First Flight #4: Boss Bridge

Summary

In the current code devs are using CREATE but in zkSync Era, CREATE for arbitrary bytecode is not available, so a revert occurs in the deployToken process.

Vulnerability Details

According to the contest README which you can see here and i've listed it below also, the project can be deployed in zkSync Era

The zkSync Era docs explain how it differs from Ethereum.

The description of CREATE and CREATE2 (https://era.zksync.io/docs/reference/architecture/differences-with-ethereum.html#create-create2) states that Create cannot be used for arbitrary code unknown to the compiler.

According to zkSync The following code will not function correctly because the compiler is not aware of the bytecode beforehand:

Now if we look at the code of Boss Bridge here we can see that Boss Bridge is using exactly similar code which is as below

Impact

Protocol will not work on zkSync

Tools Used

Manual Review

Recommendations

Follow the instructions that are stated in zksync docs here

To guarantee that create/create2 functions operate correctly, the compiler must be aware of the bytecode of the deployed contract in advance. The compiler interprets the calldata arguments as incomplete input for ContractDeployer, as the remaining part is filled in by the compiler internally. The Yul datasize and dataoffset instructions have been adjusted to return the constant size and bytecode hash rather than the bytecode itself

The code below should work as expected:

In addition, the subsequent code should also work, but it must be explicitly tested to ensure its intended functionality: