OpenZeppelin: tracing the ZKsync OS review to scope and fixes

Measurements in this report

Initial revisions identified in first two scope blocks

2

Report-stated issues

22

Report-stated resolved issues

16

Report-stated partially resolved issues

1

Evidence coverage against the seven criteria

These are research observations. All scores are withheld until independent reviewers assess the evidence.

Why this artifact was selected

We followed OpenZeppelin's research index to the ZKsync OS audit as a purposive example of protocol-level Rust work. It is not claimed to be the latest audit or a representative sample of all OpenZeppelin engagements. The article is dated October 15, 2025 and states a June 9 to June 20, 2025 audit timeline.

Original traceability check

The first two scope blocks identify repository revisions 96d9d37 and 0563213 and enumerate directories under review. This gives a reader a starting point for reconstructing the assessment. The source explicitly excludes two account-model files because account abstraction was not supported at that point. A reference to the project name alone would conceal that boundary.

Our check records two named initial scope revisions in those blocks, a directory-level scope, technical issue narratives and per-issue updates. We did not independently resolve every short hash, reproduce the build or verify that the final deployed system matches either assessed revision. These are evidence-presence observations.

A summary count is not a closure decision

The report's summary states 22 issues, with 16 resolved and one partially resolved. Those figures come from the provider's report, not from a new vulnerability test by DSA. Readers must inspect individual statuses before treating the engagement as complete.

For example, the gas-accounting discussion carries an acknowledged, unresolved update, while other findings link to corrective pull requests and commits. The distinction is useful: acknowledging a risk, scheduling a change and verifying a fix are separate outcomes. A shortlist comparison should preserve the difference instead of reducing all three to an audit-completed badge.

Fit for a proposed engagement

This artifact supplies evidence of a published review concerning Rust execution infrastructure and EVM behavior. That supports a targeted discussion about protocol internals. It does not automatically demonstrate equal depth for every Solidity application, non-EVM chain or financial mechanism.

Before commissioning work, request two more recent comparable project reports, the people assigned to the engagement, how reviewers will model trust boundaries and the final version-validation procedure. Ask how unresolved deviations from the expected execution specification will be recorded and who can accept them. No technical score is issued from this single sample.

Five recent project candidates

The expanded packet includes Miden, StableGold, TxFlow, Across v5 and the Ross Protocol contracts-v5 review. The official pages are dated August 17 to August 26, 2026. Each has explicit scope and issue-update material. The TxFlow scope uses a deployed contract address; the other four identify repository commits. These different anchors must not be collapsed into a single commit-present flag. Index ordering selected the candidates, not a claim to have enumerated every OpenZeppelin engagement.

Limits and next verification step

This is a bounded review of public evidence. We did not rerun exploits, inspect private workpapers, interview the assigned audit team or verify current booking availability. The observations describe the cited artifacts and cannot establish the provider's overall defect-detection rate. A procurement decision still needs a scoped proposal, relevant recent work and independent technical review.

Sources and reproducibility

Sources were opened on September 5, 2026. The data download records content hashes and measurement definitions. Counts describe the selected artifacts; provider-reported findings were not independently reproduced.

1. OpenZeppelin ZKsync OS audit · checked 2026-09-05SHA-256: 02eedac03d6f177cc389c6a828d4a15e347a6ca3b131b34072ed1632de6d2887
2. Official research index · checked 2026-09-05SHA-256: 8987a14adf5e106ceed163b87deaab2b2aa6d1235f1d97fcf2f3936d7fbb7e6b
3. Published audit process · checked 2026-09-05SHA-256: 14277e05b221f30ffa19aa08891b32b921dcaf844ae040b726b50cb83357f5d0
4. miden smart contracts audit · checked 2026-09-05SHA-256: 632decfd12453e01c98a02679fdbd85bcd740bb601820185687870f691c5488f
5. stablegold audit · checked 2026-09-05SHA-256: 829c7cd3ef566f872dcb4071676e2c57d1fe4be8b10bc7d099fea56473c07d6a
6. txflow security audit · checked 2026-09-05SHA-256: 5c28ea5d09b9787d6c862fbc0d639808b0fb5fff02586c381a585c57303049cf
7. across protocol v5 bridging system audit · checked 2026-09-05SHA-256: 0877575dfd549ffe84e4649c6255b7cf161fb3dfd6c907a6ad01d614dbbbf527
8. contracts v5 audit · checked 2026-09-05SHA-256: 61ab0f61244b136825281e6892c22de8fe35286a2c889214fa65e73c5f1ee100