OpenZeppelin

OpenZeppelin is a blockchain security firm, founded in 2015. It is best known for OpenZeppelin Contracts, the free code library that much of Ethereum is built on. That library does not run on Solana. Here, OpenZeppelin's work is audits of Solana programs, research into how Solana runs code, and two free tools that support Solana: Relayer and Monitor. In September 2026, S&P Global agreed to buy the firm. OpenZeppelin says its name, team and free tools stay the same, and Demian Brener stays on as CEO.

Does OpenZeppelin work on Solana?

Partly. OpenZeppelin Contracts is written in Solidity, the language of Ethereum. Solana programs are written in Rust, often with the Anchor framework. So you can't deploy OpenZeppelin's token or access-control code on Solana. On Solana, tokens come from the network's own token programs (SPL Token and Token-2022), not from a library you copy in.

What does carry over is the rest of the firm. It audits Solana programs and the servers around them. It writes research on the Solana virtual machine (SVM). And it keeps up Relayer and Monitor, which both list Solana as a supported network.

One gap is worth knowing. As of October 2026, the networks page on OpenZeppelin's website lists Ethereum, Stellar, Sui, Starknet and others, but not Solana. Its Solana support lives in the docs for individual tools, not in a full product line.

OpenZeppelin Relayer for Solana: gasless transactions and SPL-token fees

OpenZeppelin Relayer is an open-source backend service, written in Rust, that signs, submits and tracks transactions for an app. On Solana it works with mainnet-beta, devnet, testnet and custom RPC endpoints.

It offers two ways to handle fees. In the default mode, users pay network fees in an SPL token instead of SOL. In the other mode, the relayer pays the fees in SOL itself, which lets an app offer gasless transactions. Operators can restrict which tokens, programs and accounts the relayer will touch. If no allowed-token list is set, all tokens are allowed, so it is worth setting one.

The relayer can top up its own SOL by swapping collected tokens through Jupiter JUP$0.273-1.2%, either on a schedule or when a transaction fails for lack of funds. This only works on mainnet. Signing keys can sit in hosted signers such as Google Cloud KMS, HashiCorp Vault, Turnkey or Coinbase CDP, or in a local keystore. The docs recommend a hosted signer for production. The API includes a JSON-RPC endpoint that follows the Paymaster spec, plus REST endpoints for quoting, building and signing transactions. The docs list v1.5.x as the latest stable release.

OpenZeppelin Monitor for Solana programs

OpenZeppelin Monitor watches on-chain activity and sends alerts or triggers automations. On Solana it can:

• follow events from Anchor-based programs by event name (such as Deposit or Withdraw);
• flag program upgrades through BPF Loader upgrade events;
• filter on transaction details such as the fee payer, the accounts involved and whether a transaction succeeded.

It cannot yet filter by function on Solana. Monitor is written in Rust and released under the AGPL-3.0 licence, and the docs list v1.3.x as the production release. That licence matters for some commercial teams: if you change the code and run it as a network service, the AGPL requires you to publish those changes.

OpenZeppelin Solana audits: Across, 1inch and Lombard

OpenZeppelin has published several Solana audit reports, each with a narrow scope:

• Across. OpenZeppelin audited the Solana SpokePool validation mechanism for Across Protocol, which secured the launch of USDC bridging to Solana. The customer story calls this its first review of a Solana program at production scale. It does not give dates or a count of Solana-specific findings.
• 1inch Fusion on Solana. From 31 March to 8 April 2025, it reviewed the fusion-swap and whitelist programs from 1inch at commit 8743d38. It found 11 issues, none critical or high. The one medium finding (the programs emit no events) was left unresolved by design, because of compute costs.
• Lombard. In March 2025 it ran a diff audit of Lombard's Golang infrastructure for LBTC deposits and unstaking on Solana. This was off-chain code, not the on-chain LBTC program. It found 16 issues, 14 of them resolved, including five high-severity issues that were all fixed. One high finding was a wrong log offset that stopped unstake payloads from being notarised. OpenZeppelin recommended reading on-chain account state instead of parsing logs, and Lombard made that change.

An audit covers the code and commit it names, and nothing more. Check the scope of each report before treating a protocol as "audited by OpenZeppelin".

OpenZeppelin security research on the Solana runtime

OpenZeppelin has published two papers on ways to attack Solana itself. Relocation-Oriented Programming on Solana shows how a crafted program file can rewrite its own code as it loads. The program then does something quite different from what its code seems to say. Hidden Syscalls on Solana shows that a program can call built-in system functions under made-up names, as long as each name hashes to the same value as a real one.

Both tricks work only on programs built for older formats (SBPF v0 to v2). The newer SBPF v3 format closes them off. The lesson for anyone checking a deployed program is that its published source and its real behaviour can differ. OpenZeppelin also covered Solana in a risk study of six blockchains, written for banks and other regulated firms.

Confidential tokens on Solana: OpenZeppelin's FHE work

OpenZeppelin plans to bring private, encrypted tokens to Solana. A job ad for a Principal Security Engineer (Solana), posted on 13 August 2026, sets out the plan. The work ports fully homomorphic encryption (FHE), which lets code compute on data it can't read, to the SVM. On top of that, the team will design a standard for private tokens and the tools to use it. The ad says the work runs into 2027 and is planned with the Solana Foundation. The same hire would lead the firm's Solana audits and code libraries.

