First Flight #15: Mondrian Wallet

Summary

ZKSync network has its own native account abstraction implementation (https://docs.zksync.io/build/developer-reference/account-abstraction.html), which uses the Bootloader program as part of the account abstraction transaction process. This means there is no EntryPoint smart contract.

Vulnerability Details

Because ZKSync network has its native account abstraction feature, there is no EntryPoint smart contract. Therefore, some functions from the EntryPoint used in MondrianWallet won't work. These functions are:

• MondrianWallet::getNonce

• MondrianWallet::getDeposit

• MondrianWallet::addDeposit

On the other hand, if provided the correct Bootloader address as the constructor's entryPoint argument, MondrianWallet::requireFromEntryPoint and MondrianWallet::requireFromEntryPointOrOwner will work perfectly since msg.sender will be the Bootloader formal address, as stated in the official documentation (https://docs.zksync.io/zk-stack/components/zkEVM/bootloader.html).

Impact

Some core account abstraction functionalities won't work, such as getting the account's balance or adding deposits via EntryPoint.

Tools Used

Manual review

Recommendations

An alternative would be to just not use those functionalities and do a direct transfer to the wallet when adding funds and read the wallet's address balance directly.