zkSync Era - Koolex's results

Lines of code

https://github.com/code-423n4/2023-10-zksync/blob/1fb4649b612fac7b4ee613df6f6b7d921ddd6b0d/code/contracts/ethereum/contracts/zksync/libraries/TransactionValidator.sol#L36-L43

Vulnerability details

Impact

Sending L1->L2 TX

In zksync, requestL2Transaction can be used to send a L1->L2 TX.

    function requestL2Transaction(
        address _contractL2,
        uint256 _l2Value,
        bytes calldata _calldata,
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit,
        bytes[] calldata _factoryDeps,
        address _refundRecipient
    ) external payable nonReentrant senderCanCallFunction(s.allowList) returns (bytes32 canonicalTxHash) {

Mailbox.requestL2Transaction:L236-L245

This function is used by L1WethBridge.deposit (on L1) to bridge Weth to L2WethBridge (on L2).

	txHash = zkSync.requestL2Transaction{value: _amount + msg.value}(
		l2Bridge,
		_amount,
		l2TxCalldata,
		_l2TxGasLimit,
		_l2TxGasPerPubdataByte,
		new bytes[](0),
		refundRecipient
	);

L1WethBridge.deposit:L185-L193

The user should pass the required params to L1WethBridge.deposit

    function deposit(
        address _l2Receiver,
        address _l1Token,
        uint256 _amount,
        uint256 _l2TxGasLimit,
        uint256 _l2TxGasPerPubdataByte,
        address _refundRecipient

L1WethBridge.deposit:L163-L164

One important param is _l2TxGasLimit. This is used to process the TX on L2. The L2 gas limit should include both the overhead for processing the batch and the L2 gas needed to process the transaction itself (i.e. the actual l2GasLimit that will be used for the transaction). In other words, _l2TxGasLimit should have an amount that's enough to cover:

1. Transaction overhead
2. The transaction itself (body execution)

L1->L2 TX Validation

To ensure that the transaction doesn't fail when executing it (on L2) via the bootloader, there is a validation enforced on requestL2Transaction before pusing the TX to the priorityQueue.

	L2CanonicalTransaction memory transaction = _serializeL2Transaction(_priorityOpParams, _calldata, _factoryDeps);

	bytes memory transactionEncoding = abi.encode(transaction);

	TransactionValidator.validateL1ToL2Transaction(transaction, transactionEncoding, s.priorityTxMaxGasLimit);

Mailbox._writePriorityOp:L361-L368

The call flow: requestL2Transaction => _requestL2Transaction => _writePriorityOp

If we check TransactionValidator.validateL1ToL2Transaction we see that it calls getTransactionBodyGasLimit

    function validateL1ToL2Transaction(
        IMailbox.L2CanonicalTransaction memory _transaction,
        bytes memory _encoded,
        uint256 _priorityTxMaxGasLimit
    ) internal pure {
        uint256 l2GasForTxBody = getTransactionBodyGasLimit(
            _transaction.gasLimit,
            _transaction.gasPerPubdataByteLimit,
            _encoded.length
        );

TransactionValidator:L18-L28

getTransactionBodyGasLimit function makes sure that the provided gas limit covers transaction overhead then returns the l2GasLimit for the body of the transaction (the actual execution).

	function getTransactionBodyGasLimit(
		uint256 _totalGasLimit,
		uint256 _gasPricePerPubdata,
		uint256 _encodingLength
	) internal pure returns (uint256 txBodyGasLimit) {
		uint256 overhead = getOverheadForTransaction(_totalGasLimit, _gasPricePerPubdata, _encodingLength);

		require(_totalGasLimit >= overhead, "my"); // provided gas limit doesn't cover transaction overhead
		unchecked {
			// We enforce the fact that `_totalGasLimit >= overhead` explicitly above.
			txBodyGasLimit = _totalGasLimit - overhead;
		}
	}

TransactionValidator:L110-L122

After that, and back to validateL1ToL2Transaction, It ensures that the transaction covers the minimal costs for its processing (e.g. hashing its content, publishing the factory dependencies, etc).

	require(
		getMinimalPriorityTransactionGasLimit(
			_encoded.length,
			_transaction.factoryDeps.length,
			_transaction.gasPerPubdataByteLimit
		) <= _transaction.gasLimit,
		"up"
	);

TransactionValidator:L36-L43

However, the condition compares the the minimal costs with _transaction.gasLimit which includes the overhead transaction. Due to this bug, a majority of L1->L2 TX will always fail on L2 when executing it via the bootloader. These TX will fail without even an attempt to execute it. In other words, it will not enter the following if-condition body. Therefore, never attempting to call getExecuteL1TxAndGetRefund

	if gt(gasLimitForTx, gasUsedOnPreparation) { // gasLimitForTx is zero
		let potentialRefund := 0

		potentialRefund, success := getExecuteL1TxAndGetRefund(txDataOffset, sub(gasLimitForTx, gasUsedOnPreparation))

		// Asking the operator for refund
		askOperatorForRefund(potentialRefund)

		// In case the operator provided smaller refund than the one calculated
		// by the bootloader, we return the refund calculated by the bootloader.
		refundGas := max(getOperatorRefundForTx(transactionIndex), potentialRefund)
	}

bootloader:L908-L919

This happens because in getGasLimitForTx function (in bootloader), when calculating the intrinsicOverhead, it is bigger than gasLimitForTx (after deducting operatorOverheadForTransaction)

		gasLimitForTx := safeSub(totalGasLimit, operatorOverheadForTransaction, "qr")

		let intrinsicOverhead := safeAdd(
			intrinsicGas, 
			// the error messages are trimmed to fit into 32 bytes
			safeMul(intrinsicPubdata, gasPerPubdata, "qw"),
			"fj" 
		)

		switch lt(gasLimitForTx, intrinsicOverhead)
		case 1 {
			gasLimitForTx := 0
		}
		default {
			gasLimitForTx := sub(gasLimitForTx, intrinsicOverhead)
		}

bootloader:L1157-L1172

In this case, gasLimitForTx becomes zero. Since gasLimitForTx is zero, it is smaller than gasUsedOnPreparation. Therefore, it won't enter if-condition body seen above.

	if gt(gasLimitForTx, gasUsedOnPreparation) { // gasLimitForTx is zero

bootloader:L908

As a result of this (and not limited to):

• The majority of L1->L2 TXs (including deposits by L1WethBridge) will fail even though the provided L2 gas limit by the user is reasonable and already passed the validation (on L1) of minimum provided gasLimit.

• Users (with failed TX) paid for operatorOverheadForTransaction and some value less than intrinsicOverhead for a transaction that was never attempted to be executed which is unfair for the user. Please note that, obviously this applicable only if L1->L2 transactions are not free Check the comments here.

• Other various impacts which are conveyed in the report.

Please check the coded PoC below for better understanding.

Proof of Concept

• We have two files:

  1. bootloader (slightly modified to process only one TX)
  2. The test file

• To run the test file:

  1. Put these two files under the same directory.
  2. In the test file at line:730, replace the path of the bootloader (relative path)

  // Please change this to the relative path of provided bootloader.yul
  string constant bootloaderRelativePath = "solidity/test/zksync-PoCs/yul/bootloader.yul";

  3. Run the following command:

  forge test --via-ir -vv --ffi

• You should get the following output:

[PASS] test_TX_Type255_Fail() (gas: 536605312)
Logs:
  === Validating L1ToL2Transaction ===
  l2GasLimit provided: 380440
  required overhead: 180926
  remaining l2GasForTxBody: 199514
  minimumL2GasForTxBodyAccepted: 243884
  === Call bootloader.processTx for L1->L2 TX ===
  Message:   L1->L2 TX failed
  Success:  false

Test result: ok. 1 passed; 0 failed; finished in 2.26s

Files

Important: please note that the PoC doesn't use any special zksync opcode since it is irrelevant to this PoC. For this reason, solc is ok to be used in this case.

