# Should OpenZeppelin ERC20 Contracts be audited?

**URL:** <https://forum.openzeppelin.com/t/should-openzeppelin-erc20-contracts-be-audited/34432>\
**Category:** Security\
**Created:** [January 30, 2023, 8:05am UTC](https://forum.openzeppelin.com/t/should-openzeppelin-erc20-contracts-be-audited/34432 "2023-01-30T08:05:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Diornov](https://avatars.discourse-cdn.com/v4/letter/d/3e96dc/32.png) [@Diornov](https://forum.openzeppelin.com/u/Diornov)\
**Post date:** [January 30, 2023, 8:05am UTC](https://forum.openzeppelin.com/t/should-openzeppelin-erc20-contracts-be-audited/34432/1 "2023-01-30T08:05:57Z")

</div>

Most of us know how "audit companies" work in our world, especially in low range prices (1-5k$). They just run our contracts through few automated tools to check for vulnerabilities and than do a fancy report in pdf.

Audits are not protecting users from rug pulls or from infinite mints, also we know that most of the web3 hacks are happening from bridges.

So my question should OpenZeppelin ERC20 contracts be audited before deploying? Because currently I'm bootstrapping the project myself and I can't afford to pay 50-100k$ to real audit companies to check my code nor I'm planning to make any changes to OZ contracts. I'm just looking to deploy an ERC20 Burnable Token and wanted to make sure is it necessary to audit something so popular and tested as OpenZeppelin Contract?

---

<div class="post-metadata">

**Author:** ![ericglau](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/ericglau/32/15149_2.png) [@ericglau](https://forum.openzeppelin.com/u/ericglau)\
**Post date:** [January 30, 2023, 7:58pm UTC](https://forum.openzeppelin.com/t/should-openzeppelin-erc20-contracts-be-audited/34432/3 "2023-01-30T19:58:47Z")

</div>

Please see the [Security section of the readme](https://github.com/OpenZeppelin/openzeppelin-contracts#security) in the OpenZeppelin Contracts repository.

---

<div class="post-metadata">

**Author:** ![SKYBITDev3](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/skybitdev3/32/19072_2.png) [@SKYBITDev3](https://forum.openzeppelin.com/u/SKYBITDev3)\
**Post date:** [August 2, 2023, 6:21pm UTC](https://forum.openzeppelin.com/t/should-openzeppelin-erc20-contracts-be-audited/34432/4 "2023-08-02T18:21:57Z")

</div>

There's no definitive "yes" or "no" answer as it'd depend on many factors e.g. how big the stakes are.  
Generally, OpenZeppelin's code can be considered safe, as long as you didn't make any changes to any of it.  
Your own code should be checked by experienced developers.