OpenZeppelin
Open-source Solidity contract library plus smart contract audits and security services.
No project pays to be listed. How we rank
OpenZeppelin key facts
| Category | Smart contract tool |
|---|---|
| Chains | Ethereum and EVM networks |
| Platforms | Web, Library |
| Open source | Yes, OpenZeppelin Contracts under MIT on GitHub |
| Company | OpenZeppelin; S&P Global has agreed to acquire it |
| Launched | 2016 (Contracts repository created August 2016) |
| Security audits | Each Contracts release audited; v5.6.0 audited February 2026 |
| Free plan | Yes, Contracts library free and open source (MIT) |
| Pricing | Contracts library free; audit prices not published, audits start with a request form |
What is OpenZeppelin?
OpenZeppelin publishes OpenZeppelin Contracts, an open-source Solidity library under the MIT license, plus a Contracts Wizard, audits and open-source Monitor and Relayer tools. Its homepage states that 9 of the top 10 stablecoins are built on OpenZeppelin Contracts and announces an agreement for S&P Global to acquire the company.
How OpenZeppelin works
OpenZeppelin Contracts is imported, not copied: you install the package and inherit from contracts such as ERC20, ERC721 or AccessControl.
Only the functions you use are deployed. The npm package has three tags: latest for audited releases (the default on npm install), dev for final but not yet audited versions that the bug bounty still covers, and next for release candidates. Foundry users install with forge install and add a remapping for @openzeppelin/contracts/.
The audits folder in the repository lists each review: OpenZeppelin audited v5.6.0 in February 2026, and earlier releases back to 2017, with Certora formal verification of modules such as ERC20Votes, TimelockController and AccessControl in 2021 and 2022. The firm's audit service is separate and paid. Its audits page says more than 95% of clients hire it again and lists client data as of April 2025, such as 46 audits for ZKsync and 19 for 1inch.
How to start with OpenZeppelin
- For the library, run npm install @openzeppelin/contracts in a Hardhat project, or forge install OpenZeppelin/openzeppelin-contracts in Foundry, then import what you need.
- Contracts Wizard at wizard.openzeppelin.com generates a starting token or governance contract.
- For an audit, use Request a Security Audit on openzeppelin.com/security-audits.
- Teams still on Defender should note that new sign-ups closed on June 30, 2025 and final shutdown was set for July 1, 2026; the docs point to the open-source Monitor and Relayer as replacements.
Risks to know before using OpenZeppelin
- Security patches ship only for the latest minor of a major version.
- Per SECURITY.md, 5.x gets all fixes, 4.9 and 3.4 get critical fixes only, and 2.5 and older get none.
- Storage layouts differ between major versions, so upgrading a proxy from 4.9.3 to 5.0.0 is unsafe.
- Installing from the master branch through git skips release safeguards, and a later forge update pulls master.
- Vulnerabilities go to the Immunefi bug bounty.
OpenZeppelin alternatives
Other projects people compare with OpenZeppelin.
Browser-based IDE for writing, compiling, testing and deploying Solidity smart contracts.
Open-source Rust toolkit for building, testing, fuzzing and deploying Solidity smart contracts.
Development environment for compiling, testing, debugging and deploying Solidity contracts on EVM chains.
Where OpenZeppelin ranks on DappAtlas
Listed next to OpenZeppelin
- Trail of Bits Security and compliance
- Sigma Prime Security and compliance
- Ackee Blockchain Security and compliance
- CertiK Security and compliance
- Halborn Security and compliance
- Sherlock Security and compliance
OpenZeppelin pros and cons
- Contracts library is free under MIT
- Contracts Wizard generates token and governance contracts
- Homepage states 9 of the top 10 stablecoins use its contracts
- Audits are a paid, quote-based service
- Ownership is changing: S&P Global has agreed to acquire the company
OpenZeppelin FAQ
What is OpenZeppelin?
OpenZeppelin publishes OpenZeppelin Contracts, an open-source Solidity library under the MIT license, plus a Contracts Wizard, audits and open-source Monitor and Relayer tools. Its homepage states that 9 of the top 10 stablecoins are built on OpenZeppelin Contracts and announces an agreement for S&P Global to acquire the company.
Which chains does OpenZeppelin support?
Ethereum and EVM networks.
How much does OpenZeppelin cost?
Contracts library free; audit prices not published, audits start with a request form, according to OpenZeppelin’s own page (checked Oct 1, 2026). Free plan: Yes, Contracts library free and open source (MIT).
Is OpenZeppelin available in the US?
Available: terms restrict only sanctioned jurisdictions, according to OpenZeppelin’s own page (checked Sep 26, 2026).
Sources
- OpenZeppelin: official site
- OpenZeppelin: Contracts on GitHub
- OpenZeppelin: Home
- OpenZeppelin: Contracts audits list
- OpenZeppelin: Terms of Service
- OpenZeppelin: Security Audits
- OpenZeppelin: Contracts security policy
- OpenZeppelin: Contracts docs
- OpenZeppelin: Defender docs
- OpenZeppelin: Phasing out Defender
How this page works
Sources: OpenZeppelin: official site, OpenZeppelin: Contracts on GitHub, OpenZeppelin: Home. Data as of Oct 1, 2026.
Not affiliated with any project listed. Educational content, not financial advice.