• Test file

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
// PoC => L1->L2 TXs will fail in bootloader without even attempting to execute it

import {Test} from "forge-std/Test.sol";
import "forge-std/console.sol";

import {DSTest} from "ds-test/test.sol";

uint256 constant PRIORITY_OPERATION_L2_TX_TYPE = 255;

uint256 constant L2_TX_MAX_GAS_LIMIT = 80000000;

uint256 constant MAX_PUBDATA_PER_BATCH = 110000;

uint256 constant PRIORITY_TX_MAX_PUBDATA = 99000;

uint256 constant FAIR_L2_GAS_PRICE = 500000000;

uint256 constant L1_GAS_PER_PUBDATA_BYTE = 17;

uint256 constant BATCH_OVERHEAD_L2_GAS = 1200000;

uint256 constant BATCH_OVERHEAD_L1_GAS = 1000000;

uint256 constant BATCH_OVERHEAD_PUBDATA = BATCH_OVERHEAD_L1_GAS /
L1_GAS_PER_PUBDATA_BYTE;

uint256 constant MAX_TRANSACTIONS_IN_BATCH = 1024;

uint256 constant BOOTLOADER_TX_ENCODING_SPACE = 273132;

uint256 constant L1_TX_INTRINSIC_L2_GAS = 167157;

uint256 constant L1_TX_INTRINSIC_PUBDATA = 88;

uint256 constant L1_TX_MIN_L2_GAS_BASE = 173484;

uint256 constant L1_TX_DELTA_544_ENCODING_BYTES = 1656;

uint256 constant L1_TX_DELTA_FACTORY_DEPS_L2_GAS = 2473;

uint256 constant L1_TX_DELTA_FACTORY_DEPS_PUBDATA = 64;

uint256 constant MAX_NEW_FACTORY_DEPS = 32;

uint256 constant REQUIRED_L2_GAS_PRICE_PER_PUBDATA = 800;

uint256 constant PACKED_L2_BLOCK_TIMESTAMP_MASK = 0xffffffffffffffffffffffffffffffff;

interface Bootloader {}

interface IL2Bridge {
function finalizeDeposit(
    address _l1Sender,
    address _l2Receiver,
    address _l1Token,
    uint256 _amount,
    bytes calldata _data
) external payable;
}

interface IMailbox {
struct L2CanonicalTransaction {
    uint256 txType;
    uint256 from;
    uint256 to;
    uint256 gasLimit;
    uint256 gasPerPubdataByteLimit;
    uint256 maxFeePerGas;
    uint256 maxPriorityFeePerGas;
    uint256 paymaster;
    uint256 nonce;
    uint256 value;
    // In the future, we might want to add some
    // new fields to the struct. The `txData` struct
    // is to be passed to account and any changes to its structure
    // would mean a breaking change to these accounts. To prevent this,
    // we should keep some fields as "reserved".
    // It is also recommended that their length is fixed, since
    // it would allow easier proof integration (in case we will need
    // some special circuit for preprocessing transactions).
    uint256[4] reserved;
    bytes data;
    bytes signature;
    uint256[] factoryDeps;
    bytes paymasterInput;
    // Reserved dynamic type for the future use-case. Using it should be avoided,
    // But it is still here, just in case we want to enable some additional functionality.
    bytes reservedDynamic;
}
}

/**
 * copied from openzeppelin/contracts/utils/math/Math.sol
 */
library Math {
error MathOverflowedMulDiv();

enum Rounding {
    Floor, // Toward negative infinity
    Ceil, // Toward positive infinity
    Trunc, // Toward zero
    Expand // Away from zero
}

function max(uint256 a, uint256 b) internal pure returns (uint256) {
    return a > b ? a : b;
}

function min(uint256 a, uint256 b) internal pure returns (uint256) {
    return a < b ? a : b;
}

function ceilDiv(uint256 a, uint256 b) internal pure returns (uint256) {
    if (b == 0) {
        return a / b;
    }

    return a == 0 ? 0 : (a - 1) / b + 1;
}

function mulDiv(
    uint256 x,
    uint256 y,
    uint256 denominator
) internal pure returns (uint256 result) {
    unchecked {
        // 512-bit multiply [prod1 prod0] = x * y. Compute the product mod 2^256 and mod 2^256 - 1, then use
        // use the Chinese Remainder Theorem to reconstruct the 512 bit result. The result is stored in two 256
        // variables such that product = prod1 * 2^256 + prod0.
        uint256 prod0 = x * y; // Least significant 256 bits of the product
        uint256 prod1; // Most significant 256 bits of the product
        assembly {
            let mm := mulmod(x, y, not(0))
            prod1 := sub(sub(mm, prod0), lt(mm, prod0))
        }

        // Handle non-overflow cases, 256 by 256 division.
        if (prod1 == 0) {
            // Solidity will revert if denominator == 0, unlike the div opcode on its own.
            // The surrounding unchecked block does not change this fact.
            // See https://docs.soliditylang.org/en/latest/control-structures.html#checked-or-unchecked-arithmetic.
            return prod0 / denominator;
        }

        // Make sure the result is less than 2^256. Also prevents denominator == 0.
        if (denominator <= prod1) {
            revert MathOverflowedMulDiv();
        }

        ///////////////////////////////////////////////
        // 512 by 256 division.
        ///////////////////////////////////////////////

        // Make division exact by subtracting the remainder from [prod1 prod0].
        uint256 remainder;
        assembly {
            // Compute remainder using mulmod.
            remainder := mulmod(x, y, denominator)

            // Subtract 256 bit number from 512 bit number.
            prod1 := sub(prod1, gt(remainder, prod0))
            prod0 := sub(prod0, remainder)
        }

        // Factor powers of two out of denominator and compute largest power of two divisor of denominator.
        // Always >= 1. See https://cs.stackexchange.com/q/138556/92363.

        uint256 twos = denominator & (0 - denominator);
        assembly {
            // Divide denominator by twos.
            denominator := div(denominator, twos)

            // Divide [prod1 prod0] by twos.
            prod0 := div(prod0, twos)

            // Flip twos such that it is 2^256 / twos. If twos is zero, then it becomes one.
            twos := add(div(sub(0, twos), twos), 1)
        }

        // Shift in bits from prod1 into prod0.
        prod0 |= prod1 * twos;

        // Invert denominator mod 2^256. Now that denominator is an odd number, it has an inverse modulo 2^256 such
        // that denominator * inv = 1 mod 2^256. Compute the inverse by starting with a seed that is correct for
        // four bits. That is, denominator * inv = 1 mod 2^4.
        uint256 inverse = (3 * denominator) ^ 2;

        // Use the Newton-Raphson iteration to improve the precision. Thanks to Hensel's lifting lemma, this also
        // works in modular arithmetic, doubling the correct bits in each step.
        inverse *= 2 - denominator * inverse; // inverse mod 2^8
        inverse *= 2 - denominator * inverse; // inverse mod 2^16
        inverse *= 2 - denominator * inverse; // inverse mod 2^32
        inverse *= 2 - denominator * inverse; // inverse mod 2^64
        inverse *= 2 - denominator * inverse; // inverse mod 2^128
        inverse *= 2 - denominator * inverse; // inverse mod 2^256

        // Because the division is now exact we can divide by multiplying with the modular inverse of denominator.
        // This will give us the correct result modulo 2^256. Since the preconditions guarantee that the outcome is
        // less than 2^256, this is the final result. We don't need to compute the high bits of the result and prod1
        // is no longer required.
        result = prod0 * inverse;
        return result;
    }
}

function mulDiv(
    uint256 x,
    uint256 y,
    uint256 denominator,
    Rounding rounding
) internal pure returns (uint256) {
    uint256 result = mulDiv(x, y, denominator);
    if (unsignedRoundsUp(rounding) && mulmod(x, y, denominator) > 0) {
        result += 1;
    }
    return result;
}

function unsignedRoundsUp(Rounding rounding) internal pure returns (bool) {
    return uint8(rounding) % 2 == 1;
}
}

library TransactionValidator {
function validateL1ToL2Transaction(
    IMailbox.L2CanonicalTransaction memory _transaction,
    bytes memory _encoded,
    uint256 _priorityTxMaxGasLimit
) internal pure {
    uint256 l2GasForTxBody = getTransactionBodyGasLimit(
        _transaction.gasLimit,
        _transaction.gasPerPubdataByteLimit,
        _encoded.length
    );

    require(l2GasForTxBody <= _priorityTxMaxGasLimit, "ui");

    require(
        l2GasForTxBody / _transaction.gasPerPubdataByteLimit <=
            PRIORITY_TX_MAX_PUBDATA,
        "uk"
    );

    require(
        getMinimalPriorityTransactionGasLimit(
            _encoded.length,
            _transaction.factoryDeps.length,
            _transaction.gasPerPubdataByteLimit
        ) <= _transaction.gasLimit,
        "up"
    );
}

function getMinimalPriorityTransactionGasLimit(
    uint256 _encodingLength,
    uint256 _numberOfFactoryDependencies,
    uint256 _l2GasPricePerPubdata
) internal pure returns (uint256) {
    uint256 costForComputation;
    {
        // Adding the intrinsic cost for the transaction, i.e. auxiliary prices which cannot be easily accounted for
        costForComputation = L1_TX_INTRINSIC_L2_GAS; // 167157

