Why Smart Contracts Safe on Ethereum Can Fail—and Get Exploited—on L2s

Deploying smart contracts to Layer 2 networks like Polygon, Arbitrum, or Optimism carries distinct security risks that differ significantly from Ethereum mainnet, even though the EVM remains largely compatible. Key differences include block timestamp precision, sequencer behavior, and bridge trust assumptions, all of which can introduce exploitable vulnerabilities. A real-world example is the February 2022 Umbrella Network hack, in which attackers drained $3.8 million by exploiting low-liquidity conditions typical of L2 environments at launch. On Arbitrum, for instance, block.number can return the L1 block number rather than the local one, causing timing logic to behave unexpectedly, while centralized sequencers on Arbitrum and Optimism can reorder or delay transactions in ways Ethereum's mempool cannot. Security auditors who do not account for these environment-specific differences risk missing the vulnerabilities most likely to result in protocol losses.