Are you auditing the rollup or the apps on it?

For an L2 engagement, the rollup itself — the bridge, sequencer, proof system, governance contracts, upgrade paths. App-on-rollup audits are scoped as smart contract audits, with DeFi risk handled inside that track when relevant.

Can you audit fault proofs?

Yes. We have audited fault-proof systems (Cannon, Kona) and the dispute games that run on top. Fault-proof systems are unusually hard to audit because the spec is large, the implementation is large, and the threat model includes long-range games we have to model explicitly.

Do you audit sequencer behaviour?

Yes. Sequencer censorship resistance, MEV exposure, and the force-inclusion path from L1 are all in scope. We have flagged force-inclusion bypasses on multiple engagements.

What about pre-compiles and custom opcodes?

L2-specific precompiles (point evaluation, account abstraction precompiles, custom KZG variants) are in scope and have produced findings on previous audits. Custom opcodes that diverge from the upstream EVM get specific attention.

Layer 2 Protocol Audit

A Layer 2 protocol audit reviews the rollup machinery — the bridge, the sequencer, the proof system, the state-transition function, and the upgrade process — in addition to whatever application contracts run on top. We have audited optimistic and ZK rollups, the precompile sets they ship, and the L1 contracts that bridge value and validate proofs. The work straddles smart contract audit and protocol audit, and the threat model includes both bytecode-level bugs and rollup-specific exits like sequencer censorship and proof-system soundness.

Request a scoping call

What we cover.

L2 engagements span the full rollup stack:

01

Bridge contracts. Deposit, withdrawal, message passing, fee accounting, replay protection, upgrade paths.
02

Sequencer behaviour. MEV exposure, censorship resistance, the L1 force-inclusion path, sequencer-key rotation.
03

Proof system. For optimistic rollups, the fault-proof program and dispute game. For ZK rollups, the prover, the verifier contract on L1, and the trusted setup if applicable.
04

State-transition function. Diff against upstream EVM (or alternative VM), custom precompiles, gas accounting, opcode semantics.
05

Upgrade and governance. The L1 contracts that hold canonical L2 state, the timelock and quorum on upgrades, the emergency-pause path.
06

Genesis and migration. Initial state, migration scripts, and any post-genesis state injection.

Our approach.

Rollup audits run long because the surface is large. We split engagements into workstreams — bridge, prover, sequencer, governance — and assign a lead engineer per workstream. Findings cross-reference between workstreams: a bridge bug that requires a sequencer-level race, for instance, gets reviewed by both leads before the report is written.

For ZK rollups, the prover audit follows our zero knowledge audit methodology. For optimistic rollups, the fault-proof program is treated as a protocol-layer audit — the dispute game is a protocol, not a smart contract.

The bridge is usually the highest-value target on an L2. We audit bridge contracts, the message-passing protocol, and the L1 verification of L2 state, with explicit attention to the one-week withdrawal window and any bypass paths.

What matters in a Layer 2 audit.

The bridge carries the security claim

Most L2 losses do not need a novel VM exploit. They need a path through deposits, withdrawals, message replay, state-root acceptance, upgrade control, or emergency operation. We review the bridge as the place where user funds, L1 assumptions, and L2 execution meet.

Sequencer and proof assumptions are explicit

Every rollup has assumptions about who can order transactions, who can censor, how users force inclusion, how proofs are generated, and what happens when the proof system or sequencer is unavailable. Those assumptions belong in the audit scope because they define the difference between temporary liveness failure and loss of funds.

Upgrade and escape paths need the same review as launch code

Timelocks, guardian roles, governance paths, and emergency pauses.
Force-inclusion, withdrawal, and exit procedures under sequencer failure or censorship.
Proof-verifier replacement, fault-proof changes, and verifier-key updates.
Genesis, migration, and state-injection scripts used during launch or upgrade.

Related research and guidance.

Frequently asked questions.

Are you auditing the rollup or the apps on it?

For an L2 engagement, the rollup itself — the bridge, sequencer, proof system, governance contracts, upgrade paths. App-on-rollup audits are scoped as smart contract audits, with DeFi risk handled inside that track when relevant.
Can you audit fault proofs?

Yes. We have audited fault-proof systems (Cannon, Kona) and the dispute games that run on top. Fault-proof systems are unusually hard to audit because the spec is large, the implementation is large, and the threat model includes long-range games we have to model explicitly.
What about the bridge contracts?

The bridge is usually the highest-value target on an L2. We audit bridge contracts, the message-passing protocol, and the L1 verification of L2 state, with explicit attention to the one-week withdrawal window and any bypass paths.
Do you audit sequencer behaviour?

Yes. Sequencer censorship resistance, MEV exposure, and the force-inclusion path from L1 are all in scope. We have flagged force-inclusion bypasses on multiple engagements.
What about pre-compiles and custom opcodes?

L2-specific precompiles (point evaluation, account abstraction precompiles, custom KZG variants) are in scope and have produced findings on previous audits. Custom opcodes that diverge from the upstream EVM get specific attention.

Other engagements you might be considering.

Scope a Layer 2 protocol audit.

Tell us about the rollup you are building. We respond within two business days.

Request a scoping call

Services

Products

Resources

Company

Social

contact@sigmaprime.io