        // Taking into account the hashing costs that depend on the length of the transaction
        // Note that L1_TX_DELTA_544_ENCODING_BYTES is the delta in the price for every 544 bytes of
        // the transaction's encoding. It is taken as LCM between 136 and 32 (the length for each keccak256 round
        // and the size of each new encoding word).
        costForComputation += Math.ceilDiv(
            _encodingLength * L1_TX_DELTA_544_ENCODING_BYTES,
            544
        );

        // Taking into the account the additional costs of providing new factory dependenies
        costForComputation +=
            _numberOfFactoryDependencies *
            L1_TX_DELTA_FACTORY_DEPS_L2_GAS;

        // There is a minimal amount of computational L2 gas that the transaction should cover
        costForComputation = Math.max(
            costForComputation,
            L1_TX_MIN_L2_GAS_BASE
        );
    } // L1_TX_MIN_L2_GAS_BASE => 173484

    uint256 costForPubdata = 0;
    {
        // Adding the intrinsic cost for the transaction, i.e. auxilary prices which cannot be easily accounted for
        costForPubdata = L1_TX_INTRINSIC_PUBDATA * _l2GasPricePerPubdata;
        // costForPubdata => 88 * 800 => 70400
        // Taking into the account the additional costs of providing new factory dependenies
        costForPubdata +=
            _numberOfFactoryDependencies *
            L1_TX_DELTA_FACTORY_DEPS_PUBDATA *
            _l2GasPricePerPubdata;
    }
    // 173484 + 70400 => 243884
    return costForComputation + costForPubdata;
}

function getTransactionBodyGasLimit(
    uint256 _totalGasLimit,
    uint256 _gasPricePerPubdata,
    uint256 _encodingLength
) internal pure returns (uint256 txBodyGasLimit) {
    uint256 overhead = getOverheadForTransaction(
        _totalGasLimit,
        _gasPricePerPubdata,
        _encodingLength
    );

    require(_totalGasLimit >= overhead, "my"); // provided gas limit doesn't cover transaction overhead
    unchecked {
        // We enforce the fact that `_totalGasLimit >= overhead` explicitly above.
        txBodyGasLimit = _totalGasLimit - overhead;
    }
}

function getOverheadForTransaction(
    uint256 _totalGasLimit,
    uint256 _gasPricePerPubdata,
    uint256 _encodingLength
) internal pure returns (uint256 batchOverheadForTransaction) {
    uint256 batchOverheadGas = BATCH_OVERHEAD_L2_GAS +
        BATCH_OVERHEAD_PUBDATA *
        _gasPricePerPubdata;

    // The overhead from taking up the transaction's slot
    uint256 txSlotOverhead = Math.ceilDiv(
        batchOverheadGas,
        MAX_TRANSACTIONS_IN_BATCH
    );
    batchOverheadForTransaction = Math.max(
        batchOverheadForTransaction,
        txSlotOverhead
    );

    // The overhead for occupying the bootloader memory can be derived from encoded_len
    uint256 overheadForLength = Math.ceilDiv(
        _encodingLength * batchOverheadGas,
        BOOTLOADER_TX_ENCODING_SPACE
    );
    batchOverheadForTransaction = Math.max(
        batchOverheadForTransaction,
        overheadForLength
    );

    // The overhead for possible published public data
    // TODO: possibly charge a separate fee for possible pubdata spending
    // uint256 overheadForPublicData;
    // {
    //     uint256 numerator = (batchOverheadGas * _totalGasLimit + _gasPricePerPubdata * MAX_PUBDATA_PER_BATCH);
    //     uint256 denominator = (_gasPricePerPubdata * MAX_PUBDATA_PER_BATCH + batchOverheadGas);

    //     overheadForPublicData = (numerator - 1) / denominator;
    // }
    // batchOverheadForTransaction = Math.max(batchOverheadForTransaction, overheadForPublicData);

    // The overhead for ergs that could be used to use single-instance circuits
    uint256 overheadForGas;
    {
        uint256 numerator = batchOverheadGas *
            _totalGasLimit +
            L2_TX_MAX_GAS_LIMIT;
        uint256 denominator = L2_TX_MAX_GAS_LIMIT + batchOverheadGas;

        overheadForGas = (numerator - 1) / denominator;
    }
    batchOverheadForTransaction = Math.max(
        batchOverheadForTransaction,
        overheadForGas
    );
}
}

// slightly modified => inspired by https://github.com/CodeForcer/foundry-yul/blob/main/test/lib/YulDeployer.sol
contract YulDeployer is Test {
function deployContract(
    string memory fileNameRelativePath
) public returns (address) {
    string memory bashCommand = string.concat(
        'cast abi-encode "f(bytes)" $(solc --strict-assembly --optimize --optimize-runs 200 ',
        string.concat(fileNameRelativePath, " --bin | tail -1)")
    );
    string[] memory inputs = new string[](3);
    inputs[0] = "bash";
    inputs[1] = "-c";
    inputs[2] = bashCommand;

    bytes memory bytecode = abi.decode(vm.ffi(inputs), (bytes));

    address deployedAddress;
    assembly {
        deployedAddress := create(0, add(bytecode, 0x20), mload(bytecode))
    }
    require(
        deployedAddress != address(0),
        "YulDeployer could not deploy contract"
    );
    return deployedAddress;
}
}

// Please change this to the relative path of provided bootloader.yul
string constant bootloaderRelativePath = "solidity/test/zksync-PoCs/yul/bootloader.yul";

contract BootloaderMockTest is DSTest, Test {
YulDeployer yulDeployer = new YulDeployer();
Bootloader bootloaderMock;

address OPERATOR_ADDRESS = vm.addr(1);
address FROM_ADDRESS = vm.addr(2);
address TO_ADDRESS = vm.addr(3);
address PAYMASTER_ADDRESS = vm.addr(4);
address REFUND_ADDRESS = vm.addr(5);

bytes l2TxCalldata;
uint256[4] reserved;
uint256 gasPerPubdataByteLimit = 800;

// check: https://github.com/matter-labs/zksync-era/blob/73a1e8ff564025d06e02c2689da238ae47bb10c3/sdk/zksync-web3.js/src/utils.ts#L61

function setUp() public {
    vm.deal(OPERATOR_ADDRESS, 100 ether);
    {
        bootloaderMock = Bootloader(
            yulDeployer.deployContract(bootloaderRelativePath)
        );
    }
}

function _getTXDataEncoded(
    IMailbox.L2CanonicalTransaction memory transaction
) internal pure returns (bytes memory txCalldataEncoded) {
    txCalldataEncoded = abi.encode(
        transaction.txType,
        transaction.from,
        transaction.to,
        transaction.gasLimit,
        transaction.gasPerPubdataByteLimit,
        transaction.maxFeePerGas,
        transaction.maxPriorityFeePerGas,
        transaction.paymaster,
        transaction.nonce,
        transaction.value,
        transaction.reserved,
        transaction.data,
        transaction.signature,
        transaction.factoryDeps,
        transaction.paymasterInput,
        transaction.reservedDynamic
    );
}

function _getDepositL2Calldata(
    address _l1Sender,
    address _l2Receiver,
    address _l1Token,
    uint256 _amount
) internal pure returns (bytes memory txCalldata) {
    txCalldata = abi.encodeCall(
        IL2Bridge.finalizeDeposit,
        (_l1Sender, _l2Receiver, _l1Token, _amount, new bytes(0))
    );
}

function test_TX_Type255_Fail() public {
    // stack too deep. sorry
    {
        l2TxCalldata = _getDepositL2Calldata(
            address(this),
            vm.addr(11),
            vm.addr(12),
            1 ether
        );
    }
    {
        reserved[0] = 3 ether; // reserved0 has ether to be minted
        reserved[1] = uint256(uint160(bytes20(REFUND_ADDRESS))); // the address that would receive the refund
        // check: https://github.com/code-423n4/2023-10-zksync/blob/main/docs/Smart%20contract%20Section/System%20contracts%20bootloader%20description.md#l1-l2-transactions
    }

