ZKsync security record
As of 14 Oct 2026, ZKsync has 18 audit reports by 1 security firm on Trustblock; the latest is by OpenZeppelin, dated 5 Feb 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits18
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| ZKsync Paymaster Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| ZK Token, Capped Minter, and Merkle Distributor Au | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| ZKsync L1 Governance Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| ZKsync L2 Governance Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| ZKsync State Transition Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| Matterlabs EIP-4844 Support Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| zkSync Keccak256 Upgrade Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| zkSync L1Messenger Upgrade Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| zkSync L2 Block Refactor Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| zkSync Upgrade System Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| zkSync GnosisSafeZk Assessment | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| zkSync Bridge and .transfer & .send Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| zkSync WETH Bridge Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| zkSync Fee Model and Token Bridge Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| zkSync | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
| zkSync Bootloader Audit Report | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| zkSync Layer 1 Diff Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · blog.openzeppelin.com |
| zkSync Layer 1 Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | No open critical findings | Open · blog.openzeppelin.com |
Findings128
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 1 | 6 |
| Medium | 4 | 7 | 19 |
| Low | 6 | 9 | 74 |
CriticalUseless Assertion CheckzkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportCriticalStorage collision leads to failure of the systemzkSync Layer 1 Diff Audit · OpenZeppelin · 13 Dec 2022Fixed
The report gives no description here.
Open the reportHighIncorrect Hash in Proposal ID Prevents Guardians From Canceling ProposalsZKsync L1 Governance Diff Audit · OpenZeppelin · 23 Oct 2024Fixed
The report gives no description here.
Open the reportHighLack of Data Availability of BytecodezkSync L1Messenger Upgrade Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportHighMalicious Operator Can Dodge RefundzkSync Fee Model and Token Bridge Audit · OpenZeppelin · 9 Mar 2023Fixed
The report gives no description here.
Open the reportHighETH withdrawal within allowed limit could failzkSync · OpenZeppelin · 8 Mar 2023Fixed
The report gives no description here.
Open the reportHighNon-Standard Transaction HashzkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportHighUnbound RLP Length EncodingzkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportMediumSecurity Council Can Keep Protocol in Frozen StateZKsync L1 Governance Diff Audit · OpenZeppelin · 23 Oct 2024Fixed
The report gives no description here.
Open the reportMediumAmbiguous PubdataPricingMode ConfigurationZKsync State Transition Diff Audit · OpenZeppelin · 4 Jun 2024Fixed
The report gives no description here.
Open the reportShow 10 more
MediumStateTransitionManager Cannot Unfreeze ChainsZKsync State Transition Diff Audit · OpenZeppelin · 4 Jun 2024Fixed
The report gives no description here.
Open the reportMediumBootloader Uses Incorrect Value for System Contract Upgrade Log KeyMatterlabs EIP-4844 Support Audit · OpenZeppelin · 5 Feb 2024Fixed
The report gives no description here.
Open the reportMediumGas Charged Twice for Sending Message to L1zkSync L1Messenger Upgrade Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportMediumNaming ErrorzkSync L1Messenger Upgrade Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportMediumceilDiv Function Can OverflowzkSync Fee Model and Token Bridge Audit · OpenZeppelin · 9 Mar 2023Fixed
The report gives no description here.
Open the reportMediumOverflows in Fee ComputationzkSync Fee Model and Token Bridge Audit · OpenZeppelin · 9 Mar 2023Fixed
The report gives no description here.
Open the reportMediumRefund recipient defaults to inaccessible address for contractszkSync · OpenZeppelin · 8 Mar 2023Fixed
The report gives no description here.
Open the reportMediumUnchecked subtraction underflowzkSync · OpenZeppelin · 8 Mar 2023Fixed
The report gives no description here.
Open the reportMediumUser could deposit more ETH than allowedzkSync · OpenZeppelin · 8 Mar 2023Fixed
The report gives no description here.
Open the reportMediumOvershadowing and Uncaptured ReturnszkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportShow 10 more
MediumString Literal Exceeds 32 Bytes LimitzkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportMediumArbitrary l2Logs length can lead to unprovable blocks and log inclusionzkSync Layer 1 Diff Audit · OpenZeppelin · 13 Dec 2022Fixed
The report gives no description here.
Open the reportMediumGovernor can immediately execute diamond upgradeszkSync Layer 1 Diff Audit · OpenZeppelin · 13 Dec 2022Fixed
The report gives no description here.
