Hedging during liquidation is incorrect

Lines of code Vulnerability details Impact Hedging will not work as expected, and LiquidityPool will lose funds without expectation. Proof of concept 1. When a short position is liquidated in contract Exchange, function liquidate will be triggered. It will burn the power perp tokens and reduce th...

characterModifier is uint8 but encodes 1.38e24 different Zalgo distortions.

Lines of code Vulnerability details Impact Only 256 Zalgo distortions are possible, which is a miniscule fraction of the actual combinations possible. Proof of Concept A Zalgo tile is defined by a letter and a modification consisting of a combination of characters above, over and below the letter...

Namespace fuse ignores font class attribute from tile data

Lines of code Vulnerability details Impact The fuse function present in the Namespace contract mints a new Namespace NFT based on the given character data that references Tray tiles owned by the caller. For each character, the implementation will use the characterToUnicodeBytes function from the...

Profile Picture: Address Registry should maintain storage between consecutive deploys

Lines of code Vulnerability details H-01 Profile Picture: Address Registry should maintain storage between consecutive deploys This vulnerability is more in the code of Canto Identity Protocol, but it impacts the ProfilePicture Subprotocol. A ProfilePicture NFT with id=pfpId is linked to a CID NF...

[term-fix] Mitigation Error

Lines of code Vulnerability details Note - The term refactoring has been made for the following reason: Our main KIBT is intended to be backed by 1-year treasury bill tokens, however, a bond issued on 1 Jan 2023 does not have the same amount of seconds compared to a 1-year treasury bill issued on...

JSON context breaking in Bio.tokenURI

Lines of code Vulnerability details Impact Bio.tokenURI function returns an encoded JSON which is supposed to be parsed by a browser or another tool. The field description contains unsanitized user input and can be fully controlled by a hacker when they create an NFT via Bio.mintstring calldata...

The user may lose the remaining tokens once the partial withdraw completed in processWithdraws() function. Unable to access the old withdrawalQueue once the queuedWithdrawalHead incremented

Lines of code Vulnerability details Impact User lose the tokens once partial withdraw completed. Proof of Concept function processWithdrawsuint256 count external override nonReentrant whenNotPaused"POOLPROCESSWITHDRAWS" assertqueuedWithdrawalHead + count - 1 nextQueuedWithdrawalId; for uint256 i ...

buy() method of Tray.sol may exceed Block Limit

Lines of code Vulnerability details Impact DOS in buy method. Proof of Concept File: Tray.sol function buyuint256 amount external uint256 startingTrayId = nextTokenId; if prelaunchMinted == typeuint256.max // Still in prelaunch phase if msg.sender != owner revert OnlyOwnerCanMintPreLaunch; if...

Incorrect use of the && Operator will allow anyone to fuse a new Namespace NFT

Lines of code Vulnerability details Impact Any caller can easily mint NFT if they provide a valid list of characters with the appropriate trays, the problem with this code is in this check if trayOwner != msg.sender && tray.getApprovedtrayID != msg.sender && !tray.isApprovedForAlltrayOwner,...

Unlimited minting of Canto Bio NFT

Lines of code Vulnerability details Impact There is no max limit on the number of Bio NFT that can be minted by a user. This allows an attacker to mint himself any amount of Bio NFT he want. Proof of Concept function testMint public string memory bio = "TEST BIO"; vm.prankalice; for uint i = 0; i...

Potential front-running attacks in buy function

Lines of code Vulnerability details Impact The buy function generates new trays and stores them in the tiles mapping based on the value of lastHash. Since the value of lastHash is publicly accessible and can be predicted, an attacker could potentially front-run other users to mint specific trays...

Implementation error in Namespace.fuse() leads to a wrong unicode representation

Lines of code Vulnerability details Impact The font class of a tile will be always considered as 0 emoji when a user registers a name. Proof of Concept To register a name, fuse is used taking as input the data of the characters. The name to register is a string created by converting the character...

