First Flight #4: Boss Bridge

According to the README, the TokenFactory contract will be deployed to ZKSync Era. TokenFactory::deployToken uses the create() opcode which works differently on ZKSync Era than Ethereum. This means that TokenFactory::deployToken will not yield the expected output.

Vulnerability details

The following ZKSync Era documentation states that CREATE works differently than on Ethereum and cannot be used for arbitrary code unknown to the compiler. The create() opcode is used in TokenFactory::deployToken on line 25:

Since the contractBytecode is provided by the caller which is passed directly to create() meaning that deployToken() will not work as expected on ZKSYnc Era as the bytecode of the contract must be known by the compiler in advance for create() to operate correctly. This means the ERC20 token contract address deployed will not be as expected compared to deployments on other EVM chains.

See this Sherlock finding for more details.

## Impact

Deploying the token to ZKSync Era is core contract functionality, as detailed in the README, this functionality is broken, rendering the contract useless. This is therefore a medium severity finding.

Recommended mitigation

Refer to the zkSync documentation for create() design consideration as explained above.