OpenZeppelin

OpenZeppelin is a security firm founded in 2015 that performs smart contract, infrastructure and zero-knowledge audits and maintains the OpenZeppelin Contracts library, whose Solidity repository showed about 27.3k GitHub stars on 2026-09-24. It fits teams that build on OpenZeppelin libraries or need repeat, long-running audit relationships across EVM and a growing set of non-EVM ecosystems. The strongest evidence-backed signal is how often it publishes: its research index listed twelve audit reports between late July and mid-September 2026. On 17 September 2026, S&P Global announced an agreement to acquire the company, pending closing conditions.

At a glance

Founded	2015 (about page)
Headquarters / jurisdiction	The about page describes a distributed global team of "100+". No headquarters address was confirmed in this pass. Ownership is changing: S&P Global agreed to acquire the company on 2026-09-17, pending close (announcement)
Engagement model	Private firm audit, plus a "Continuous Security Program" retainer (about)
Core specialties	Solidity and DeFi audits, L1/L2 and infrastructure, ZK proofs, token and governance standards
Ecosystems / languages	Solidity, Cairo, Rust and Go per the audit page; published work also covers Solana (Rust/Anchor), TRON (Solidity), Miden and SP1 (ZK)
Public report index	openzeppelin.com/research (security audits section). The directory's listed URL, /security-audits, is a services landing page, not a report list
Open-source tooling	OpenZeppelin Contracts (Solidity, Cairo, Stylus, Stellar, Sui variants), Upgrades plugins, Contracts Wizard, Ethernaut, open-source Relayer and Monitor (GitHub)
Published pricing	Not published

What they do

The security audits page describes four steps:

1. Pre-audit: documentation and test-suite review, supported by an in-house "Code Inspector" tool.
2. Audit: every line is reviewed by at least two researchers, with fuzzing where relevant.
3. Fix review: findings are tracked through a dedicated platform.
4. Ongoing support: a communication channel stays open after the engagement.

The about page lists smart contract audits, blockchain infrastructure audits, ZKP audits and a Continuous Security Program.

The hosted Defender operations platform is being retired. Sign-ups closed, and the hosted service was scheduled to shut down on 1 July 2026. OpenZeppelin now directs users to self-hosted, AGPL-licensed open-source Relayer and Monitor (Defender sunset FAQ). Buyers who expect "audit plus Defender monitoring" should confirm what post-deploy monitoring is offered today.

Acquisition: S&P Global's agreement to acquire OpenZeppelin was announced on 17 September 2026 and is pending closing conditions. OpenZeppelin says audits and engineering continue with the existing team, and that the Contracts libraries stay free and open source (announcement).

Specialties and ecosystem coverage

• EVM / Solidity: Heavily evidenced. Most entries in the research index are Solidity audits.
• Solana: Confirmed. Examples are the 1inch Fusion Swap for Solana audit (Rust/Anchor, published July 2025) (report) and Solana research such as "Relocation-Oriented Programming on Solana" (May 2026) (post).
• Starknet / Cairo, Stellar (Soroban), Sui (Move), Arbitrum Stylus (Rust): Evidenced by maintained library repos on GitHub, and Cairo is named on the audit page. None of these appear in the directory's chain list.
• L2s and ZK: The audit page lists ZKsync (46 audits; the card dates the relationship from 2020, with client data "as of April 2025") and Optimism (5 audits since 2022). The same page now also lists the Ethereum Foundation (3 audits, 2022) and WisdomTree (1 audit, 2025), two of the directory's notable clients that the September pass could not verify. Recent reports include SP1 changes and Miden (research).
• TRON: A TRON Foundation library audit was published 2026-09-17 (research). TRON is not in the directory's chain list.
• Base, BNB Chain, Avalanche, Polygon: These directory chains were not specifically confirmed by a report in this pass.

Recent public work

Pulled from the security-audits section of openzeppelin.com/research on 2026-09-24. Re-checked on 2026-10-14, the index had added Uniswap Universal Router (two reports, 2026-10-08), CACEIS EURXT (2026-10-02), Uniswap Token Launcher (2026-09-29) and ONCHAINID (2026-09-29) above the entries below:

1. TRON Foundation Library and Upgradeable Contracts Audit (2026-09-17)
2. Miden Smart Contracts Audit (2026-08-26)
3. StableGold Audit (2026-08-19)
4. Across Protocol V5 Bridging System Audit (2026-08-17)
5. Contracts V5 Audit (2026-08-17)
6. SP1 and USP changes Audit (2026-08-17)
7. UMA OOReporter Audit (2026-08-10)
8. 1inch Aqua and SwapVM MVP v1.0 Audit (2026-07-28)

The audit page also lists long-running client relationships, each with an audit count and start year: Compound (74 audits, since 2019), The Graph (43, since 2020), ZKsync (46, since 2022), Origin Protocol (20, since 2021), Uniswap Labs (9, since 2020), Aave (8, since 2019) and Optimism (5, since 2022).