No check for checking the "to" address to not be zero address in _execute() function of DefaultAccount.sol

Lines of code Vulnerability details Impact The "to" address can be zero address while converting from uint256 to uint160. Proof of Concept // SPDX-License-Identifier: GPL-3.0 pragma solidity ^0.8.0; contract Test uint256 public to = 2160; function check external view assertaddressuint160to ==...

Underflow if enough amount is sent to the contract

Lines of code Vulnerability details Impact In function withdraw function withdrawaddress l1Receiver external payable override uint256 amount = msg.value; // Silent burning of the ether unchecked balanceaddressthis -= amount; totalSupply -= amount; they are using unchecked to decrease balances. Th...

Namespace tokenName has only emojis.

Lines of code Vulnerability details Impact The tokenName and image of Namespace should always be the same. The image is correct but the tokenName only consists of emojis. Duplicate names are checked on the tokenName and not on the image. Because of this a tile of font class 1 with character index...

L2EthToken.withdraw can be underflow with little cost

Lines of code Vulnerability details Impact calculating balanceaddressthis within unchecked will cause underflow. Say if balanceaddressthis == 1 and msg.value == 2, after calling withdraw, balanceaddressthis will be typeuint256.max Proof of Concept function underFlowuint a, uint b public pure...

Unsafe safeTransfer function

Lines of code Vulnerability details Impact The safeTransfer function of the SafeERC20.sol contract check that the target is actually a contract before calling it, this is to avoid calls to address with no code that will always return succes = true. For exemple if you use token.safeTransfer and...

External calls can be manipulated

Lines of code Vulnerability details Impact By making external calls to untrusted contracts, the sender might manipulate the contract's state and cause unintended behavior. Proof of Concept In the tokenURI and mint functions, the contract makes external calls to ERC721nftContract.tokenURInftID and...

Loss of funds when msg.value > 2**128

Lines of code Vulnerability details Impact When a user try to transfer an amount of ether 2128 an invariant is broken where instead of reverting the transaction the affected code just return. Proof of Concept The following is the affected code where it returns instead of reverting. if value != 0...

[H-01] User that fuse more tiles to Namespace NFT pay lesser fusing costs instead of greater

Lines of code Vulnerability details Impact User that fuses more tiles will pay lesser fusing costs to revenueAddress instead of higher cost as intended Proof of Concept Namespace.solL110-L114 /Namespace.sol 110: function fuseCharacterData calldata characterList external 111: uint256 numCharacters...

deploying contracts with forceDeployOnAddress will break contracts when callConstructor is false

Lines of code Vulnerability details Impact when function forceDeployOnAddress used for deploying contract and callConstructor is false, then contract's bytecodehash would stay in constructing state and calling the contract won't be possible. it can cause protocol and other contracts that are usin...

DefaultAccount will add system call flag to any call with msg.value

Lines of code Vulnerability details Impact As mentioned in the repo's README.md documentation: isSystem flag. Whether the call intends a system contracts' function. While most of the system contracts' functions are relatively harmless, accessing some with calldata only may break the invariants of...

L2EthToken.sol balance[address(this)] COULD UNDERFLOW

Lines of code Vulnerability details Impact The ethereum balance of the L2EthToken.sol contract can underflow thus breaking the accounting of the protocol for L2-L1 fund transfers. Proof of Concept L2EthToken.sol contract has the withdraw function to transfer funds to L1 for withdrawal. In the...

The call to MsgValueSimulator with non zero msg.value will call to sender itself which will bypass the onlySelf check

Lines of code Vulnerability details Impact First, I need to clarify, there may be more serious ways to exploit this issue. Due to the lack of time and documents, I cannot complete further exploit. The current exploit has only achieved the impact in the title. I will expand the possibility of...

function _nonSystemDeployOnAddress() should try another nonces when getNewAddressCreate() result is in kernel space otherwise some logics would be broken

Lines of code Vulnerability details Impact Function createAccount Deploys a contract account with similar address derivation rules to the EVM's CREATE opcode. the deployed contract address is calculated based on sender deployed nonce. code uses nonSystemDeployOnAddress to deploy the contract to n...

