OpenZeppelin Contracts for Cairo

A library for secure smart contract development written in Cairo for Starknet, a decentralized ZK Rollup.

[!TIP] :mage: Not sure how to get started? Check out Contracts Wizard for Cairo — an interactive smart contract generator.

Usage

Prepare the environment

Install Scarb, which includes the Cairo compiler. Use the toolchain specified in the release manifest for the version you install. For repository development and testing, follow Development setup.

Set up your project

Create a new project and cd into it.

scarb new my_project && cd my_project

The contents of my_project should look like this:

$ ls

Scarb.toml src

Install the library

Add the individual packages your contract uses to Scarb.toml. For the ERC20 example below:

[dependencies]
openzeppelin_token = "4.0.1"

Build the project to download it:

scarb build

Use published releases and the documentation for the version you install. The main branch can contain unreleased changes.

Using the library

Open src/lib.cairo and write your contract.

With the openzeppelin_token dependency above, this is an ERC20-compliant contract:

#[starknet::contract]
mod MyToken {
    use openzeppelin_token::erc20::{ERC20Component, ERC20HooksEmptyImpl, DefaultConfig};
    use starknet::ContractAddress;

    component!(path: ERC20Component, storage: erc20, event: ERC20Event);

    // ERC20 Mixin
    #[abi(embed_v0)]
    impl ERC20MixinImpl = ERC20Component::ERC20MixinImpl<ContractState>;
    impl ERC20InternalImpl = ERC20Component::InternalImpl<ContractState>;

    #[storage]
    struct Storage {
        #[substorage(v0)]
        erc20: ERC20Component::Storage
    }

    #[event]
    #[derive(Drop, starknet::Event)]
    enum Event {
        #[flat]
        ERC20Event: ERC20Component::Event
    }

    #[constructor]
    fn constructor(
        ref self: ContractState,
        initial_supply: u256,
        recipient: ContractAddress
    ) {
        let name = "MyToken";
        let symbol = "MTK";

        self.erc20.initializer(name, symbol);
        self.erc20.mint(recipient, initial_supply);
    }
}

Packages

Package READMEs list public modules; manifests specify package versions. openzeppelin_interfaces, openzeppelin_utils and openzeppelin_testing have independent versions.

Package	Purpose
openzeppelin_access	Ownership and role-based permissions
openzeppelin_account	Starknet accounts and account extensions
openzeppelin_finance	Vesting
openzeppelin_governance	Governor, votes, timelock and multisig
openzeppelin_interfaces	Shared ABI traits and dispatchers
openzeppelin_introspection	SRC5 interface introspection
openzeppelin_merkle_tree	Merkle proof verification
openzeppelin_presets	Deployable contract presets
openzeppelin_security	Initialization, pausing and reentrancy protection
openzeppelin_token	Token standards and extensions
openzeppelin_upgrades	Contract class upgrades
openzeppelin_utils	Cryptography, deployment and data structures
openzeppelin_macros	Procedural macros; add as a separate dependency
openzeppelin_testing	Foundry helpers; add as a separate dev dependency

Learn

Documentation

Check out the full documentation site! AI integrators can start with llms.txt for package catalogs, examples, API references and audit reports.

Cairo

• Cairo book
• Cairo language documentation
• Starknet documentation
• Cairopractice

Tooling

• Scarb

Development

[!NOTE] You can track our roadmap and future milestones in our Github Project.

See CONTRIBUTING.md for setup, build, test and coverage commands, commit and PR conventions, and documentation updates. Read the Code of Conduct, Cairo guidelines, and architecture before contributing. Release maintainers should follow RELEASING.md.

Security

This project is maintained by OpenZeppelin with the goal of providing a secure and reliable library of smart contract components for the Starknet ecosystem. We address security through risk management in various areas such as engineering and open source best practices, scoping and API design, multi-layered review processes, and incident response preparedness.

Refer to SECURITY.md for more details.

The audit index lists reports with their audited commits and scope.

Smart contracts are an evolving technology and carry a high level of technical risk and uncertainty. Although OpenZeppelin is well known for its security audits, using OpenZeppelin Contracts for Cairo is not a substitute for a security audit.

License

OpenZeppelin Contracts for Cairo is released under the MIT License.