSync	No open critical findings
12	zkSync Bridge and .transfer & .send Diff Audit	OpenZeppelin	2024/01/29	zkSync	No open critical findings
13	zkSync WETH Bridge Audit	OpenZeppelin	2024/01/29	zkSync	No open critical findings
14	zkSync Fee Model and Token Bridge Audit	OpenZeppelin	2023/03/09	zkSync	No open critical findings
15	zkSync	OpenZeppelin	2023/03/08	zkSync	No open critical findings
16	zkSync Bootloader Audit Report	OpenZeppelin	2023/01/27	zkSync	No open critical findings
17	zkSync Layer 1 Diff Audit	OpenZeppelin	2022/12/13	zkSync	No open critical findings
18	zkSync Layer 1 Audit	OpenZeppelin	2022/11/23	zkSync	No open critical findings

ZKsync security record

Issues (128)

Lack of Validationnot_fixed/low

Missing Testsnot_fixed/low

Misleading Documentationnot_fixed/low

Entanglement of Initialization and ReentrancyGuardnot_fixed/low

Missing Docstringsnot_fixed/low

Audits (18)

Contracts (125)

Get your label

Audits (18)