zkSync Era - erebus's results

Lines of code

https://github.com/code-423n4/2024-03-zksync/blob/4f0ba34f34a864c354c7e8c47643ed8f4a250e13/code/contracts/ethereum/contracts/state-transition/StateTransitionManager.sol#L166

Vulnerability details

Impact

There is a typo when unfreezing an hyperchain, which makes it impossible to unfreeze a previously freezed one.

Proof of Concept

Pretty visual

StateTransitionManager, function unfreezeChain

    /// @dev freezes the specified chain
    function unfreezeChain(uint256 _chainId) external onlyOwner {
        IZkSyncStateTransition(stateTransition[_chainId]).freezeDiamond(); // @audit must be unfreezeDiamond(), typo
    }

Calling unfreezeChain on a freezed one will always revert due to the following require in

Admin, function freezeDiamond

    function freezeDiamond() external onlyAdminOrStateTransitionManager {
        ...

        require(!diamondStorage.isFrozen, "a9"); // diamond proxy is frozen already
        
        ...
    }

Runnable POC (for completeness)

    function test_freezeX2() public {
        address admin = utilsFacet.util_getAdmin();

        vm.expectRevert(bytes.concat("a9"));

        vm.startPrank(admin);
        adminFacet.freezeDiamond();
        adminFacet.freezeDiamond();
        vm.stopPrank();
    }
    

Recommended Mitigation Steps

Trivial

StateTransitionManager, function unfreezeChain

    /// @dev freezes the specified chain
    function unfreezeChain(uint256 _chainId) external onlyOwner {
-       IZkSyncStateTransition(stateTransition[_chainId]).freezeDiamond();
+       IZkSyncStateTransition(stateTransition[_chainId]).unfreezeDiamond();
    }

Assessed type

Other