    IMailbox.L2CanonicalTransaction memory transaction;
    {
        transaction.txType = PRIORITY_OPERATION_L2_TX_TYPE;
        transaction.from = uint256(uint160(bytes20(FROM_ADDRESS)));
        transaction.to = uint256(uint160(bytes20(TO_ADDRESS)));
        transaction.gasLimit = uint256(380_440);
        transaction.gasPerPubdataByteLimit = gasPerPubdataByteLimit;
        transaction.maxFeePerGas = uint256(13e9);
        transaction.maxPriorityFeePerGas = uint256(0);
        transaction.paymaster = uint256(0);
        transaction.nonce = uint256(1);
        transaction.value = uint256(1 ether);
        transaction.reserved = reserved;
        transaction.data = l2TxCalldata;
        transaction.signature = new bytes(0);
        transaction.paymasterInput = new bytes(0);
        transaction.reservedDynamic = new bytes(0);
        transaction.factoryDeps = new uint256[](0);
    }

    // Transaction should pass validation on L1
    bytes memory transactionEncoding = abi.encode(transaction);
    console.log("=== Validating L1ToL2Transaction ===");
    TransactionValidator.validateL1ToL2Transaction(
        transaction,
        transactionEncoding,
        (2 ** 32) - 1
    );

    uint256 overhead = TransactionValidator.getOverheadForTransaction(
        transaction.gasLimit,
        transaction.gasPerPubdataByteLimit,
        transactionEncoding.length
    );

    uint256 l2GasForTxBody = TransactionValidator
        .getTransactionBodyGasLimit(
            transaction.gasLimit,
            transaction.gasPerPubdataByteLimit,
            transactionEncoding.length
        );

    uint256 minimumL2GasForTxBodyAccepted = TransactionValidator
        .getMinimalPriorityTransactionGasLimit(
            transactionEncoding.length,
            transaction.factoryDeps.length,
            transaction.gasPerPubdataByteLimit
        );

    console.log("l2GasLimit provided: %d", transaction.gasLimit);
    console.log("required overhead: %d", overhead);
    console.log("remaining l2GasForTxBody: %d", l2GasForTxBody);
    console.log(
        "minimumL2GasForTxBodyAccepted: %d",
        minimumL2GasForTxBodyAccepted
    );

    // Pass data to bootloader to pprocess L1->L2 tx
    vm.startPrank(OPERATOR_ADDRESS);
    bytes memory txCalldataEncoded = _getTXDataEncoded(transaction);
    (bool status, bytes memory ret) = address(bootloaderMock).call(
        txCalldataEncoded
    );

    // Use this in case you need to print values (by reverting) from bootloader
    // console.log("=== ret ===");
    // console.logBytes(ret);
    // console.log(uint256(bytes32(ret)));

    console.log("=== Call bootloader.processTx for L1->L2 TX ===");
    console.log("Message: ", string(ret));
    console.log("Success: ", status);
    assertEq(status, false);
}
}

• Bootloader (slightly modified to process only one TX) Please note unused functions (irrelevant to this PoC) and some comments were removed to reduce the size of the file.

object "Bootloader" {
code {
    datacopy(0, dataoffset("runtime"), datasize("runtime"))
    return(0, datasize("runtime"))
}
object "runtime" {
code {
    function MAX_ALLOWED_L1_GAS_PRICE() -> ret {
        // 100k gwei
        ret := 100000000000000
    }

    function MAX_ALLOWED_FAIR_L2_GAS_PRICE() -> ret {
        // 10k gwei
        ret := 10000000000000
    }

    function validateOperatorProvidedPrices(l1GasPrice, fairL2GasPrice) {
        if gt(l1GasPrice, MAX_ALLOWED_L1_GAS_PRICE()) {
            assertionError("L1 gas price too high")
        }

        if gt(fairL2GasPrice, MAX_ALLOWED_FAIR_L2_GAS_PRICE()) {
            assertionError("L2 fair gas price too high")
        }
    }

    function getBaseFee(l1GasPrice, fairL2GasPrice) -> baseFee, gasPricePerPubdata {
        // By default, we want to provide the fair L2 gas price.
        // That it means that the operator controls
        // what the value of the baseFee will be. In the future, 
        // a better system, aided by EIP1559 should be added. 

        let pubdataBytePriceETH := safeMul(l1GasPrice, L1_GAS_PER_PUBDATA_BYTE(), "aoa")

        baseFee := max(
            fairL2GasPrice,
            ceilDiv(pubdataBytePriceETH, MAX_L2_GAS_PER_PUBDATA())
        )
        gasPricePerPubdata := ceilDiv(pubdataBytePriceETH, baseFee)
    }

    function GUARANTEED_PUBDATA_PER_TX() -> ret {
        ret := 4000 
    }

    function MAX_L2_GAS_PER_PUBDATA() -> ret {
        ret := div(MAX_GAS_PER_TRANSACTION(), GUARANTEED_PUBDATA_PER_TX())
    }

    function BATCH_OVERHEAD_L2_GAS() -> ret {
        ret := 1200000
    }

    function BATCH_OVERHEAD_L1_GAS() -> ret {
        ret := 1000000 
    }

    function MAX_GAS_PER_TRANSACTION() -> ret {
        ret := 80000000 
    }

    function L1_GAS_PER_PUBDATA_BYTE() -> ret {
        ret := 17
    }

    function BOOTLOADER_MEMORY_FOR_TXS() -> ret {
        ret := 273132 
    }

    function MAX_TRANSACTIONS_IN_BATCH() -> ret {
        ret := 1024 
    }

    function SCRATCH_SPACE_BEGIN_SLOT() -> ret {
        ret := 8
    }

    
    function SCRATCH_SPACE_SLOTS() -> ret {
        ret := 32
    }

    function PAYMASTER_CONTEXT_SLOTS() -> ret {
        ret := 33
    }

    function PAYMASTER_CONTEXT_BEGIN_SLOT() -> ret {
        ret := add(SCRATCH_SPACE_BEGIN_SLOT(), SCRATCH_SPACE_SLOTS())
    }

    function MAX_POSTOP_SLOTS() -> ret {
        ret := add(PAYMASTER_CONTEXT_SLOTS(), 7)
    }

    function CURRENT_L2_TX_HASHES_RESERVED_SLOTS() -> ret {
        ret := 2
    }

    function CURRENT_L2_TX_HASHES_BEGIN_SLOT() -> ret {
        ret := add(PAYMASTER_CONTEXT_BEGIN_SLOT(), PAYMASTER_CONTEXT_SLOTS())
    }

    
    function MAX_NEW_FACTORY_DEPS() -> ret {
        ret := 32
    }

    function NEW_FACTORY_DEPS_RESERVED_SLOTS() -> ret {
        ret := add(MAX_NEW_FACTORY_DEPS(), 4)
    }

    function NEW_FACTORY_DEPS_BEGIN_SLOT() -> ret {
        ret := add(CURRENT_L2_TX_HASHES_BEGIN_SLOT(), CURRENT_L2_TX_HASHES_RESERVED_SLOTS())
    }

    function TX_OPERATOR_REFUND_BEGIN_SLOT() -> ret {
        ret := add(NEW_FACTORY_DEPS_BEGIN_SLOT(), NEW_FACTORY_DEPS_RESERVED_SLOTS())
    }

    function TX_OPERATOR_REFUND_BEGIN_BYTE() -> ret {
        ret := mul(TX_OPERATOR_REFUND_BEGIN_SLOT(), 32)
    }

    function TX_OPERATOR_REFUNDS_SLOTS() -> ret {
        ret := MAX_TRANSACTIONS_IN_BATCH()
    }

    function TX_SUGGESTED_OVERHEAD_BEGIN_SLOT() -> ret {
        ret := add(TX_OPERATOR_REFUND_BEGIN_SLOT(), TX_OPERATOR_REFUNDS_SLOTS())
    }

    function TX_SUGGESTED_OVERHEAD_BEGIN_BYTE() -> ret {
        ret := mul(TX_SUGGESTED_OVERHEAD_BEGIN_SLOT(), 32)
    }

    function TX_SUGGESTED_OVERHEAD_SLOTS() -> ret {
        ret := MAX_TRANSACTIONS_IN_BATCH()
    }

    function TX_OPERATOR_TRUSTED_GAS_LIMIT_BEGIN_SLOT() -> ret {
        ret := add(TX_SUGGESTED_OVERHEAD_BEGIN_SLOT(), TX_SUGGESTED_OVERHEAD_SLOTS())
    }

    function TX_OPERATOR_TRUSTED_GAS_LIMIT_BEGIN_BYTE() -> ret {
        ret := mul(TX_OPERATOR_TRUSTED_GAS_LIMIT_BEGIN_SLOT(), 32)
    }

    function TX_OPERATOR_TRUSTED_GAS_LIMIT_SLOTS() -> ret {
        ret := MAX_TRANSACTIONS_IN_BATCH()
    }