Unsafe cast

Lines of code Vulnerability details Impact In AccountCodeStorage.sol we have function getCodeHash and getCodeSize Due to an insecure cast, it is possible to get an integer overflow. Solidity version 0.8.0 provide SafeMath, but casting operations are not safe and can overflow. Proof of Concept As...

[Medium - 1] Ecrecover precompile doesn't behave the same as the one from Ethereum

Lines of code Vulnerability details Impact According to the Ethereum yellow paper and in the specifications of the ecrecover precompile, it is stated that if the ecrecover doesn't return anything denoted by ∅, then the return should be 0 as well. If we take a look at the current ecrecover...

NonceHolder.setValueUnderNonce lack of validation

Lines of code Vulnerability details Impact NonceHolder.setValueUnderNonce can set the nonce value for key has already being used. Proof of Concept Quoting to the document NonceHolder part: It provides a function validateNonceUsage which the bootloader uses to check whether the nonce has been used...

NonceHolder.setValueUnderNonce does not increase the minNonce when using sequential account nonce ordering

Lines of code Vulnerability details Impact The current available nonce can't be synchronized to the client and rpc resp in real time. As a result, the client can't use the correct nonce to signature transaction. Proof of Concept If the nonceOrdering type of the account is...

Incorrect calculation of gasToPay due to dividing before multiplying, rounding error.

Lines of code Vulnerability details Impact In Solidity, it is an error to divide before multiplying because of lots of rounding errors that can come from that. In this case: uint256 pubdataLen; unchecked pubdataLen = message.length + 31 / 32 32 + 64; uint256 gasToPay = pubdataLen...

EVM Elliptic Curve Recovery Discrepancy

Lines of code Vulnerability details Impact The Ecrecover.yul file meant to simulate the ecrecover mechanism as executed by traditional ETH 1.0 consensus mechanisms is incorrect. In detail, it does not conform to the "Homestead" update which introduced an upper-bound check for s values of an r, s,...

Default accounts cannot pay transaction fees due to DefaultAccount not calling MsgValueSimulator

Lines of code Vulnerability details Impact Default accounts cannot pay the transaction fees to the bootloader. It's not clear whether the attempts to do so will silently succeed or revert because the behaviour of the CALL opcode in the zkSync Era virtual machine isn't explained in the description...

User may lose ETH

Lines of code Vulnerability details Impact User may lose ETH Proof of Concept If a non-existent function is called , the protocol may enter MsgValueSimulator.fallback.Inside the fallback function ,the protocol will transfer ETH from one address to another. If user calls a function that doesn't...

A user can mint a PFP NFT multiple times using the same _nftId

Lines of code Vulnerability details Impact A user might unintentionally "intentionally" try to take advantage of the mint function in ProfilePicture.sol Proof of Concept The pfp mapping stores the pfp data per NFT, L31-32 of Profilepicture.sol /// @notice Stores the pfp data per NFT mappinguint25...

[Medium - 2] A force deployed contract may be stuck in the constructor forever

Lines of code Vulnerability details Impact The forceDeployOnAddress function in the ContractDeployer contract may be used to redeploy contracts at a specified address. Very useful in the case of precompiles or system contracts upgrades for instance. In the deployment parameters, multiple values c...

Unchecked return value of call will allow to send messages marked as sent but will fail due to not enough gas

Lines of code Vulnerability details Impact On the sendTol1 function, they are sending the message via the SystemContractHelper: SystemContractHelper.toL1true, bytes32uint256uint160msg.sender, hash; the problem relies on the fact that they are not checking whether the message was actually sent...

Division before multiply results in precision loss

Lines of code Vulnerability details Impact Precision loss occurs when division is carried out before multiplication, that can affect gas calculation in terms of publishing the data to L1. Proof of Concept Tools Used Manual Review Recommended Mitigation Steps Recommendation is made for avoiding...

