web3-hunt-zksync-era

LIVE HUNT: ZKsync Era (Immunefi) — COMPLETED, 0 FINDINGS

> Outcome: 0 submittable findings after 5+ sessions, 22+ agents, 25+ contracts, 25+ attack vectors

> Lesson: This file exists as a DEFENSE STUDY — what a hardened protocol looks like, and when to stop hunting.

---

TARGET PROFILE

| Field | Value |

|-------|-------|

| Protocol | ZKsync Era (L2 rollup) |

| Platform | Immunefi |

| TVL | $322M (L2BEAT Total Value Secured) |

| Bounty | $100K minimum Critical, $1.1M max |

| Codebase | 750K LOC (Solidity + Rust + Yul) |

| Audits | OpenZeppelin V29 (June 2025), multiple prior audits |

| Version | Protocol V29.4 |

| Repo | github.com/matter-labs/era-contracts |

| Primacy | Primacy of Impact — even out-of-scope assets qualify |

| Prior payouts | $50K (ChainLight ZK circuit bug) |

Pre-Dive Scorecard

| Check | Result | Score |

|-------|--------|-------|

| TVL > $500K | $322M | PASS |

| Max payout > $10K | $100K minimum | PASS |

| Simple protocol? | 750K LOC, L1↔L2 bridge + ZK + governance | PASS (complex) |

| < 500 lines? | 750K LOC | PASS |

| Audit quality | OpenZeppelin (top-tier) on ALL critical paths | WARNING |

> REFINEMENT: Pre-dive should weight audit quality MORE for large protocols.

> A protocol passing TVL/LOC/payout checks can still be unhuntable if OZ/ToB audited the exact code you'd hunt.

> Add "audit firm tier" as a SOFT kill signal for 500K+ LOC protocols.

---

ARCHITECTURE (What Makes It Hardened)

L1 Bridge Stack

Bridgehub (router)
  ├── L1AssetRouter (token routing)
  │     ├── L1Nullifier (deposit/withdrawal state)
  │     └── L1NativeTokenVault (token custody)
  ├── ChainTypeManager (chain registration)
  └── ValidatorTimelock (RBAC execution delay)

L2 System Contracts (kernel space 0x8000-0xFFFF)

Bootloader (0x8001) → AccountCodeStorage, NonceHolder, KnownCodeStorage,
ImmutableSimulator, ContractDeployer, L1Messenger (0x8008),
MsgValueSimulator, L2BaseToken (0x800a), SystemContext (0x800b),
BootloaderUtilities, Compressor, ComplexUpgrader

L2 User Space Contracts (0x10000+)

Create2Factory, Bridgehub, AssetRouter, NativeTokenVault, MessageRoot

Diamond Proxy Pattern (EIP-2535)

• All facets (Admin, Executor, Mailbox, Getters) share single ZKChainStorage struct
• No storage collision possible between facets
• Function selectors explicitly mapped in DiamondCut

---

ALL 25 ATTACK VECTORS TESTED

Critical Path (Vectors 1-8)

| # | Vector | Target | Why It Failed |

|---|--------|--------|---------------|

| 1 | UnsafeBytes offset miscalculation | L1Nullifier _parseL2WithdrawalMessage | All callers pre-validate message length before UnsafeBytes calls |

| 2 | Legacy/new boundary double-withdrawal | L1Nullifier | _isLegacyTxDataHash try/catch returns false on decode failure; encoding prefix discriminator prevents collision |

| 3 | secondBridgeAddress return value manipulation | Bridgehub requestL2TransactionTwoBridges | >0xFFFF check blocks system contracts; L2-side msg.sender auth makes crafted returns useless |

| 4 | Failed deposit claim wrong amount (legacy encoding) | L1Nullifier claimFailedDeposit | Legacy hash uses try/catch; depositHappened correctly tracks per-encoding-version |

| 5 | V29 interop root forgery | Executor | addChainBatchRoot requires onlyChain + onlyL2; historical roots verified via Merkle |

| 6 | Missing access control on sibling function | All bridge contracts | Every external function has appropriate modifier; checked all 50+ external functions |

| 7 | Fee-on-transfer token accounting desync | NativeTokenVault | L1ERC20Bridge: if (amount != _amount) revert TokensWithFeesNotSupported() |

| 8 | Governance timelock bypass | ValidatorTimelock | 5-role RBAC via AccessControlEnumerable; block.timestamp >= commitTimestamp + delay |