This is a plan in a job ad, not a shipped product. On EVM chains, the equivalent work already exists: OpenZeppelin's Confidential Contracts library is built on Zama's fhEVM.

OpenZeppelin Contracts, Wizard and audits on other chains

Outside Solana, the firm's main asset is still Contracts. By its own count, contracts built with the library have moved over $38 trillion (October 2026). It says most of the largest stablecoins and tokenized money market funds are built on it.

The library keeps growing. In August 2026 the firm launched RWA Wizard, which writes code for regulated real-world assets, starting on Stellar. In September a new Cairo release shipped for Starknet, and the library went live on TRON.

Around the library sit the Contracts Wizard, which drafts contract code for you, and Contracts MCP, which does the same through an AI assistant. There are also tools for upgrades, user interfaces and admin roles. The audit team reviews code in Solidity, Rust, Go, Cairo and more. The firm cites over 900 security reviews and more than 10,000 bugs caught before launch. Clients can book a one-off review or ongoing cover, which since May 2026 has mixed human review with AI checks.

S&P Global acquisition of OpenZeppelin

On 17 September 2026, S&P Global announced an agreement to acquire OpenZeppelin. The terms were not disclosed, and S&P said the deal will not have a material effect on its results. The Block presented it as S&P extending its risk assessment into the technology behind on-chain markets. The deal was still subject to closing conditions when announced.

OpenZeppelin's own statement made two promises. Contracts and its other open-source tools stay free and publicly maintained on GitHub. Audits and engineering work continue with the same team and brand, and OpenZeppelin runs as its own business unit under S&P. For Solana teams, nothing about Relayer, Monitor or audit engagements has changed so far. The longer-term question is whether a ratings and data owner shifts the firm further towards institutional clients.

What happened to OpenZeppelin Defender?

Defender was OpenZeppelin's hosted service for deploying, watching and upgrading contracts. The firm closed sign-ups in June 2025 and shut it down on 1 July 2026. Relayer and Monitor, made free and open source in 2025, take over its main jobs. The catch is that you now run them on your own servers. They also support Solana and Stellar, which Defender never did.

Who should use OpenZeppelin on Solana?

OpenZeppelin suits three groups on Solana.

• Cross-chain teams that already use it on the EVM. Examples are bridges, DEX aggregators and Bitcoin-yield protocols expanding to Solana, as Across, 1inch and Lombard did. One auditor across chains keeps the review standards consistent.
• Institutions and issuers that want a security vendor with a long record and, after the deal closes, S&P Global behind it.
• Developers who need a self-hosted relayer for gasless or SPL-token fee payments and can run and secure a Rust service and its signing keys.

It is a weaker fit for a Solana-native team that only builds on Solana and wants an auditor with a long list of Solana-only programs. Its public Solana record is short, and its marketing barely mentions Solana. It is also no help to anyone looking for drop-in Solana program templates, which OpenZeppelin does not offer.

Is OpenZeppelin safe? Risks and limitations

OpenZeppelin has no token and holds no user funds on Solana. Project-get lists no on-chain Solana programs for it, so there is no program upgrade authority to check. The risks sit with the code it reviews and the tools you run.

• Audits are bounded. Each report covers named programs at a named commit. Later upgrades are not covered, and accepted findings can stay open, such as the unresolved medium finding in the 1inch Fusion review.
• Your keys, your risk. With Relayer, the operator holds the fee-paying key. A badly configured relayer, for example with no allowed-token or allowed-program list, can be drained by spam or abuse.
• Licence terms. Monitor is AGPL-3.0, which brings obligations if you change it and run it as a service.
• Thin Solana focus. Solana is missing from the company's networks page, and its confidential-token work for Solana is still on the roadmap.
• Ownership change. The S&P Global deal brings a new parent company, and its priorities could shift over time.

OpenZeppelin alternatives for Solana audits and tooling

For audits, the main alternatives are security firms that grew up on Solana, such as OtterSec and Neodyme. They have spent longer on Rust and Anchor code. OpenZeppelin's edge is that it covers many chains and has a long record with banks and funds. The Solana firms have reviewed far more Solana-only code. Many large protocols use more than one firm. Lombard, for example, had OpenZeppelin review its off-chain Solana infrastructure, while Veridise and Ackee Blockchain audited its LBTC Solana program.

For ready-made code, Solana has no direct match for OpenZeppelin Contracts. Teams use the SPL Token and Token-2022 programs and the Anchor framework instead. For relaying and alerts, the main choice is between running OpenZeppelin's free tools yourself and paying a hosted provider to do it.

OpenZeppelin team, founders and history

Demian Brener and Manuel Araoz founded OpenZeppelin in 2015. Brener has been CEO from the start and keeps the job under S&P Global. The leaders also include CTO Jonathan Alexander and COO Barry Duplantis. The firm says it has over 140 staff, working remotely with no fixed head office, and more than 200 active clients.

Its recent work leans towards banks and funds. In August 2026 it teamed up with Pacific Meta to sell its services in Japan. In September it helped build and audit ONCHAINID v3, an identity tool, with T-REX Network. It also checked the code for EURXT, a euro stablecoin from Crédit Agricole CACEIS, before its launch under the EU's MiCA rules.