Research, tooling and methodology

• Libraries: OpenZeppelin Contracts (about 27.3k stars on 2026-09-24), its upgradeable variant, and ports for Cairo, Stylus, Stellar and Sui.
• Operations tooling: open-source Relayer and Monitor, which replace hosted Defender (FAQ).
• Training: the Ethernaut wargame (GitHub).
• Research: low-level Solana work, such as ELF relocation-based code injection in SBPF v0–v2 (post).
• Report format: published reports give scope (repository and commit), timeframe, and severity counts with resolution status (Critical/High/Medium/Low/Notes), as in the Fusion Swap report.
• Firm-published figures: 900+ security engagements and 10,000+ vulnerabilities identified (announcement). These are the firm's own figures and were not independently checked.

Track record and incidents

• Audius (July 2022): An attacker reinitialised Audius governance contracts through a storage collision between Audius's proxy and the Initializable pattern, and moved about 18M AUDIO. rekt.news states that the contracts had been audited by Kudelski and OpenZeppelin. It does not establish whether the colliding proxy layout was in either audit's scope. Audius's post-mortem link returned 404 in this pass, and no OpenZeppelin response was found.
• Aevo / Ribbon (December 2025): rekt.news reports a loss of about $2.7M. It attributes the loss to a December 2025 oracle upgrade that removed access controls, and says this came four years after a 2021 OpenZeppelin audit of Ribbon V2. On rekt's account, the exploited code was written after the audit and therefore outside its scope.

An exploit after an audit does not by itself show that a finding was missed.

Who should consider them — and who might look elsewhere

The public evidence is strongest for Solidity DeFi, bridges, L2s, and teams already using OpenZeppelin Contracts. It also covers Solana, Cairo, and ZK systems such as SP1 and Miden. The firm fits teams that want an ongoing retainer rather than a single engagement. Teams that want managed post-deploy monitoring should confirm the current offering, since hosted Defender has been retired. Teams sensitive to vendor ownership should note the pending S&P Global acquisition. Anyone wanting a published price, or a competitive-contest format, will not find either on OpenZeppelin's pages.

How to engage

Use the "Request a Security Audit" or "Talk to an Expert" form at openzeppelin.com/request. The page says the team will follow up on next steps. The published process starts with documentation and test-suite review (audit page), so prepare a frozen commit, specifications, and a passing test suite.

Gaps and unverified claims

• Pricing and turnaround are not published. The one sampled report ran 9 days, so the directory's "4-10 weeks" is not firm-published.
• Team size: the about page says "100+", matching the directory.
• The directory's description refers to Defender monitoring, but the hosted Defender service was scheduled to shut down on 2026-07-01.
• The directory's publicReports URL is a services page, not a report index. The index is at /research.
• Of the directory's notable audits, Aave, Compound, The Graph, Uniswap and ZKsync are confirmed on the firm's audit page. Coinbase, Ethereum Foundation, USDT0 and WisdomTree were not verified in this pass.
• Coverage of Base, BNB Chain, Avalanche and Polygon was not confirmed by a specific report.
• Audius's official post-mortem URL returned 404.
• The S&P Global acquisition was pending as of 2026-09-24.

Sources

1. OpenZeppelin — Security Audits, accessed 2026-09-24
2. OpenZeppelin — About, accessed 2026-09-24
3. OpenZeppelin — Research (security audits index), accessed 2026-09-24
4. OpenZeppelin — S&P Global enters agreement to acquire OpenZeppelin, accessed 2026-09-24
5. OpenZeppelin — Defender Sunset FAQ, accessed 2026-09-24
6. OpenZeppelin GitHub org, accessed 2026-09-24
7. OpenZeppelin — Request form, accessed 2026-09-24
8. OpenZeppelin — Fusion Swap for Solana Audit, accessed 2026-09-24
9. OpenZeppelin — Relocation-Oriented Programming on Solana, accessed 2026-09-24
10. rekt.news — Audius REKT, accessed 2026-09-24
11. rekt.news — Aevo REKT, accessed 2026-09-24