    function TX_OPERATOR_L2_BLOCK_INFO_BEGIN_SLOT() -> ret {
        ret := add(TX_OPERATOR_TRUSTED_GAS_LIMIT_BEGIN_SLOT(), TX_OPERATOR_TRUSTED_GAS_LIMIT_SLOTS())
    }

    function TX_OPERATOR_L2_BLOCK_INFO_SLOT_SIZE() -> ret {
        ret := 4
    }

    function TX_OPERATOR_L2_BLOCK_INFO_SLOTS() -> ret {
        ret := mul(add(MAX_TRANSACTIONS_IN_BATCH(), 1), TX_OPERATOR_L2_BLOCK_INFO_SLOT_SIZE())
    }

    function COMPRESSED_BYTECODES_BEGIN_SLOT() -> ret {
        ret := add(TX_OPERATOR_L2_BLOCK_INFO_BEGIN_SLOT(), TX_OPERATOR_L2_BLOCK_INFO_SLOTS())
    }

    function COMPRESSED_BYTECODES_BEGIN_BYTE() -> ret {
        ret := mul(COMPRESSED_BYTECODES_BEGIN_SLOT(), 32)
    }

    function COMPRESSED_BYTECODES_SLOTS() -> ret {
        ret := 32768 
    }

    function PRIORITY_TXS_L1_DATA_RESERVED_SLOTS() -> ret {
        ret := 2
    }

    function PRIORITY_TXS_L1_DATA_BEGIN_SLOT() -> ret {
        ret := add(COMPRESSED_BYTECODES_BEGIN_SLOT(), COMPRESSED_BYTECODES_SLOTS())
    }

    function PRIORITY_TXS_L1_DATA_BEGIN_BYTE() -> ret {
        ret := mul(PRIORITY_TXS_L1_DATA_BEGIN_SLOT(), 32)
    }

    function OPERATOR_PROVIDED_L1_MESSENGER_PUBDATA_BEGIN_SLOT() -> ret {
        ret := add(PRIORITY_TXS_L1_DATA_BEGIN_SLOT(), PRIORITY_TXS_L1_DATA_RESERVED_SLOTS())
    }

    function OPERATOR_PROVIDED_L1_MESSENGER_PUBDATA_BEGIN_BYTE() -> ret {
        ret := mul(OPERATOR_PROVIDED_L1_MESSENGER_PUBDATA_BEGIN_SLOT(), 32)
    }

    function OPERATOR_PROVIDED_L1_MESSENGER_PUBDATA_SLOTS() -> ret {
        ret := 208000 
    }

    function OPERATOR_PROVIDED_L1_MESSENGER_PUBDATA_END_SLOT() -> ret {
        ret := add(OPERATOR_PROVIDED_L1_MESSENGER_PUBDATA_BEGIN_SLOT(), OPERATOR_PROVIDED_L1_MESSENGER_PUBDATA_SLOTS())
    }

    function TX_DESCRIPTION_BEGIN_SLOT() -> ret {
        ret := OPERATOR_PROVIDED_L1_MESSENGER_PUBDATA_END_SLOT()
    }

    function TX_DESCRIPTION_BEGIN_BYTE() -> ret {
        ret := mul(TX_DESCRIPTION_BEGIN_SLOT(), 32)
    }

    function TX_DESCRIPTION_SIZE() -> ret {
        ret := 64
    }

    function TXS_IN_BATCH_LAST_PTR() -> ret {
        ret := add(TX_DESCRIPTION_BEGIN_BYTE(), mul(MAX_TRANSACTIONS_IN_BATCH(), TX_DESCRIPTION_SIZE()))
    }

    function MAX_MEM_SIZE() -> ret {
        ret := 0x1000000 
    }

    function L1_TX_INTRINSIC_L2_GAS() -> ret {
        ret := 167157 
    }

    function L1_TX_INTRINSIC_PUBDATA() -> ret {
        ret := 88 
    }

    function L2_TX_INTRINSIC_GAS() -> ret {
        ret := 14070 
    }

    function L2_TX_INTRINSIC_PUBDATA() -> ret {
        ret := 0
    }

    function RESULT_START_PTR() -> ret {
        ret := sub(MAX_MEM_SIZE(), mul(MAX_TRANSACTIONS_IN_BATCH(), 32))
    }

    function VM_HOOK_PTR() -> ret {
        ret := sub(RESULT_START_PTR(), 32)
    }

    function VM_HOOK_PARAMS() -> ret {
        ret := 2
    }

    function VM_HOOK_PARAMS_OFFSET() -> ret {
        ret := sub(VM_HOOK_PTR(), mul(VM_HOOK_PARAMS(), 32))
    }

    function LAST_FREE_SLOT() -> ret {
        ret := sub(VM_HOOK_PARAMS_OFFSET(), 32)
    }

    function BOOTLOADER_FORMAL_ADDR() -> ret {
        ret := 0x0000000000000000000000000000000000008001
    }

    function MAX_SYSTEM_CONTRACT_ADDR() -> ret {
        ret := 0x000000000000000000000000000000000000ffff
    }

    function CONTRACT_DEPLOYER_ADDR() -> ret {
        ret := 0x0000000000000000000000000000000000008006
    }
    
    
    function MSG_VALUE_SIMULATOR_ADDR() -> ret {
        ret := 0x0000000000000000000000000000000000008009
    }

    
    

    function ceilDiv(x, y) -> ret {
        switch or(eq(x, 0), eq(y, 0))
        case 0 {
            ret := add(div(sub(x, 1), y), 1)
        }
        default {
            ret := 0
        }
    }
    
    function lengthRoundedByWords(len) -> ret {
        let neededWords := div(add(len, 31), 32)
        ret := safeMul(neededWords, 32, "xv")
    }

    function processTx(
        txDataOffset, 
        resultPtr,
        transactionIndex,
        isETHCall,
        gasPerPubdata
    ) {
        setL2Block(transactionIndex)            
        let innerTxDataOffset := add(txDataOffset, 32)

        // By default we assume that the transaction has failed.
        mstore(resultPtr, 0)

        let userProvidedPubdataPrice := getGasPerPubdataByteLimit(innerTxDataOffset)

        switch getTxType(innerTxDataOffset) 
            case 255 {
                processL1Tx(txDataOffset, resultPtr, transactionIndex, userProvidedPubdataPrice, true)
            }
            default {

            }
    }

    function getCanonicalL1TxHash(txDataOffset) -> ret {
        mstore(txDataOffset, 32)
        let innerTxDataOffset := add(txDataOffset, 32)
        let dataLength := safeAdd(32, getDataLength(innerTxDataOffset), "qev")
        ret := keccak256(txDataOffset, dataLength)
    }

    function mintEther(to, amount, useNearCallPanic) {
    }

    function processL1Tx(
        txDataOffset,
        resultPtr,
        transactionIndex,
        gasPerPubdata,
        isPriorityOp
    ) {
        setPricePerPubdataByte(gasPerPubdata)
        
        // Skipping the first formal 0x20 byte
        let innerTxDataOffset := add(txDataOffset, 32)
        let gasLimitForTx, reservedGas := getGasLimitForTx(
            innerTxDataOffset, 
            transactionIndex, 
            gasPerPubdata, 
            L1_TX_INTRINSIC_L2_GAS(), 
            L1_TX_INTRINSIC_PUBDATA()
        ) 
        // @audit: gasLimitForTx => 0 if intrinsicOverhead is bigger 
        // than gasLimitForTx after deducting OperatorOverhead which causes the issue

        let gasUsedOnPreparation := 0
        let canonicalL1TxHash := 0

        canonicalL1TxHash, gasUsedOnPreparation := l1TxPreparation(txDataOffset)

        let refundGas := 0
        let success := 0

        let gasLimit := getGasLimit(innerTxDataOffset) // totalGasLimit

        let gasPrice := getMaxFeePerGas(innerTxDataOffset)
        let txInternalCost := safeMul(gasPrice, gasLimit, "poa")
        let value := getValue(innerTxDataOffset)
        if lt(getReserved0(innerTxDataOffset), safeAdd(value, txInternalCost, "ol")) {
            assertionError("deposited eth too low")
        }

        if gt(gasLimitForTx, gasUsedOnPreparation) { // gasLimitForTx could be zero
            let potentialRefund := 0
            success := 1 // set tx to success as we don't need to actually execute it for the PoC as it won't enter here
            // potentialRefund, success := getExecuteL1TxAndGetRefund(txDataOffset, sub(gasLimitForTx, gasUsedOnPreparation))

            // Asking the operator for refund
            //  askOperatorForRefund(potentialRefund)

