CVE-2023-46232 era-compiler-vyper First Immutable Variable Initialization vulnerability

era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain criteria. The proble...

_deployCreate()/_deployCreate2() will not work on ZKSync Era

Lines of code Vulnerability details Bug Description In the contest's Scoping Details, the sponsor states that Universal Profiles might eventually be deployed across multiple chains: Is it multi-chain? LUKSO itself is not a multi-chain. The lsp-smart-contracts are initially intended to be used on...

[bootloader] A bytecode hash without the bytecode (preimage) can be marked as known, breaking the prover

Lines of code Vulnerability details This is a report of a finding in bootloader.yul. While the file is out of scope of the contest, the sponsor stated that they would still accept findings in the file and would judge them separately from the contest. Impact A bytecode hash for which the bytecode...

Default accounts cannot pay transaction fees due to DefaultAccount not calling MsgValueSimulator

Lines of code Vulnerability details Impact Default accounts cannot pay the transaction fees to the bootloader. It's not clear whether the attempts to do so will silently succeed or revert because the behaviour of the CALL opcode in the zkSync Era virtual machine isn't explained in the description...

Wrong Implementation of EIP-712

Lines of code Vulnerability details Impact The EIP-712 uses several parameters. Those parameters are exactly: EIP712Domain string name; string version; uint256 chainId; address verifyingContract; As you can see on the following Domain, ZkSync, is missing one parameter: bytes32 constant...

Users pay excessive gas cost for sending bytecode hashes to L1

Lines of code Vulnerability details Impact When deploying new contracts, users are forced to pay more gas than is required to publish the bytecode hash to the L1. Proof of Concept When users deploy new smart contracts, the protocol marks the hashes of the bytecodes of the contracts as known and...

Unsafe Initializations Of Bridge Contracts

Lines of code Vulnerability details Vulnerability Details During the zkSync initialization process, several complicated tasks would be required to execute. Incorrect configurations in some tasks could lead to unexpected vulnerabilities. One task of the zkSync initialization process is deploying a...

Malicious code in zksync-zkwallet-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bd3b6b946e713de4e537f8421bca9683725288606ef784195ff2e5d01110aea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7398 Malicious code in zksync-zkwallet-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bd3b6b946e713de4e537f8421bca9683725288606ef784195ff2e5d01110aea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview zksync-zkwallet-vue is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

Malicious Package

Overview dependencies-zksync is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

Malicious code in dependencies-zksync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8331d5a7104e71dec7d39359757edf1a15fd227d0aa8c8589ed82cc45ec2c2c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2430 Malicious code in dependencies-zksync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8331d5a7104e71dec7d39359757edf1a15fd227d0aa8c8589ed82cc45ec2c2c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@internxt/cli (>=1.0.5 <=1.2.2), @latitude-data/cli (>=0.0.29 <=1.11.0-canary.8) +10 more potentially affected by CVE-2020-7660 via serialize-javascript (>=7.0.0 <=7.0.2)

serialize-javascript NPM version =7.0.0, =1.0.5, =0.0.29, =0.7.5, =1.3.0, =0.1.0, =1.0.7, =0.2.0, =0.7.0-alpha.6 Source cves: CVE-2020-7660 Source advisory: SNYK:JS-SERIALIZEJAVASCRIPT-570062...