Building and auditing on Optimism, an EVM-equivalent optimistic rollup on Ethereum: tooling, cross-domain messaging, sequencer risks and preparation.
Optimism is an optimistic rollup on Ethereum built with the OP Stack, an open-source framework also used by other networks. It executes transactions off Ethereum, posts transaction data back to it and relies on fault proofs to challenge invalid state. For a project, it means Ethereum-like development at lower cost, with a set of rollup assumptions that deserve explicit review.
Building on Optimism
Optimism aims for EVM equivalence: contracts written in Solidity or Vyper behave as they would on Ethereum, and the standard tooling works without special compilers. A sequencer orders transactions. Communication with Ethereum goes through cross-domain messenger and bridge contracts, and withdrawals to Ethereum only finalize after a challenge period. Because other OP Stack chains share the same design, code and review experience often carry over between them.
Languages: Solidity, Vyper
Frameworks: Foundry, Hardhat
Transaction costs combine L2 execution gas with a fee for data posted to Ethereum
What auditors look at
Cross-domain messages: checks on the messenger address and on the original sender, and handling of messages that fail or are replayed
Withdrawal flows and the delay before funds are available on Ethereum, including what users can do meanwhile
Sequencer dependency: behavior during downtime or delayed inclusion, and whether price feeds are protected by uptime checks
Bridged assets and the difference between canonical tokens and wrapped versions from third-party bridges
Standard EVM risks, from reentrancy to access control and upgradeable proxy configuration
Before requesting quotes
Describe the deployment targets: Optimism alone, other OP Stack chains, or Ethereum as well
Map each cross-chain flow, its sender, receiver and the privileges it grants
Share the list of predeployed or system contracts your code calls directly
Provide tests that simulate cross-domain messages rather than only local calls