Arbitrum is a family of optimistic rollups that execute transactions off Ethereum and post the resulting data back to it, with fraud proofs allowing incorrect state to be challenged. For a project, it offers lower transaction costs with the familiar EVM development experience, while adding rollup-specific assumptions that must be understood and reviewed.
Building on Arbitrum
Arbitrum is EVM-compatible: Solidity and Vyper contracts compile with the usual toolchains and most Ethereum code deploys with little change. A sequencer orders transactions, and messages between Ethereum and Arbitrum go through dedicated bridge contracts, with withdrawals to Ethereum subject to a challenge period. Arbitrum also supports contracts compiled to WebAssembly, written in languages such as Rust, which run alongside EVM contracts.
- Languages: Solidity, Vyper, and Rust through the WebAssembly environment
- Frameworks: Foundry, Hardhat
- Differences to check: block number and timestamp semantics, gas accounting that includes the cost of posting data to Ethereum
What auditors look at
- Sequencer assumptions: behavior if the sequencer is down or delays transactions, and use of sequencer uptime checks with price feeds
- Cross-chain messaging between Ethereum and Arbitrum: authentication of the sender, address aliasing of L1 contracts, retryable messages that can fail or be redeemed later
- Time and block dependencies that behave differently from Ethereum mainnet
- Bridged tokens: which bridge issued the asset and whether the contract assumes a canonical version
- Classic EVM risks (reentrancy, access control, oracle manipulation), which apply unchanged
Before requesting quotes
- Specify whether the system is Arbitrum only or also deployed on Ethereum or other rollups, and which parts communicate across chains
- Describe every L1 to L2 or L2 to L1 message flow and who is allowed to trigger it
- List the oracles and bridged assets you depend on, and your plan if the sequencer is unavailable
- Indicate whether any code uses the WebAssembly environment, as it requires reviewers with Rust experience