OpenZeppelin

OpenZeppelin is one of the longest-standing blockchain security companies in the industry, having operated continuously since 2015. Founded by Demian Brener and Manuel Araoz, the firm built its reputation on the open-source Contracts library for Ethereum—a collection of battle-tested, audited smart contract implementations that became the default starting point for developers building on EVM-compatible blockchains. A decade later, the company has expanded into multi-chain security auditing, institutional services, and Solana-specific research and audit work.

The Contracts Library

The OpenZeppelin Contracts library is the most widely deployed smart contract library in production. According to the company, $33.2 trillion in value has been transferred through contracts built on its code, with over $250 billion in assets currently protected. It provides standardized, audited implementations of token standards (ERC-20, ERC-721, ERC-1155), access control patterns, governance modules, and upgrade mechanisms.

The library's reach reflects its market position: 9 of the top 10 stablecoins by market cap and 10 of the top 10 tokenized money market funds use OpenZeppelin Contracts as a foundation. In July 2026, the company released Contracts 5.7, adding account abstraction paymaster support, cross-chain token bridge primitives, and new deployment tooling—continuing active maintenance a full decade after the library's initial release.

Alongside the library, OpenZeppelin offers the Contracts Wizard, an interactive tool for generating compliant smart contract scaffolding, and Contracts MCP, which provides AI-assisted secure contract development through the Model Context Protocol.

Security Auditing

OpenZeppelin's audit practice covers Solidity, Rust, Go, Cairo, and other languages used across major blockchain ecosystems. The firm has completed over 900 audits since 2017, identifying more than 700 critical and high-severity vulnerabilities across protocols including Compound (74 audits), 1inch (19 audits), Origin Protocol (20 audits), Uniswap (9 audits), Aave (8 audits), Lido, MakerDAO, Balancer, and Synthetix.

Audit formats range from point-in-time reviews to the Continuous Security Program, which covers architecture-phase through post-deployment support with ongoing AI-assisted analysis. The company updated this program in May 2026 to incorporate automated, AI-powered review pipelines running alongside human expert analysis.

Zero-knowledge proof audits are a more recent capability, reflecting the growth of ZKP infrastructure in Ethereum scaling solutions and privacy-preserving applications.

Solana Audit Work and Research

OpenZeppelin has conducted Solana-specific security audits and published original security research on the Solana runtime.

In 2025 the firm completed two public Solana audits. The first, in March, reviewed Golang-based infrastructure for the Lombard protocol enabling BTC deposits and LBTC minting on Solana, plus unstaking flows back to Bitcoin. The audit identified 16 issues across 5 high, 2 medium, and 3 low categories, with 14 resolved. Key findings included incorrect log offset calculations preventing unstake notarization, invocation log validation errors, and concerns about reliance on Solana's native log parsing. The second, in April, reviewed the 1inch solana-fusion-protocol repository—two Rust programs (fusion_swap and whitelist) covering order creation, escrow management, filling, cancellation, and resolver address management. That audit found no critical or high-severity issues and 11 total findings, with 6 resolved.

On the research side, OpenZeppelin has published technical analyses specifically targeting the Solana execution model, including "Relocation-Oriented Programming on Solana" and "Hidden Syscalls on Solana." These investigate attack surfaces unique to the Solana runtime rather than generalizing from EVM security patterns. The company also included Solana in its Technical Risk Assessment of Blockchain Networks—a multi-chain evaluation covering six networks prepared for regulated financial institutions evaluating chain risk for deployment.

Developer Operations Tooling

For several years, OpenZeppelin offered Defender—a hosted platform for smart contract deployment, monitoring, and automation including relayer services, upgrade management, and alerting. In mid-2025, OpenZeppelin announced the sunset of Defender, disabling new sign-ups in June 2025 with full shutdown on July 1, 2026.

In place of Defender, OpenZeppelin released open source, production-ready versions of two core tools: Relayer, for sending on-chain transactions with nonce management and gas handling, and Monitor, for observing smart contract and program activity for alerting and automation. Both tools now support Solana and Stellar alongside EVM-compatible chains—a broader network footprint than Defender ever offered.

Institutional Positioning

OpenZeppelin serves institutions deploying tokenization, stablecoin, asset management, and settlement infrastructure. The firm reports 200+ active customers with a 95%+ re-engagement rate and a 71 Net Promoter Score. Recent partnerships include a July 2026 collaboration with the Tokenized Vault Foundation implementing ERC-7540 asynchronous vaults for tokenized funds, and a partnership with T-REX Network to advance institutional compliance infrastructure for onchain securities.

Team and Structure

The company employs over 140 people globally. CEO Demian Brener is one of the original co-founders, having led the company through its full decade of operation. The leadership team includes COO Barry Duplantis and CTO Jonathan Alexander. OpenZeppelin operates as a distributed organization without a fixed headquarters location.