            // In case the operator provided smaller refund than the one calculated
            // by the bootloader, we return the refund calculated by the bootloader.
            //  refundGas := max(getOperatorRefundForTx(transactionIndex), potentialRefund)
        }

        // @audit: if we reach here, and success is still zero. 
        // This means we didn't enter the if-condition body above
        refundGas := add(refundGas, reservedGas)

        if gt(refundGas, gasLimit) {
            assertionError("L1: refundGas > gasLimit")
        }

        let payToOperator := safeMul(gasPrice, safeSub(gasLimit, refundGas, "lpah"), "mnk")
        //  notifyAboutRefund(refundGas) // commented out not important

        // Paying the fee to the operator // body of this function is commented out but it is irrelavant here
        mintEther(BOOTLOADER_FORMAL_ADDR(), payToOperator, false)

        let toRefundRecipient
        switch success
        case 0 {
            toRefundRecipient := safeSub(getReserved0(innerTxDataOffset), payToOperator, "vji")
        }
        default {

            toRefundRecipient := safeSub(getReserved0(innerTxDataOffset), safeAdd(getValue(innerTxDataOffset), payToOperator, "kpa"), "ysl")
        }

        if gt(toRefundRecipient, 0) {
            let refundRecipient := getReserved1(innerTxDataOffset)
            refundRecipient := and(refundRecipient, sub(shl(160, 1), 1))
            mintEther(refundRecipient, toRefundRecipient, false) // body of this function is commented out but it is irrelavant here
        } 

        mstore(resultPtr, success)
        
        sendL2LogUsingL1Messenger(true, canonicalL1TxHash, success)

        if isPriorityOp {
            mstore(0, mload(PRIORITY_TXS_L1_DATA_BEGIN_BYTE()))
            mstore(32, canonicalL1TxHash)
            mstore(PRIORITY_TXS_L1_DATA_BEGIN_BYTE(), keccak256(0, 64))
            mstore(add(PRIORITY_TXS_L1_DATA_BEGIN_BYTE(), 32), add(mload(add(PRIORITY_TXS_L1_DATA_BEGIN_BYTE(), 32)), 1))
        }   
    }

    function getExecuteL1TxAndGetRefund(txDataOffset, gasForExecution) -> potentialRefund, success {
        // body removed as it is not required for this PoC
    }

    function l1TxPreparation(txDataOffset) -> canonicalL1TxHash, gasUsedOnPreparation {
        let innerTxDataOffset := add(txDataOffset, 32)
        
        let gasBeforePreparation := gas()

        canonicalL1TxHash := getCanonicalL1TxHash(txDataOffset)

        appendTransactionHash(canonicalL1TxHash, true)

        markFactoryDepsForTx(innerTxDataOffset, true)

        gasUsedOnPreparation := safeSub(gasBeforePreparation, gas(), "xpa")
    }

    function getGasPrice(
        maxFeePerGas,
        maxPriorityFeePerGas
    ) -> ret {
        let baseFee := basefee()

        if gt(maxPriorityFeePerGas, maxFeePerGas) {
            revertWithReason(
                MAX_PRIORITY_FEE_PER_GAS_GREATER_THAN_MAX_FEE_PER_GAS(),
                0
            )
        }

        if gt(baseFee, maxFeePerGas) {
            revertWithReason(
                BASE_FEE_GREATER_THAN_MAX_FEE_PER_GAS(),
                0
            )
        }

        ret := baseFee
    }

    

    function getGasLimitForTx(
        innerTxDataOffset,
        transactionIndex,
        gasPerPubdata,
        intrinsicGas,
        intrinsicPubdata
    ) -> gasLimitForTx, reservedGas {
        let totalGasLimit := getGasLimit(innerTxDataOffset)

        let operatorTrustedGasLimit := max(MAX_GAS_PER_TRANSACTION(), getOperatorTrustedGasLimitForTx(transactionIndex))

        // We remember the amount of gas that is beyond the operator's trust limit to refund it back later.
        switch gt(totalGasLimit, operatorTrustedGasLimit) 
        case 0 {
            reservedGas := 0
        }
        default {
            reservedGas := sub(totalGasLimit, operatorTrustedGasLimit)
            totalGasLimit := operatorTrustedGasLimit
        }

        let txEncodingLen := safeAdd(32, getDataLength(innerTxDataOffset), "lsh")

        let operatorOverheadForTransaction := getVerifiedOperatorOverheadForTx(
            transactionIndex,
            totalGasLimit,
            gasPerPubdata,
            txEncodingLen
        ) 
        // operatorOverheadForTransaction => 180926

        gasLimitForTx := safeSub(totalGasLimit, operatorOverheadForTransaction, "qr")
        let intrinsicOverhead := safeAdd(
            intrinsicGas, 
            // the error messages are trimmed to fit into 32 bytes
            safeMul(intrinsicPubdata, gasPerPubdata, "qw"),
            "fj" 
        )
        // intrinsicOverhead => 237557
        // gasLimitForTx => 199514 which is not enough
        switch lt(gasLimitForTx, intrinsicOverhead)
        case 1 {
            gasLimitForTx := 0
        }
        default {
            gasLimitForTx := sub(gasLimitForTx, intrinsicOverhead)
        }
    }

    function getOperatorRefundForTx(transactionIndex) -> ret {
        let refundPtr := add(TX_OPERATOR_REFUND_BEGIN_BYTE(), mul(transactionIndex, 32))
        ret := mload(refundPtr)
    }

    function getOperatorOverheadForTx(transactionIndex) -> ret {
        let txBatchOverheadPtr := add(TX_SUGGESTED_OVERHEAD_BEGIN_BYTE(), mul(transactionIndex, 32))
        ret := mload(txBatchOverheadPtr)
    }

    function getOperatorTrustedGasLimitForTx(transactionIndex) -> ret {
        let txTrustedGasLimitPtr := add(TX_OPERATOR_TRUSTED_GAS_LIMIT_BEGIN_BYTE(), mul(transactionIndex, 32))
        ret := mload(txTrustedGasLimitPtr)
    }

    function getVerifiedOperatorOverheadForTx(
        transactionIndex,
        txTotalGasLimit,
        gasPerPubdataByte,
        txEncodeLen
    ) -> ret {
        let operatorOverheadForTransaction := getOperatorOverheadForTx(transactionIndex)
        if gt(operatorOverheadForTransaction, txTotalGasLimit) {
            assertionError("Overhead higher than gasLimit")
        } 
        let txGasLimit := min(safeSub(txTotalGasLimit, operatorOverheadForTransaction, "www"), MAX_GAS_PER_TRANSACTION())

        let requiredOverhead := getTransactionUpfrontOverhead(
            txGasLimit,
            gasPerPubdataByte,
            txEncodeLen
        ) 

        // The required overhead is less than the overhead that the operator
        // has requested from the user, meaning that the operator tried to overcharge the user
        if lt(requiredOverhead, operatorOverheadForTransaction) {
            assertionError("Operator's overhead too high")
        }
        
        ret := operatorOverheadForTransaction
    }

    

    /// Returns the batch overhead to be paid, assuming a certain value of gasPerPubdata
    function getBatchOverheadGas(gasPerPubdata) -> ret {
        let computationOverhead := BATCH_OVERHEAD_L2_GAS()
        let l1GasOverhead := BATCH_OVERHEAD_L1_GAS()
        let l1GasPerPubdata := L1_GAS_PER_PUBDATA_BYTE()

        let pubdataEquivalentForL1Gas := safeDiv(l1GasOverhead, l1GasPerPubdata, "dd")
        
        ret := safeAdd(
            computationOverhead, 
            safeMul(gasPerPubdata, pubdataEquivalentForL1Gas, "aa"),
            "ab"
        )
    }

    function getTransactionUpfrontOverhead(
        txGasLimit,
        gasPerPubdataByte,
        txEncodeLen
    ) -> ret {
        ret := 0
        let totalBatchOverhead := getBatchOverheadGas(gasPerPubdataByte)

        let overheadForCircuits := ceilDiv(
            safeMul(totalBatchOverhead, txGasLimit, "ac"),
            MAX_GAS_PER_TRANSACTION() // 80_000_000
        )
        ret := max(ret, overheadForCircuits)
        
        let overheadForLength := ceilDiv(
            safeMul(txEncodeLen, totalBatchOverhead, "ad"),
            BOOTLOADER_MEMORY_FOR_TXS()
        )
        ret := max(ret, overheadForLength)

        
        let overheadForSlot := ceilDiv(
            totalBatchOverhead,
            MAX_TRANSACTIONS_IN_BATCH()
        )
        ret := max(ret, overheadForSlot)
    
