Sequencer correctness
Ordering, censorship resistance, and escape hatch enforcement that determine whether users can exit independent of the operator.
// Services / L2 Infrastructure
L2 security spans more than smart contracts.
Layer-2 infrastructure combines smart contract security with deeper system-level concerns: sequencer logic, proof systems, data availability, escape hatches, validator and operator behavior. The contracts on L1 are only part of the attack surface. The Rust or Go binary running the sequencer, the zk circuit verifying state transitions, the data availability layer storing transaction batches — all of these can fail in ways that drain user funds without the L1 contracts ever appearing exploitable.
Audit firms that only review Solidity miss most of this. Manual review across the full stack — circuits, sequencer code, L1 contracts — is so expensive that few teams do it before mainnet.
// Attack surface
Where the bugs hide.
Proof system bugs
Constraint underdetermination in zk circuits, malleability, and edge cases in fault proofs that let invalid state transitions through unchallenged.
Data availability
Assumptions about what data must be published, and what fails — silently or otherwise — if it isn't.
L1 bridge contracts
Deposit and withdrawal correctness, including the path where withdrawals depend on proof system output rather than direct contract logic.
Operator key management
Sequencer keys, prover keys, and multi-sig setups for upgradeability, where centralized failure becomes systemic risk.
State root validation
Whether state roots committed to L1 actually reflect verifiable computation, or whether the verifier accepts roots it shouldn't.
Built on years of L2 work.
Kurt's expertise in L2 infrastructure is a core part of why Zero Cool can audit this category. Both founders spent years at Spearbit and Certora reviewing L2 designs and proof systems. Through Offbeat Security they worked with Optimism and zkSync, two of the most studied L2 systems in the field. The patterns they learned — sequencer compromise scenarios, proof system edge cases, escape hatch flaws — are embedded into how the agents prioritize across the full L2 stack.
ZERO COOL
Find what others
miss
For protocol teams and security leaders who want exploit-grade coverage backed by proof, not promises.
Request a demo