CVE-2024-45056
📋 TL;DR
A compiler optimization bug in zksolc (Solidity compiler for ZKsync) incorrectly handles bitwise rotation operations, producing wrong machine code. This could cause smart contracts to execute incorrectly, potentially leading to unexpected behavior or security issues. Only affects developers who compiled contracts with vulnerable zksolc versions.
💻 Affected Systems
- zksolc (Solidity compiler for ZKsync)
📦 What is this software?
Zksolc by Matter Labs
⚠️ Risk & Real-World Impact
Worst Case
Smart contracts execute with incorrect logic, potentially allowing unauthorized actions, fund loss, or contract state corruption.
Likely Case
Contracts may behave unpredictably or fail during execution, but analysis shows no contracts were actually affected before patching.
If Mitigated
If contracts were compiled with vulnerable compiler but not deployed, or if redeployed after patching, no impact occurs.
🎯 Exploit Status
Exploitation requires understanding of specific bitwise operations and compiler output. No known exploits exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.3
Vendor Advisory: https://github.com/matter-labs/era-compiler-solidity/security/advisories/GHSA-fpx7-8vc6-frjj
Restart Required: No
Instructions:
1. Upgrade zksolc to version 1.5.3 or later. 2. Recompile all Solidity contracts with the patched compiler. 3. Redeploy any contracts compiled with vulnerable versions.
🔧 Temporary Workarounds
Disable compiler optimizations
allCompile contracts without optimization flags to avoid the bug
zksolc --no-optimize contract.sol
🧯 If You Can't Patch
- Avoid using bitwise rotation operations in Solidity contracts
- Audit contracts compiled with vulnerable versions for incorrect behavior
🔍 How to Verify
Check if Vulnerable:
Check zksolc version with 'zksolc --version'. If version is earlier than 1.5.3, you are vulnerable.Check Version:
zksolc --versionVerify Fix Applied:
After upgrading, verify version is 1.5.3 or later and recompile contracts.📡 Detection & Monitoring
Log Indicators:
- Compiler warnings about optimization issues
- Contract execution failures involving bitwise operations
Network Indicators:
- None - this is a compile-time issue
SIEM Query:
Not applicable for compile-time vulnerabilities