zkSync Upgrade System Audit

Off-Chain (Private)

Audited on 2024/01/29

No active critical issues

Summary

Information 9 (0 resolved) Client Reported Issues 0 (0 resolved) Scope We audited: Pull request #272 of the matter-labs/system-contracts repository up to the 548a958e02f71a350e288c70e5523fbfb4ae0832 commit. Pull request #143 of the matter-labs/zksync-2-contracts repository up to the 0ea939847569a02ae9c3b2d096aef5cb6238eb9d commit. In scope were changes to the following contracts: system-contracts... A comprehensive multi-level test suite with high coverage is strongly recommended before the next audits, to ensure robustness and reduce the risk of further vulnerabilities. The Matter Labs team has been very diligent, as usual, in helping our auditors navigate this codebase.

Project

ZKsync

zkSync

Issues (11)

	Low	Medium	High	Critical	Total
Not fixed	6	4	1	-	11
Fixed	-	-	-	-	0
Total	6	4	1	0	11

Contracts (16)

#	File Name
11	ComplexUpgrader.sol
12	Executor.sol
13	Config.sol
14	IComplexUpgrader.sol
15	ContractDeployer.sol
16	Constants.sol

#	File Name
11	ComplexUpgrader.sol
12	Executor.sol
13	Config.sol
14	IComplexUpgrader.sol
15	ContractDeployer.sol
16	Constants.sol

zkSync Upgrade System Audit

Summary

Issues (11)

Not Setting L2 Upgrade Block Number Prevents Future Upgradesnot_fixed/high

Inadequate Test Coveragenot_fixed/medium

Insufficient Validation of L2 Upgrade Transactionnot_fixed/medium

L2 Upgrade Timing Will Precede L1 Upgradenot_fixed/medium

Reverted L2 Upgrade Block Forces Recommitment of Preceding Blocks with Incorrect Valuesnot_fixed/medium

Contracts (16)