OpenZeppelin is a smart contract security company for teams building onchain financial products. It helps banks, asset managers and protocol teams write, run and review blockchain code that holds real value, combining open source software with security research.
The goal is fewer exploitable flaws in contracts, from the first line of code through to years of live operation. OpenZeppelin is now part of S&P Global.
At A Glance
| Vendor | OpenZeppelin (part of S&P Global) |
|---|---|
| Category | Smart contract security, open source libraries and audits |
| Identities covered | Onchain roles and accounts, transaction signing keys, service secrets |
| Deployment | Open source libraries; self-hosted Relayer and Monitor services |
| Customers | Crédit Agricole CACEIS, USDT0, Uniswap, WisdomTree, Matter Labs |
| Certifications | SOC 2 Type II, CCSS, GDPR, CCPA |
| Founded | 2015 |
| Market classification | DevSecOps |
What OpenZeppelin Does
A bug in a smart contract can move real money irreversibly, so the code and the way it is operated need the same care as a bank’s core systems. OpenZeppelin’s mission is to speed up the world’s move to an open financial system, and it focuses on the uses where that matters most: tokenisation and asset issuance, stablecoins and tokenised deposits, collateral and treasury operations, custody, asset management and yield, and payments and cross-border settlement.
The approach is to standardise. Developers start from reviewed, widely used code instead of writing sensitive logic themselves, operate contracts with open source tooling, and bring in researchers to check what is specific to their project. The same approach covers about 12 blockchain networks, including Ethereum, Base, Arbitrum, Stellar and Sui.
Products
OpenZeppelin Contracts
OpenZeppelin Contracts is a library of open source smart contracts for Solidity, used on Ethereum and other EVM chains. Rather than writing token, access control or upgrade logic from scratch, developers import widely used implementations of the ERC standards. Versions also exist for Starknet (Cairo), Sui (Move), Stellar (Soroban), Arbitrum Stylus (Rust), Zama FHEVM, Midnight and other platforms.
Contract Wizard And Upgrades Plugins
The Contract Wizard lets developers configure and generate a contract in an interactive interface, a quick way to start from the standard library without hand-assembling it. The Upgrades Plugins for Hardhat and Foundry automate proxy deployment for upgradeable contracts and run safety checks that catch upgrade mistakes before they reach a live network.
Contracts MCP
Contracts MCP brings the same standards into AI coding assistants, so an assistant can help write secure contracts that follow OpenZeppelin conventions. Contracts Skills sits alongside it as a developer tool.
Relayer
Relayer is a Rust service for teams that need to send transactions automatically to EVM and non-EVM networks. It handles scheduled jobs, batched calls and gasless meta transactions, takes care of nonce management, fee estimation and status tracking, and can be extended with TypeScript plugins and a JavaScript and TypeScript SDK.
Monitor
Monitor watches for specific onchain activity and sends notifications when configurable conditions are met, so operators hear about suspicious functions, events or transactions quickly. It recovers missed blocks, exposes Prometheus metrics.
UI Builder, Role Manager And Ethernaut
UI Builder generates a React interface for a deployed contract. Role Manager is an open source tool that shows the state of roles in a contract and lets authorised users assign and revoke them. Ethernaut is a game that teaches smart contract security by hacking deliberately vulnerable contracts.
Security Audits And Continuous Security Program
OpenZeppelin researchers audit Solidity, Cairo, Rust and Go code and run separate zero knowledge proof audits. Every line of code in an audit is inspected by at least two security researchers, and the company reports more than 900 audits since 2017. The Continuous Security Program extends that work over time and is scaled with OpenZeppelin AI.
How It Works
The libraries are source code that developers compile into their own contracts. Relayer and Monitor are self-hosted services released under the GNU Affero General Public License v3.0.
| Component | What it does |
|---|---|
| Relayer | Runs locally with Rust or through Docker Compose and is configured with config.json and .env files and a REST API. It is designed to sit behind a reverse proxy or firewall rather than face the public internet. |
| Monitor | A Rust application configured through JSON files for networks, monitors and triggers. It runs locally or in Docker and keeps a checkpoint of processed blocks so it can resume after a restart. |
| Audit process | Audits run in four stages: pre-audit, security audit, fix review and ongoing support. During pre-audit an automated Code Inspector picks up most low severity issues so researchers can focus on deeper flaws. |
Identities And Systems Covered
| Signing keys | Keys that Relayer uses to sign transactions, held locally or in an external key service |
|---|---|
| Onchain roles | Role holders, pending changes and role history for OpenZeppelin AccessControl and Ownable contracts, through Role Manager (currently on Stellar Mainnet and Testnet) |
| Secrets | Monitor secrets supplied as plain values, environment variables or from a vault, with memory zeroization |
| Networks | Relayer covers EVM chains and Solana, with partial Stellar support; Monitor covers EVM, Stellar and Solana, with partial Midnight support |
Integrations
| Area | Integrations |
|---|---|
| Development frameworks | Hardhat, Foundry |
| Key management | HashiCorp Vault (secret and Transit modes), HashiCorp Cloud Vault, Google Cloud KMS, Turnkey, CDP |
| Notifications | Slack, Discord, email (SMTP), Telegram, webhooks, custom scripts |
| Observability | Prometheus, Grafana |
| Wallets | Freighter |
Company Background
| Founded | 2015 |
|---|---|
| Leadership | Demian Brener, founder and CEO |
| Ownership | S&P Global agreed to acquire OpenZeppelin and has completed the acquisition |
Note: This overview is compiled from OpenZeppelin’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.