zkSync Era - zhanmingjing's results

Lines of code

https://github.com/code-423n4/2024-03-zksync/blob/main/code/contracts/ethereum/contracts/state-transition/StateTransitionManager.sol#L159-L167

Vulnerability details

Impact

state-transition#unfreezeChain is freezeChain in fact. When owner tries to unfreezeChain, he freezeChain again, which means, he couldn't unfreeze chain.

Proof of Concept

https://github.com/code-423n4/2024-03-zksync/blob/main/code/contracts/ethereum/contracts/state-transition/StateTransitionManager.sol#L159-L167

/// @dev freezes the specified chain
function freezeChain(uint256 _chainId) external onlyOwner {
    IZkSyncStateTransition(stateTransition[_chainId]).freezeDiamond();
}

/// @dev freezes the specified chain
function unfreezeChain(uint256 _chainId) external onlyOwner {
    IZkSyncStateTransition(stateTransition[_chainId]).freezeDiamond();
}

In function unfreezeChain(), shoud be : IZkSyncStateTransition(stateTransition[_chainId]).unfreezeDiamond();

Tools Used

manually reviewed.

Recommended Mitigation Steps

change function unfreezeChain() to the following:

function unfreezeChain(uint256 _chainId) external onlyOwner { IZkSyncStateTransition(stateTransition[_chainId]).unfreezeDiamond(); }

Assessed type

Other