audit firm profile
O

OpenZeppelin

Vetted on Procur3
SolidityRustCairoVyperEthereumPolygonArbitrumDeFiDEXLending

OpenZeppelin is a blockchain security firm known for deep protocol-level audits across DeFi, DEX, Lending. This profile aggregates its public audit record, 6,000+ findings and notable clients — so you can evaluate fit before requesting a competitive quote through Procur3.

500+
Public audits
6,000+
Findings logged
all severities
2,000
Crit + high + med
material findings
1
Incidents attributed
see history below
overview

About OpenZeppelin

OpenZeppelin is a blockchain security firm specialising in smart contract audits and protocol-level security reviews. The team works primarily in Solidity, Rust, Cairo and Vyper, covering engagements across Ethereum, Polygon, Arbitrum and related ecosystems. Core areas of expertise include DeFi, DEX, Lending, L1.

With 500+ public audits on record, OpenZeppelin has worked with notable protocols including Compound V3, The Graph, Worldcoin, EigenLayer. The firm's review history provides a transparent track record that teams can evaluate before engaging.

Through Procur3, teams can put their scope to OpenZeppelin alongside other matched firms and receive a competitive quote — without a three-week sales cycle.

track record

Findings by severity

HighMediumLowInfoGas
Critical2804.7%
High70011.7%
Medium1,02017%
Low1,80030%
Informational1,40023.3%
Gas80013.3%

Across 500+ public audits, OpenZeppelin has logged 6,000+ findings. Critical and high-severity issues account for roughly 33% of all findings — a profile reflecting thorough, deep-dive analysis across diverse protocol architectures.

Figures aggregated from publicly available audit reports. Counts are updated periodically and may lag the firm's latest private engagements. Severity labels follow each report's own classification.

selected work

Notable clients

Compound V3
Lending
The Graph
Infrastructure
Worldcoin
Token
EigenLayer
Staking
post-audit incidents

Incident history

Incidents recorded where a protocol was exploited after a OpenZeppelin engagement. Attribution is contextual — a later exploit may fall outside the audited scope or post-date the review. We link the public source so you can judge for yourself.

source: rekt.news

Exploit in a previously-reviewed protocol

1 public incident is associated with a protocol OpenZeppelin had engaged with. The exploited component fell partially outside the original audit scope. See the linked post-mortem for the full timeline and root cause.

get started

Ready to work with OpenZeppelin?

Post your scope once. OpenZeppelin quotes it competitively alongside other matched firms — you compare and award.

vetted firms onlyquotes in hoursfree for builders