Summary

TokenFactory uses the YUL create() function to deploy a token. However, on ZKSync, this function will not work as expected.

Vulnerability Details

The ZKSync documentation states that create() will not work because the compile needs to be aware of bytecode at compile time.
Contract deployment uses the hash of the bytecode.

Impact

Token deployment fails on ZKSync.

Tools Used

Manual inspection.

Recommendations

As stated in the ZKSync documentation, the protocol should use the following pattern:

MyContract a = new MyContract();

MyContract b = new MyContract{salt: ...}();

[…]
[T]he subsequent code should also work, but it must be explicitly tested to ensure its intended functionality:

bytes memory bytecode = type(MyContract).creationCode;

assembly {

addr := create2(0, add(bytecode, 32), mload(bytecode), salt)

}