Open the reportMediumCorruption of facets array on selector replacementzkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportMediumFreezable property applies to individual selectors instead of facetszkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportMediumMerkle library verifies intermediate inputszkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportMediumProof replayabilityzkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowIncomplete DocstringsZKsync Paymaster Audit · OpenZeppelin · 5 Feb 2025Fixed
The report gives no description here.
Open the reportLowNaming SuggestionZKsync Paymaster Audit · OpenZeppelin · 5 Feb 2025Fixed
The report gives no description here.
Open the reportLowRace Condition During CancelationZKsync Paymaster Audit · OpenZeppelin · 5 Feb 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowClaim Can Be Prevented by Anyone if Front-RanZK Token, Capped Minter, and Merkle Distributor Au · OpenZeppelin · 5 Feb 2025Fixed
The report gives no description here.
Open the reportLowClaim Cap Is Not Enforced on Merkle DistributorZK Token, Capped Minter, and Merkle Distributor Au · OpenZeppelin · 5 Feb 2025Fixed
The report gives no description here.
Open the reportLowNot All Delegation Parameters Are SignedZK Token, Capped Minter, and Merkle Distributor Au · OpenZeppelin · 5 Feb 2025Fixed
The report gives no description here.
Open the reportLowProblematic Edge Cases When Using delegateBySigZK Token, Capped Minter, and Merkle Distributor Au · OpenZeppelin · 5 Feb 2025Fixed
The report gives no description here.
Open the reportLowThe Domain of The Permit Functionality Is Not InitializedZK Token, Capped Minter, and Merkle Distributor Au · OpenZeppelin · 5 Feb 2025Fixed
The report gives no description here.
Open the reportLowVoting Checkpoints Refer to Block Numbers Despite Unstable Block Production FrequencyZK Token, Capped Minter, and Merkle Distributor Au · OpenZeppelin · 5 Feb 2025Fixed
The report gives no description here.
Open the reportLowIncorrect and Missing DocumentationZKsync L1 Governance Diff Audit · OpenZeppelin · 23 Oct 2024Fixed
The report gives no description here.
Open the reportLowLack of Hyperchain-ID-Specific (Un)freeze ReinforcementZKsync L1 Governance Diff Audit · OpenZeppelin · 23 Oct 2024Fixed
The report gives no description here.
Open the reportLowNaming SuggestionsZKsync L1 Governance Diff Audit · OpenZeppelin · 23 Oct 2024Fixed
The report gives no description here.
Open the reportLowInconsistent Counting ModeZKsync L2 Governance Audit · OpenZeppelin · 23 Oct 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowInconsistent Use of msg.sender and _msgSender()ZKsync L2 Governance Audit · OpenZeppelin · 23 Oct 2024Fixed
The report gives no description here.
Open the reportLowEmitting Deleted ValueZKsync State Transition Diff Audit · OpenZeppelin · 4 Jun 2024Fixed
The report gives no description here.
Open the reportLowLack of EventsZKsync State Transition Diff Audit · OpenZeppelin · 4 Jun 2024Fixed
The report gives no description here.
Open the reportLowMissing and Incomplete DocumentationZKsync State Transition Diff Audit · OpenZeppelin · 4 Jun 2024Fixed
The report gives no description here.
Open the reportLowPubdataSource Does Not Account for Validium ModeZKsync State Transition Diff Audit · OpenZeppelin · 4 Jun 2024Fixed
The report gives no description here.
Open the reportLowStateTransitionManager Role-Specific Functions Cannot Be Reached in Admin FacetZKsync State Transition Diff Audit · OpenZeppelin · 4 Jun 2024Fixed
The report gives no description here.
Open the reportLowrequire Statement With Multiple ConditionsMatterlabs EIP-4844 Support Audit · OpenZeppelin · 5 Feb 2024Fixed
The report gives no description here.