    }

    function max(x, y) -> ret {
        ret := y
        if gt(x, y) {
            ret := x
        }
    }
    function min(x, y) -> ret {
        ret := y
        if lt(x, y) {
            ret := x
        }
    }

    function EMPTY_STRING_KECCAK() -> ret {
        ret := 0xc5d2460186f7233c927e7db2dcc703c0e500b653ca82273b7bfad8045d85a470
    }

    function lte(x, y) -> ret {
        ret := or(lt(x,y), eq(x,y))
    }

    function markFactoryDepsForTx(innerTxDataOffset, isL1Tx) {
    }

    ///
    /// zkSync-specific utilities:
    ///

    function sendL2LogUsingL1Messenger(isService, key, value) {
    }
    
    function setPricePerPubdataByte(newPrice) { // not needed here
    }

    function setL2Block(txId) {
    }

    function appendTransactionHash(
        txHash,
        isL1Tx
    ) {
    }

    /// @notice Asserts the equality of two values and reverts 
    /// with the appropriate error message in case it doesn't hold
    function assertEq(value1, value2, message) {
        switch eq(value1, value2) 
            case 0 { assertionError(message) }
            default { } 
    }

    /// @notice Makes sure that the structure of the transaction is set in accordance to its type
    function validateTypedTxStructure(innerTxDataOffset) {
        /// Some common checks for all transactions.
        let reservedDynamicLength := getReservedDynamicBytesLength(innerTxDataOffset)
        if gt(reservedDynamicLength, 0) {
            assertionError("non-empty reservedDynamic")
        }
        let txType := getTxType(innerTxDataOffset)
        switch txType // only 255 is required for this PoC                   
            case 255 {
                // Double-check that the operator doesn't try to do an upgrade transaction via L1 -> L2 transaction.
                assertEq(gt(getFrom(innerTxDataOffset), MAX_SYSTEM_CONTRACT_ADDR()), 1, "from in kernel space")
                // L1 transaction, no need to validate as it is validated on L1. 
            }
            default {
                assertionError("Unknown tx type")
            }
    }

    /// 
    /// TransactionData utilities
    /// 
    /// @dev The next methods are programmatically generated
    ///

    function getTxType(innerTxDataOffset) -> ret {
        ret := mload(innerTxDataOffset)
    }

    function getFrom(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 32))
    }

    function getTo(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 64))
    }

    function getGasLimit(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 96))
    }

    function getGasPerPubdataByteLimit(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 128))
    }

    function getMaxFeePerGas(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 160))
    }

    function getMaxPriorityFeePerGas(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 192))
    }

    function getPaymaster(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 224))
    }

    function getNonce(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 256))
    }

    function getValue(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 288))
    }

    function getReserved0(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 320))
    }

    function getReserved1(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 352))
    }

    function getReserved2(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 384))
    }

    function getReserved3(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 416))
    }

    function getDataPtr(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 448))
        ret := add(innerTxDataOffset, ret)
    }

    function getDataBytesLength(innerTxDataOffset) -> ret {
        let ptr := getDataPtr(innerTxDataOffset)
        ret := lengthRoundedByWords(mload(ptr))
    }

    function getSignaturePtr(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 480))
        ret := add(innerTxDataOffset, ret)
    }

    function getSignatureBytesLength(innerTxDataOffset) -> ret {
        let ptr := getSignaturePtr(innerTxDataOffset)
        ret := lengthRoundedByWords(mload(ptr))
    }

    function getFactoryDepsPtr(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 512))
        ret := add(innerTxDataOffset, ret)
    }

    function getFactoryDepsBytesLength(innerTxDataOffset) -> ret {
        let ptr := getFactoryDepsPtr(innerTxDataOffset)
        ret := safeMul(mload(ptr),32, "fwop")
    }

    function getPaymasterInputPtr(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 544))
        ret := add(innerTxDataOffset, ret)
    }

    function getPaymasterInputBytesLength(innerTxDataOffset) -> ret {
        let ptr := getPaymasterInputPtr(innerTxDataOffset)
        ret := lengthRoundedByWords(mload(ptr))
    }

    function getReservedDynamicPtr(innerTxDataOffset) -> ret {
        ret := mload(add(innerTxDataOffset, 576))
        ret := add(innerTxDataOffset, ret)
    }

    function getReservedDynamicBytesLength(innerTxDataOffset) -> ret {
        let ptr := getReservedDynamicPtr(innerTxDataOffset)
        ret := lengthRoundedByWords(mload(ptr))
    }

    /// This method checks that the transaction's structure is correct
    /// and tightly packed
    function validateAbiEncoding(txDataOffset) -> ret {
        if iszero(eq(mload(txDataOffset), 32)) {
            assertionError("Encoding offset")
        }

        let innerTxDataOffset := add(txDataOffset, 32)

        let fromValue := getFrom(innerTxDataOffset)
        if iszero(validateAddress(fromValue)) {
            assertionError("Encoding from")
        }

        let toValue := getTo(innerTxDataOffset)
        if iszero(validateAddress(toValue)) {
            assertionError("Encoding to")
        }

        let gasLimitValue := getGasLimit(innerTxDataOffset)
        if iszero(validateUint32(gasLimitValue)) {
            assertionError("Encoding gasLimit")
        }

        let gasPerPubdataByteLimitValue := getGasPerPubdataByteLimit(innerTxDataOffset)
        if iszero(validateUint32(gasPerPubdataByteLimitValue)) {
            assertionError("Encoding gasPerPubdataByteLimit")
        }

        let maxFeePerGas := getMaxFeePerGas(innerTxDataOffset)
        if iszero(validateUint128(maxFeePerGas)) {
            assertionError("Encoding maxFeePerGas")
        }

        let maxPriorityFeePerGas := getMaxPriorityFeePerGas(innerTxDataOffset)
        if iszero(validateUint128(maxPriorityFeePerGas)) {
            assertionError("Encoding maxPriorityFeePerGas")
        }

        let paymasterValue := getPaymaster(innerTxDataOffset)
        if iszero(validateAddress(paymasterValue)) {
            assertionError("Encoding paymaster")
        }

        let expectedDynamicLenPtr := add(innerTxDataOffset, 608)

        let dataLengthPos := getDataPtr(innerTxDataOffset)
        // let ptr := 0
        // mstore(ptr, dataLengthPos)
        // ptr := add(ptr, 32)
        // revert(0, ptr)

        if iszero(eq(dataLengthPos, expectedDynamicLenPtr)) {
            assertionError("Encoding data")
        }
        expectedDynamicLenPtr := validateBytes(dataLengthPos)

        let signatureLengthPos := getSignaturePtr(innerTxDataOffset)
        if iszero(eq(signatureLengthPos, expectedDynamicLenPtr)) {
            assertionError("Encoding signature")
        }
        expectedDynamicLenPtr := validateBytes(signatureLengthPos)

        let factoryDepsLengthPos := getFactoryDepsPtr(innerTxDataOffset)
        if iszero(eq(factoryDepsLengthPos, expectedDynamicLenPtr)) {
            assertionError("Encoding factoryDeps")
        }
        expectedDynamicLenPtr := validateBytes32Array(factoryDepsLengthPos)

        let paymasterInputLengthPos := getPaymasterInputPtr(innerTxDataOffset)
        if iszero(eq(paymasterInputLengthPos, expectedDynamicLenPtr)) {
            assertionError("Encoding paymasterInput")
        }
        expectedDynamicLenPtr := validateBytes(paymasterInputLengthPos)

        let reservedDynamicLengthPos := getReservedDynamicPtr(innerTxDataOffset)
        if iszero(eq(reservedDynamicLengthPos, expectedDynamicLenPtr)) {
            assertionError("Encoding reservedDynamic")
        }
        expectedDynamicLenPtr := validateBytes(reservedDynamicLengthPos)

        ret := expectedDynamicLenPtr
    }

    function getDataLength(innerTxDataOffset) -> ret {
        // To get the length of the txData in bytes, we can simply
        // get the number of fields * 32 + the length of the dynamic types
        // in bytes.
        ret := 768

        ret := safeAdd(ret, getDataBytesLength(innerTxDataOffset), "asx")        
        ret := safeAdd(ret, getSignatureBytesLength(innerTxDataOffset), "qwqa")
        ret := safeAdd(ret, getFactoryDepsBytesLength(innerTxDataOffset), "sic")
        ret := safeAdd(ret, getPaymasterInputBytesLength(innerTxDataOffset), "tpiw")
        ret := safeAdd(ret, getReservedDynamicBytesLength(innerTxDataOffset), "shy")
    }

