S&P Global’s OpenZeppelin deal targets the technology risk behind tokenised markets

S&P Global agreed on 17 September 2026 to acquire OpenZeppelin, adding smart-contract security and engineering to its digital-asset risk-assessment business. The announced structure keeps OpenZeppelin as a separate branded business unit, led by Demian Brener reporting to S&P Global Ratings president Yann Le Pallec.[1]

The disclosed agreement is subject to closing conditions and supplies no financial terms. S&P says the transaction is not expected to have a material effect on its financial results. Its strategic purpose is to extend analysis into the technology supporting on-chain financial products.[1]

Existing software rights survive separately from a corporate transaction

OpenZeppelin says its Contracts libraries will remain free, open source and publicly maintained, and that current audits, engineering work and ecosystem programmes will continue. These are the supplier’s continuity commitments alongside the transaction.[2]

The Contracts repository’s MIT licence already grants recipients broad rights to use, modify and redistribute the code, subject to retaining the copyright and permission notice. It disclaims warranties. An institution’s right to use a released library therefore rests on its licence; a paid support or audit engagement is a separate commercial relationship.[3]

Ownership of the developer also does not itself transfer authority over applications built with its tools. The Upgrades Plugins documentation assigns upgrade authority to configured admin or owner addresses, with different mechanisms for transparent, UUPS and beacon proxies. For a transparent proxy, the owner of the proxy-admin contract controls upgrades.[4]

The plugins can check a proposed implementation for upgrade safety and compatibility before deployment. The authorised account still executes the change. For a token issuer, the significant control is who holds that authority and how an upgrade is approved, rather than the corporate owner of the reusable library.[4]

Security work covers more than choosing a library

OpenZeppelin’s audit process includes advance review of project documentation and tests, inspection by at least two security researchers, recommendations, and a subsequent fix review. Its final report tracks findings and resolutions. That sequence makes the remediation record important alongside the initial list of vulnerabilities.[5]

Its continuous programme instead describes an annual engagement tailored to the institution’s systems, potentially including governance design, infrastructure assessment, deployment verification and monitoring. The commercial model can turn separate review projects into recurring security work; the published description does not establish a uniform tariff or a measured cost saving.[6]

The network can introduce a different risk from the contract

OpenZeppelin’s May network-assessment methodology uses public documents, on-chain data, incident records and governance practices. Its published overview covers six networks and says the exercise exposes structural trade-offs rather than ranking them or recommending one. This supplies an existing analytical framework that S&P’s institutional distribution could bring to more clients.[7]

A tokenised asset can have carefully reviewed code while still depending on a network’s validator concentration, recovery procedures or settlement model. The combination of software assessment and network due diligence helps an institution ask how a system behaves after deployment, as well as whether its initial code contains defects.[7]

Report an error or submit an update