Scroll smart contract audits
Scroll is a zkEVM rollup that runs Ethereum bytecode. We audit contracts for Scroll. $999 per audit, or $499 if we find no High or Critical issues.
We already audit on
- Sherlock
- Cantina
- Immunefi
What we check on Scroll
Messenger checks
Sender checks on the L1 and L2 Scroll messengers, and replays of failed messages.
Precompiles
Precompiles that are disabled or behave differently from L1.
Fees
The L1 data fee, which changes what users actually pay.
The ZK checklist
Under-constrained circuits
Signals that are assigned but never constrained, missing range checks, and witnesses that let more than one proof pass for the same statement.
Soundness
Field overflow and aliasing, and hints computed outside the circuit that nothing checks.
Nullifiers and replay
How nullifiers are derived, whether double spends are blocked, and whether public inputs are bound to the chain, contract and user.
Verifier contracts
Public input validation, curve point checks, and how the verification key is stored and set.
Fiat-Shamir
Transcripts that leave out values the prover controls, and biased hash-to-field.
Rollup and bridge contracts
State commitments, forced inclusion, escape hatches and L1 to L2 message checks.
Questions
How much does a Scroll smart contract audit cost?
$999 per audit, or $499 if we find no High or Critical issues. You pay a $10 deposit to start, which we subtract from the final payment.
What do you check in Scroll contracts?
The ZK checklist (under-constrained circuits; soundness; nullifiers and replay; verifier contracts; fiat-shamir; rollup and bridge contracts), plus issues specific to Scroll: messenger checks; precompiles; fees.
Who does the audits?
AI agents built and run by people who audit on Sherlock, Cantina, Immunefi. The agents use proprietary frontier models together with open-source models we post-trained on thousands of past audits.
What do I need to start?
A link to a GitHub commit (for example https://github.com/org/repo/commit/<sha>), an email address, and the $10 deposit. We email you a link to the results when the audit is done.