Extended Surface (Vectors 9-25)

| # | Vector | Why It Failed |

|---|--------|---------------|

| 9 | GatewayTransactionFilterer bypass | Era mainnet: transactionFilterer == address(0), not used |

| 10 | Precommitment sentinel collision | _revertBatches properly resets precommitment; sentinel values don't collide |

| 11 | L2→L1 message forgery via sendToL1 | Anyone can call sendToL1, but L1 verifies sender=0x8008 in log — can't forge system log sender |

| 12 | Compressor state diff manipulation | publishCompressedBytecode called only from bootloader context |

| 13 | Admin privilege escalation | Diamond proxy admin is governance; no facet can self-modify |

| 14 | Fee calculation overflow | All fee math uses SafeMath or checked arithmetic |

| 15 | Free L2 transaction abuse | reservedDynamic field properly handled; bootloader validates gas |

| 16 | DataEncoding L1/L2 mismatch | All 10 encode/decode pairs verified consistent across L1↔L2 |

| 17 | NTV token registration race | _ensureTokenRegistered is idempotent; double registration returns same assetId |

| 18 | Asset ID collision | keccak256(chainId, ntvAddress, tokenAddress) — no collision possible |

| 19 | Beacon proxy CREATE2 collision | Standard CREATE2; address determined by deployer+salt+bytecodeHash |

| 20 | Cross-contract reentrancy | Each contract has independent ReentrancyGuard AND follows CEI |

| 21 | Address aliasing collision | Bijective mapping (add/subtract offset mod 2^160) |

| 22 | Diamond proxy selector clash | Explicit selector mapping in DiamondCut; duplicates would revert |

| 23 | Priority tree manipulation | Merkle range proofs; unprocessedIndex only moves forward |

| 24 | Chain migration state corruption | forwardedBridgeMint validates consistency; atomic revert on mismatch |

| 25 | Cross-chain message replay | isWithdrawalFinalized[chainId][batch][index] prevents replay |

---

WHY THIS PROTOCOL IS UNHUNTABLE (Solidity Surface)

Defense Pattern 1: CEI Everywhere

// L1Nullifier._finalizeDeposit (line 411)
isWithdrawalFinalized[chainId][l2BatchNumber][l2MessageIndex] = true; // EFFECT first
// ... then external call to NTV

Every single withdrawal/claim/deposit path follows Check-Effect-Interact.

Defense Pattern 2: Independent Access Control on L2

Each L2 system contract independently enforces access:

• L2BaseToken.transferFromTo: checks msg.sender against 3 allowed callers
• L1Messenger.sendToL1: open to anyone, but L1 verifies sender field in log
• SystemContext: onlyCallFromBootloader on all state-changing functions
• No single RBAC failure cascades

Defense Pattern 3: Encoding Collision Resistance

LEGACY_ENCODING_VERSION = 0x00  (first byte)
NEW_ENCODING_VERSION    = 0x01  (first byte)

Different first byte = impossible to confuse one format for another.

Defense Pattern 4: Mature Legacy Boundary Handling

Three bridge generations coexist cleanly:

1. L1ERC20Bridge (legacy wrapper → delegates to AssetRouter)
2. L1SharedBridge (previous → absorbed into AssetRouter/Nullifier)
3. L1AssetRouter + L1Nullifier (current)

Each boundary has explicit version checks, try/catch decoding, and fallback paths.

Defense Pattern 5: Audit Fix Quality

V29 OZ audit found 3 HIGHs. All fixes were thorough — not just patches but architectural improvements.

The "least audited code" assumption (that fixes are hastily applied) did NOT hold here.

---

STRATEGIC TAKEAWAYS

When to Abandon a Large L1 Bridge Target

1. After systematically testing top 8 attack vectors (Days 1-2): if all blocked, ROI drops exponentially
2. If OZ/ToB audited the EXACT codebase version you're reviewing (not an older version)
3. If 22+ automated agents all return clean across all contracts
4. If encoding, access control, and CEI are all consistently applied with zero exceptions

What Could Still Work on ZKsync

1. ZK circuits (Rust/RISC-V) — different skillset, different attack surface, prior $50K payout proves bugs exist there
2. Bootloader assembly (Yul) — 5000+ lines of hand-written Yul, complex gas accounting, less audited
3. New code drops (V30+) — fresh code = fresh bugs. Monitor era-contracts releases
4. EVM emulation edge cases — EvmGasManager, EVM opcode compatibility gaps
5. Interop protocol (when launched) — L2InteropRootStorage is minimal now, but interop = massive new surface

Pre-Dive Scoring Refinement

Add to the scorecard:

SOFT KILL: If protocol has OZ/ToB/Cyfrin audit on current version AND codebase > 500K LOC
           → expect 40+ hours for MAYBE 1 finding
           → only proceed if bounty floor > $50K AND you have protocol-specific expertise

---

> NEXT: [08-ai-tools.md](08-ai-tools.md)