    /// 
    /// End of programmatically generated code
    ///

    /// @dev Accepts an address and returns whether or not it is
    /// a valid address
    function validateAddress(addr) -> ret {
        ret := lt(addr, shl(160, 1))
    }

    /// @dev Accepts an uint32 and returns whether or not it is
    /// a valid uint32
    function validateUint32(x) -> ret {
        ret := lt(x, shl(32,1))
    }


    /// @dev Accepts an uint32 and returns whether or not it is
    /// a valid uint64
    function validateUint128(x) -> ret {
        ret := lt(x, shl(128,1))
    }

    /// Validates that the `bytes` is formed correctly
    /// and returns the pointer right after the end of the bytes
    function validateBytes(bytesPtr) -> bytesEnd {
        let length := mload(bytesPtr)
        let lastWordBytes := mod(length, 32)

        switch lastWordBytes
        case 0 { 
            // If the length is divisible by 32, then 
            // the bytes occupy whole words, so there is
            // nothing to validate
            bytesEnd := safeAdd(bytesPtr, safeAdd(length, 32, "pol"), "aop") 
        }
        default {
            // If the length is not divisible by 32, then 
            // the last word is padded with zeroes, i.e.
            // the last 32 - `lastWordBytes` bytes must be zeroes
            // The easiest way to check this is to use AND operator

            let zeroBytes := sub(32, lastWordBytes)
            // It has its first 32 - `lastWordBytes` bytes set to 255
            let mask := sub(shl(mul(zeroBytes,8),1),1)

            let fullLen := lengthRoundedByWords(length)
            bytesEnd := safeAdd(bytesPtr, safeAdd(32, fullLen, "dza"), "dzp")

            let lastWord := mload(sub(bytesEnd, 32))

            // If last word contains some unintended bits
            // return 0
            if and(lastWord, mask) {
                assertionError("bad bytes encoding")
            }
        }
    }

    /// @dev Accepts the pointer to the bytes32[] array length and 
    /// returns the pointer right after the array's content 
    function validateBytes32Array(arrayPtr) -> arrayEnd {
        // The bytes32[] array takes full words which may contain any content.
        // Thus, there is nothing to validate.
        let length := mload(arrayPtr)
        arrayEnd := safeAdd(arrayPtr, safeAdd(32, safeMul(length, 32, "lop"), "asa"), "sp")
    }

    ///
    /// Safe math utilities
    ///

    function safeMul(x, y, errMsg) -> ret {
        switch y
        case 0 {
            ret := 0
        }
        default {
            ret := mul(x, y)
            if iszero(eq(div(ret, y), x)) {
                assertionError(errMsg)
            }
        }
    }

    function safeDiv(x, y, errMsg) -> ret {
        if iszero(y) {
            assertionError(errMsg)
        }
        ret := div(x, y)
    }

    function safeAdd(x, y, errMsg) -> ret {
        ret := add(x, y)
        if lt(ret, x) {
            assertionError(errMsg)
        }
    }

    function safeSub(x, y, errMsg) -> ret {
        if gt(y, x) {
            assertionError(errMsg)
        }
        ret := sub(x, y)
    }

    ///
    /// Debug utilities
    ///

    function debugReturndata() {
    }

    function notifyAboutRefund(refund) {
    }

    

    function askOperatorForRefund(gasLeft) {
    }
    
    /// 
    /// Error codes used for more correct diagnostics from the server side.
    /// 

    function MAX_PRIORITY_FEE_PER_GAS_GREATER_THAN_MAX_FEE_PER_GAS() -> ret {
        ret := 13
    }

    function BASE_FEE_GREATER_THAN_MAX_FEE_PER_GAS() -> ret {
        ret := 14
    }

    function ASSERTION_ERROR() -> ret {
        ret := 17
    }

    /// @dev Accepts a 1-word literal and returns its length in bytes
    function getStrLen(str) -> len {
        len := 0
        for {} str {str := shl(8, str)} {
            len := add(len, 1)
        }
    }   

    function GENERAL_ERROR_SELECTOR() -> ret {
    }

    function assertionError(err) {
        let ptr := 0
        mstore8(ptr, ASSERTION_ERROR())
        ptr := add(ptr, 1)
        mstore(ptr, GENERAL_ERROR_SELECTOR())
        ptr := add(ptr, 4)
        mstore(ptr, 32)
        ptr := add(ptr, 32)
        mstore(ptr, getStrLen(err))
        ptr := add(ptr, 32)
        mstore(ptr, err)
        ptr := add(ptr, 32)
        revert(0, ptr)
    }

    function revertWithReason(errCode, sendReturnData) {
        let returndataLen := 1
        mstore8(0, errCode)

        if sendReturnData {
            returndataLen := add(returndataLen, returndatasize())
            returndatacopy(1, 0, returndatasize())
        }
        revert(0, returndataLen)
    }
    
    ////////////////////////////////////////////////////////////////////////////
    //     For PoC , call processTX directly to process one L1->L2 TX only    //
    ////////////////////////////////////////////////////////////////////////////
    let L1_GAS_PRICE := 13000000000 // Assume it as 13 Gwei // mload(128)
    let FAIR_L2_GAS_PRICE := 500000000 // mload(160)
    let baseFee, GAS_PRICE_PER_PUBDATA := getBaseFee(L1_GAS_PRICE, FAIR_L2_GAS_PRICE)
    let gasPerPubdata := 0
    
    let currentExpectedTxOffset := add(TXS_IN_BATCH_LAST_PTR(), mul(MAX_POSTOP_SLOTS(), 32))
    let txPtr := TX_DESCRIPTION_BEGIN_BYTE()

    mstore(COMPRESSED_BYTECODES_BEGIN_BYTE(), add(COMPRESSED_BYTECODES_BEGIN_BYTE(), 32))

    mstore(PRIORITY_TXS_L1_DATA_BEGIN_BYTE(), EMPTY_STRING_KECCAK())
    mstore(add(PRIORITY_TXS_L1_DATA_BEGIN_BYTE(), 32), 0)


    let transactionIndex := 0
    let resultPtr := RESULT_START_PTR()

    txPtr := add(txPtr, TX_DESCRIPTION_SIZE())
    resultPtr := add(resultPtr, 32)
    transactionIndex := add(transactionIndex, 1) 

    let txDataOffset := mload(add(txPtr, 32))
    txDataOffset := currentExpectedTxOffset // set txDataOffset to the expected

    // Set Encoding offset
    mstore(txDataOffset, 32)
    // innerTxDataOffset Starts from txType
    let innerTxDataOffset := add(txDataOffset, 32)
    // copy from calldata
    calldatacopy(innerTxDataOffset, 0, calldatasize())
    
    currentExpectedTxOffset := validateAbiEncoding(txDataOffset)

    // Checking whether the last slot of the transaction's description
    // does not go out of bounds.
    if gt(sub(currentExpectedTxOffset, 32), LAST_FREE_SLOT()) {
        assertionError("currentExpectedTxOffset too high")
    }
    validateTypedTxStructure(add(txDataOffset, 32))

    // The operator sets the trusted gas limit 
    let txTrustedGasLimitPtr := add(TX_OPERATOR_TRUSTED_GAS_LIMIT_BEGIN_BYTE(), mul(transactionIndex, 32))
    mstore(txTrustedGasLimitPtr,80000000) 
    // The operator sets the OperatorOverheadForTx 
    let txBatchOverheadPtr := add(TX_SUGGESTED_OVERHEAD_BEGIN_BYTE(), mul(transactionIndex, 32))
    mstore(txBatchOverheadPtr,180926) // requiredOverhead => getTransactionUpfrontOverhead
    // 180926 is the maximum requiredOverhead that the operator can provide. Otherwise, it reverts

    processTx(txDataOffset, resultPtr, transactionIndex, 0, GAS_PRICE_PER_PUBDATA)
    let success := mload(resultPtr)
    // Check if the Tx succeeded.
    if iszero(success){
        assertionError("L1->L2 TX failed")
    }
}
}
}

Tools Used

Manual analysis

Recommended Mitigation Steps

• _transaction.gasLimit should be replaced with l2GasForTxBody

getMinimalPriorityTransactionGasLimit(
                _encoded.length,
                _transaction.factoryDeps.length,
                _transaction.gasPerPubdataByteLimit
            ) <= l2GasForTxBody,
            "up"

TransactionValidator.sol#L36-L43

Assessed type

Invalid Validation