Summary

The protocol intends to allow all bridges to be migrated and this is seen in the implemention of Bridgehb::_registerNewZKChain function with its bool of _checkMaxNumberOfZKChains, but the check in MessageRoot::_addNewChain can prevent this from happening during Bridgehub::bridgeMint.

Vulnerabilty Details

From the specs on Bridgehb::_registerNewZKChain:

• https://github.com/Cyfrin/2024-10-zksync/blob/cfc1251de29379a9548eeff1eea3c78267288356/era-contracts/l1-contracts/contracts/bridgehub/Bridgehub.sol#L383-L386

This indicates that cases like brigde migration shouldn't be stopped by bridges having reached the MAX_NUMBER_OF_ZK_CHAINS, as bridge migarations should be gauranteed.

During bridge migration in Bridgehub::bridgeMint, when the chain being migrated is not yet deployed, the contract deploys the new chain and calls Bridgehb::_registerNewZKChain with _checkMaxNumberOfZKChains = false:

• https://github.com/Cyfrin/2024-10-zksync/blob/cfc1251de29379a9548eeff1eea3c78267288356/era-contracts/l1-contracts/contracts/bridgehub/Bridgehub.sol#L775-L777

As you can see the spec, it wants to ensure that any chain is migrated.

The call to messageRoot will cause issues and can prevent this ensuarance from happen as messageRoot::addNewChain will call _addNewChain internal function.

The _addNewChain has a check:

• https://github.com/Cyfrin/2024-10-zksync/blob/cfc1251de29379a9548eeff1eea3c78267288356/era-contracts/l1-contracts/contracts/bridgehub/MessageRoot.sol#L153-L156

For cases where the MAX_NUMBER_OF_ZK_CHAINS has been reached, this check will revert the entire migration transaction hence preventing the ensurance that all migrations should be gauranted.

Imapct

Denial of chain migration which should be gauranteed all the time.

Recommention

Consider implementing MessageRoot::_addNewChain the way Bridgehb::_registerNewZKChain with a bool to prevent the check.