My Findings

Lines of code Vulnerability details Impact 1. Integer overflow: In the publishCompressedBytecode function, the check dictionary.length = 2 16 8 is intended to ensure that the dictionary does not become too large, but it is not sufficient to prevent an integer overflow. If dictionary.length exceed...

Unsafe system contract verification

Lines of code Vulnerability details Impact On the following function: function isSystemContractaddress address internal pure returns bool return uint160address = uint160MAXSYSTEMCONTRACTADDRESS; it does check whether an address is a system contract by checking whether it is smaller than...

User transactions can call system contracts directly

Lines of code Vulnerability details Impact User transaction can call system contracts directly, which shouldn't be allowed to not invoke potentially dangerous operations. Proof of Concept The DefaultAccount.executeTransaction executes a user transaction after it was validated. The function calls...

ProfilePictureData is not stored, which will cause serious logic errors

Lines of code Vulnerability details Impact All data minted by the contract will not be stored, paralyzing the entire contract Proof of Concept code snippet： function mintaddress nftContract, uint256 nftID external uint256 tokenId = ++numMinted; if ERC721nftContract.ownerOfnftID != msg.sender reve...

bootloader doesn't add tighter gas limit to the IAccount.validateTransaction call

Lines of code Vulnerability details Impact As mentioned in the competition details: Important, while the bootloader is out of scope, we may reward an additional bounty for valid bugs found in it by our judgement! As mentioned in the dev document, , there are some limitations of the verification a...

The "totalRequiredBalance()" function in the TransactionHelper.sol library can compute address(uint160(_transaction.paymaster) as zero address even when _transaction.paymaster is non-zero

Lines of code Vulnerability details Impact A user may provide a non-zero entry for the "transaction.paymaster" field for a transaction to ensure they do not have to pay the gas fees. However, certain values of "transaction.paymaster" = 2^160 can result in addressuint160transaction.paymaster to be...

[bootloader] A bytecode hash without the bytecode (preimage) can be marked as known, breaking the prover

Lines of code Vulnerability details This is a report of a finding in bootloader.yul. While the file is out of scope of the contest, the sponsor stated that they would still accept findings in the file and would judge them separately from the contest. Impact A bytecode hash for which the bytecode...

Malicious or hacked admin can steal all ETH

Lines of code Vulnerability details Impact In L2EthToken.sol we have transferFromTo It is possible malicious or hacked admin to steal the ETH. Proof of Concept As can be seen from the code snippet below, nothing can stop malicious or hacked admin to steal all ETH. He can use address from and send...

Wrong Implementation of EIP-712

Lines of code Vulnerability details Impact The EIP-712 uses several parameters. Those parameters are exactly: EIP712Domain string name; string version; uint256 chainId; address verifyingContract; As you can see on the following Domain, ZkSync, is missing one parameter: bytes32 constant...

Users pay excessive gas cost for sending bytecode hashes to L1

Lines of code Vulnerability details Impact When deploying new contracts, users are forced to pay more gas than is required to publish the bytecode hash to the L1. Proof of Concept When users deploy new smart contracts, the protocol marks the hashes of the bytecodes of the contracts as known and...

Wrong block number calculation

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The calculation for the block info is currentBlockNumber + 1 BLOCKINFOBLOCKNUMBERPART + newTimestamp. getBlockNumberAndTimestamp, getBlockTimestamp, getBlockNumber all incorrectly calculate the current...

Gas check inaccuracy

Lines of code Vulnerability details Impact Since the gas forwarded will be limited to 63/64 of the total gasleft, L1 transactions will be vulnerable of being reverted. To achieve 1:1 partity with the EVM, the ZKEVM should account for 1/64 rule. Please refer to the 1/64 rule here. The actual amoun...

Incorrect argument passed to "Utils.characterToUnicodeBytes" in "Namespace.fuse"

Lines of code Vulnerability details Impact The function Namespace.fuse uses Utils.characterToUnicodeBytes to get the unicode bytevalue for a given Tile. The first argument of characterToUnicodeBytes is an uint8 value representing the font class. Instead of passing the font class in the tile data,...