Arbitrum smart contract audits
Contracts on Arbitrum are written in Solidity like mainnet contracts, but they run in a different environment. A HYDN Arbitrum audit checks the usual code risks plus the L2 specifics: sequencer downtime and stale prices, L1 to L2 message handling and address aliasing, retryable tickets, and block number and timestamp behaviour that differs from Ethereum.
Arbitrum-specific risks we check
- Sequencer uptime. Oracle reads in lending and derivatives protocols should check whether the sequencer is up and has been for long enough before trusting a price.
- Block number. On Arbitrum,
block.numberreturns an approximation of the L1 block number, so logic that counts blocks to measure time will not behave as it does on mainnet. - L1 to L2 messages. Contracts receiving messages from L1 must check the sender correctly. Messages from L1 contracts arrive from an aliased address, and code that forgets this either rejects valid messages or trusts the wrong caller.
- Retryable tickets. L1 to L2 messages that fail can be retried later, by anyone. Logic that assumes immediate, single delivery needs to handle delays and redemption order.
- Gas. L2 transactions pay for L1 data as well as execution, which affects gas estimates and any logic that relies on gas left.
The rest of the audit
Everything else is the standard HYDN audit: manual review against a fixed commit, a private report with remediation guidance, up to two rounds of fix review, and a final report and certification.
Frequently asked questions
Can we deploy our audited mainnet contracts to Arbitrum unchanged?
Often the code compiles and runs, but assumptions may not hold. Time based logic, oracle reads and any cross-chain messaging should be reviewed for Arbitrum before you deploy.
Why does sequencer downtime matter?
If the sequencer goes down, prices on Arbitrum stop updating while the market keeps moving. When it comes back, positions can be liquidated at prices users had no chance to react to. Lending protocols should check a sequencer uptime feed and allow a grace period.
Published Updated