OpenZeppelin Contracts for Cairo

A library for secure smart contract development written in Cairo for Starknet, a decentralized ZK Rollup.

[!TIP] :mage: Not sure how to get started? Check out Contracts Wizard for Cairo — an interactive smart contract generator.

Usage

Prepare the environment

Install Scarb, which includes the Cairo compiler. Use the toolchain specified in the release manifest for the version you install. For repository development and testing, follow Development setup.

Set up your project

Create a new project and cd into it.

scarb new my_project && cd my_project

The contents of my_project should look like this:

$ ls

Scarb.toml src

Install the library

Add the individual packages your contract uses to Scarb.toml. For the ERC20 example below:

[dependencies]
openzeppelin_token = "4.0.1"

Build the project to download it:

scarb build

Use published releases and the documentation for the version you install. The main branch can contain unreleased changes.

Using the library

Open src/lib.cairo and write your contract.

With the openzeppelin_token dependency above, this is an ERC20-compliant contract:

#[starknet::contract]
mod MyToken {
    use openzeppelin_token::erc20::{ERC20Component, ERC20HooksEmptyImpl, DefaultConfig};
    use starknet::ContractAddress;

    component!(path: ERC20Component, storage: erc20, event: ERC20Event);

    // ERC20 Mixin
    #[abi(embed_v0)]
    impl ERC20MixinImpl = ERC20Component::ERC20MixinImpl<ContractState>;
    impl ERC20InternalImpl = ERC20Component::InternalImpl<ContractState>;

    #[storage]
    struct Storage {
        #[substorage(v0)]
        erc20: ERC20Component::Storage
    }

    #[event]
    #[derive(Drop, starknet::Event)]
    enum Event {
        #[flat]
        ERC20Event: ERC20Component::Event
    }

    #[constructor]
    fn constructor(
        ref self: ContractState,
        initial_supply: u256,
        recipient: ContractAddress
    ) {
        let name = "MyToken";
        let symbol = "MTK";

        self.erc20.initializer(name, symbol);
        self.erc20.mint(recipient, initial_supply);
    }
}

Packages

Package READMEs list public modules; manifests specify package versions. openzeppelin_interfaces, openzeppelin_utils and openzeppelin_testing have independent versions.

Package Purpose openzeppelin_access Ownership and role-based permissions openzeppelin_account Starknet accounts and account extensions openzeppelin_finance Vesting openzeppelin_governance Governor, votes, timelock and multisig openzeppelin_interfaces Shared ABI traits and dispatchers openzeppelin_introspection SRC5 interface introspection openzeppelin_merkle_tree Merkle proof verification openzeppelin_presets Deployable contract presets openzeppelin_security Initialization, pausing and reentrancy protection openzeppelin_token Token standards and extensions openzeppelin_upgrades Contract class upgrades openzeppelin_utils Cryptography, deployment and data structures openzeppelin_macros Procedural macros; add as a separate dependency openzeppelin_testing Foundry helpers; add as a separate dev dependency

Learn

Documentation

Check out the full documentation site! AI integrators can start with llms.txt for package catalogs, examples, API references and audit reports.

Cairo

Tooling

Scarb

Development

[!NOTE] You can track our roadmap and future milestones in our Github Project.

See CONTRIBUTING.md for setup, build, test and coverage commands, commit and PR conventions, and documentation updates. Read the Code of Conduct, Cairo guidelines, and architecture before contributing. Release maintainers should follow RELEASING.md.

Security

This project is maintained by OpenZeppelin with the goal of providing a secure and reliable library of smart contract components for the Starknet ecosystem. We address security through risk management in various areas such as engineering and open source best practices, scoping and API design, multi-layered review processes, and incident response preparedness.

Refer to SECURITY.md for more details.

The audit index lists reports with their audited commits and scope.

Smart contracts are an evolving technology and carry a high level of technical risk and uncertainty. Although OpenZeppelin is well known for its security audits, using OpenZeppelin Contracts for Cairo is not a substitute for a security audit.

License

OpenZeppelin Contracts for Cairo is released under the MIT License.

Readme