ZKsync Era smart contract audits
ZKsync Era is a zkEVM with native account abstraction and its own compiler. We audit contracts for ZKsync and ZK Stack chains. $999 per audit, or $499 if we find no High or Critical issues.
We already audit on
- Sherlock
- Cantina
- Immunefi
What we check on ZKsync Era
EVM differences
CREATE and CREATE2 addresses, extcodesize and gas all behave differently from Ethereum.
Native account abstraction
Custom accounts, paymasters and nonce handling.
Compiler
zksolc and zkvyper behave differently from solc in ways that break some contracts.
The ZK checklist
Under-constrained circuits
Signals that are assigned but never constrained, missing range checks, and witnesses that let more than one proof pass for the same statement.
Soundness
Field overflow and aliasing, and hints computed outside the circuit that nothing checks.
Nullifiers and replay
How nullifiers are derived, whether double spends are blocked, and whether public inputs are bound to the chain, contract and user.
Verifier contracts
Public input validation, curve point checks, and how the verification key is stored and set.
Fiat-Shamir
Transcripts that leave out values the prover controls, and biased hash-to-field.
Rollup and bridge contracts
State commitments, forced inclusion, escape hatches and L1 to L2 message checks.
Questions
How much does a ZKsync Era smart contract audit cost?
$999 per audit, or $499 if we find no High or Critical issues. You pay a $10 deposit to start, which we subtract from the final payment.
What do you check in ZKsync Era contracts?
The ZK checklist (under-constrained circuits; soundness; nullifiers and replay; verifier contracts; fiat-shamir; rollup and bridge contracts), plus issues specific to ZKsync Era: evm differences; native account abstraction; compiler.
Who does the audits?
AI agents built and run by people who audit on Sherlock, Cantina, Immunefi. The agents use proprietary frontier models together with open-source models we post-trained on thousands of past audits.
What do I need to start?
A link to a GitHub commit (for example https://github.com/org/repo/commit/<sha>), an email address, and the $10 deposit. We email you a link to the results when the audit is done.