zkSync Era - wangxx2026's results

Lines of code

https://github.com/code-423n4/2023-10-zksync/blob/1fb4649b612fac7b4ee613df6f6b7d921ddd6b0d/code/contracts/ethereum/contracts/zksync/ValidatorTimelock.sol#L113-L128 https://github.com/code-423n4/2023-10-zksync/blob/1fb4649b612fac7b4ee613df6f6b7d921ddd6b0d/code/contracts/ethereum/contracts/zksync/facets/Executor.sol#L291-L307 https://github.com/code-423n4/2023-10-zksync/blob/1fb4649b612fac7b4ee613df6f6b7d921ddd6b0d/code/contracts/ethereum/contracts/zksync/facets/Admin.sol#L68-L71 https://github.com/code-423n4/2023-10-zksync/blob/1fb4649b612fac7b4ee613df6f6b7d921ddd6b0d/code/contracts/ethereum/contracts/zksync/facets/Base.sol#L24-L33

Vulnerability details

Impact

A user can bypass time limits and Governance authorization to execute executeBatches

In the readme, it is particularly emphasized that authorized users must also receive process restrictions, so the impact should be high

Proof of Concept

The execution of ValidatorTimelock.executeBatches adds a time limit, the code is shown below.

    function executeBatches(StoredBatchInfo[] calldata _newBatchesData) external onlyValidator {
   ...
       require(block.timestamp >= commitBatchTimestamp + delay, "5c"); // The delay is not passed
   ...
    }

Then request the ExecutorFacet.executeBatches method through DiamondProxy. This method has no time limit and can also be accessed directly by authorized users. The code is as follows //found

    function executeBatches(StoredBatchInfo[] calldata _batchesData) external nonReentrant onlyValidator { // found
...

    }

    /// @notice Checks if validator is active
    modifier onlyValidator() {
        require(s.validators[msg.sender], "1h"); //found
        _;
    }

Governor authorization is not required, and access can also be authorized through admin. The code is as follows //found

    function setValidator(address _validator, bool _active) external onlyGovernorOrAdmin {
        s.validators[_validator] = _active; // found
        emit ValidatorStatusUpdate(_validator, _active);
    }

    modifier onlyGovernorOrAdmin() {
        require(msg.sender == s.governor || msg.sender == s.admin, "Only by governor or admin");// found
        _;
    }

Finally, a Validator not authorized by the Governor can bypass the time limit and execute executeBatches in advance.

Tools Used

Manual Review

Recommended Mitigation Steps

In ExecutorFacet.executeBatches, adding msg.sender can only be the ValidatorTimelock contract

Assessed type

Access Control