Open the reportLowMissing TestszkSync Keccak256 Upgrade Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowPrecompile Keccak256 Contract Is Missing Constructor CodezkSync Keccak256 Upgrade Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowImproper Hash Value for Unused Leaves in Merkle TreezkSync L1Messenger Upgrade Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowMisleading CommentzkSync L1Messenger Upgrade Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowMissing Error Messages in require StatementszkSync L1Messenger Upgrade Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowUse of Magic NumberszkSync L1Messenger Upgrade Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowMisleading DocumentationzkSync L2 Block Refactor Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowMisleading Variable NamingzkSync L2 Block Refactor Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowMissing DocstringszkSync L2 Block Refactor Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowMissing Error Message in require StatementzkSync L2 Block Refactor Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowBridge Cannot Recover FundszkSync Bridge and .transfer & .send Diff Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowMissing and Misleading DocumentationzkSync Bridge and .transfer & .send Diff Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowMissing Error Messages in require StatementszkSync Bridge and .transfer & .send Diff Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowUnsafe ABI EncodingzkSync Bridge and .transfer & .send Diff Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowFunds Can Get Lost in WETH BridgezkSync WETH Bridge Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowInterface MismatchzkSync WETH Bridge Audit · OpenZeppelin · 29 Jan 2024Fixed
The report gives no description here.
Open the reportLowFloating Pragma Solidity VersionzkSync Fee Model and Token Bridge Audit · OpenZeppelin · 9 Mar 2023Fixed
The report gives no description here.
Open the reportLowImplicit Zero Cost AssumptionzkSync Fee Model and Token Bridge Audit · OpenZeppelin · 9 Mar 2023Fixed
The report gives no description here.
Open the reportLowL2ERC20Bridge Is Not UpgradeablezkSync Fee Model and Token Bridge Audit · OpenZeppelin · 9 Mar 2023Fixed
The report gives no description here.
Open the reportLowLack of EventszkSync Fee Model and Token Bridge Audit · OpenZeppelin · 9 Mar 2023Fixed
The report gives no description here.
Open the reportLowMissing Error Messages in require and revert StatementszkSync Fee Model and Token Bridge Audit · OpenZeppelin · 9 Mar 2023Fixed
The report gives no description here.
Open the reportLowPotential EIP-1052 DeviationzkSync Fee Model and Token Bridge Audit · OpenZeppelin · 9 Mar 2023Fixed
The report gives no description here.
Open the reportLowsetValueUnderNonce Value Is MutablezkSync Fee Model and Token Bridge Audit · OpenZeppelin · 9 Mar 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowL2 transaction hash is not emittedzkSync · OpenZeppelin · 8 Mar 2023Fixed
The report gives no description here.
Open the reportLowMissing documentationzkSync · OpenZeppelin · 8 Mar 2023Fixed
The report gives no description here.
Open the reportLowDocumentation and Code MismatchzkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportLowImprecise Naming of Transaction Struct ElementszkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportLowIncompatible Function SyntaxzkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportLowInexplicit Fail in Bridge BurnzkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportLowInexplicit ImportszkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportLowLack of Revert MessageszkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportLowMismatch Between Interface and ImplementationzkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportLowMissing Interface for L2EthTokenzkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowTypeScript Constant Names Are InconsistentzkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportLowUnused FunctionszkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportLowWrong EIP-712 Transaction Type CheckzkSync Bootloader Audit Report · OpenZeppelin · 27 Jan 2023Fixed
The report gives no description here.
Open the reportLowLack of explicit proposal idzkSync Layer 1 Diff Audit · OpenZeppelin · 13 Dec 2022Fixed
The report gives no description here.
Open the reportLowMissing error messages in require statementszkSync Layer 1 Diff Audit · OpenZeppelin · 13 Dec 2022Fixed
The report gives no description here.
Open the reportLowReimplementation of library functionalityzkSync Layer 1 Diff Audit · OpenZeppelin · 13 Dec 2022Fixed
The report gives no description here.
Open the reportLowRequire statement with multiple conditionszkSync Layer 1 Diff Audit · OpenZeppelin · 13 Dec 2022Fixed
The report gives no description here.
Open the reportLow_proveBlock while loop could run out of gaszkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowConfusing event emission when executing diamond cut proposalszkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowDiamondInit can be initialized itselfzkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowGas optimizationszkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowGetter returns misleading valuezkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowInterface and contract function parameter mismatchzkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowLack of DocumentationzkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowLack of event informationzkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowLack of l2Logs validationzkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowPreimage hash collision protection for storage pointerszkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowRequire statements with multiple conditionszkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowUnused input to commit blockszkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportLowUnused L2Messages can be committed to L1zkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportShow 1 more
LowUnverified inputs during block commitmentzkSync Layer 1 Audit · OpenZeppelin · 23 Nov 2022Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="zksync"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us