First Flight #4: Boss Bridge

Summary

As the documentation shows, the TokenFactory.sol will be deployed on ZkSync

But the create assembly operation should use a bytecode hash instead of the full bytecode

L2 contracts are deployed by bytecode hash, not by full bytecode
Factory dependencies - list of bytecode hashes that can be deployed on L2 Address derivation for create/create2 on L1 and L2 is different

Source:

https://era.zksync.io/docs/reference/architecture/contract-deployment.html#ethereum-zksync-differences-in-contract-deployment

https://github.com/code-423n4/2022-10-zksync

Vulnerability Details

DeployToken will fail on L2

Impact

Contract deployment will fail in the factory

Tools Used

Zksync doc

Recommendations

On zkSync Era, contract deployment is performed using the hash of the bytecode, and the factoryDeps field of EIP712 transactions contains the bytecode. The actual deployment occurs by providing the contract's hash to the ContractDeployer system contract.

To guarantee that create/create2 functions operate correctly, the compiler must be aware of the bytecode of the deployed contract in advance. The compiler interprets the calldata arguments as incomplete input for ContractDeployer, as the remaining part is filled in by the compiler internally.

https://era.zksync.io/docs/reference/architecture/differences-with-ethereum.html#create-create2