What happens to OpenZeppelin’s open-source code once S&P Global owns it

S&P Global has agreed to acquire OpenZeppelin, the smart-contract security firm whose open-source code library underpins much of Web3, and the company’s answers on what happens to that code are already on the record. S&P announced the agreement on September 17, placing OpenZeppelin inside the group that includes S&P Global Ratings once the deal closes.

OpenZeppelin says released versions of its Contracts library will remain open source permanently and cannot be withdrawn. That promise sits on a firm legal base for code already published: the current OpenZeppelin Contracts repository uses the MIT License, which grants broad rights to use, copy, modify and distribute the software. Anyone running a released version keeps those rights regardless of who owns the company.

What the license does not settle is the future. Whether unreleased and future versions of OpenZeppelin Contracts will stay under the MIT License is not addressed in the announcements, and a permissive license gives the owner no obligation to keep shipping publicly. OpenZeppelin also said its security audits, engineering work and developer programs will continue with the same team, a pre-closing commitment that could still change by the time the deal completes.

OpenZeppelin says more than $37 trillion in value has been transferred through its Contracts software since 2015, a cumulative figure the company reports itself. The library is a permissively licensed dependency used across much of the Ethereum network, which is why ownership of the company behind it matters to developers even with the license unchanged.

Demian Brener would continue leading OpenZeppelin and report to Yann Le Pallec, president of S&P Global Ratings. Financial terms were not disclosed, and S&P said it does not expect the deal to materially affect its results. Until closing, OpenZeppelin remains the subject of a pending acquisition agreement, and no closing date has been given.