web3-hunt-zksync-era
starsforks
How to install web3-hunt-zksync-era?
shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-hunt-zksync-era
$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-hunt-zksync-eraZKsync Era (Immunefi) completed hunt — 0 findings after exhaustive 5-session audit. Use as a DEFENSE STUDY — learn what makes a protocol unhuntable, which patterns block all 10 bug classes, and when to abandon a target. Contains architecture breakdown, 25 tested attack vectors, a
SKILL.md
| 1 | # LIVE HUNT: ZKsync Era (Immunefi) — COMPLETED, 0 FINDINGS |
| 2 | |
| 3 | > **Outcome**: 0 submittable findings after 5+ sessions, 22+ agents, 25+ contracts, 25+ attack vectors |
| 4 | > **Lesson**: This file exists as a DEFENSE STUDY — what a hardened protocol looks like, and when to stop hunting. |
| 5 | |
| 6 | --- |
| 7 | |
| 8 | ## TARGET PROFILE |
| 9 | |
| 10 | | Field | Value | |
| 11 | |-------|-------| |
| 12 | | Protocol | ZKsync Era (L2 rollup) | |
| 13 | | Platform | Immunefi | |
| 14 | | TVL | $322M (L2BEAT Total Value Secured) | |
| 15 | | Bounty | $100K minimum Critical, $1.1M max | |
| 16 | | Codebase | 750K LOC (Solidity + Rust + Yul) | |
| 17 | | Audits | OpenZeppelin V29 (June 2025), multiple prior audits | |
| 18 | | Version | Protocol V29.4 | |
| 19 | | Repo | `github.com/matter-labs/era-contracts` | |
| 20 | | Primacy | Primacy of Impact — even out-of-scope assets qualify | |
| 21 | | Prior payouts | $50K (ChainLight ZK circuit bug) | |
| 22 | |
| 23 | ### Pre-Dive Scorecard |
| 24 | |
| 25 | | Check | Result | Score | |
| 26 | |-------|--------|-------| |
| 27 | | TVL > $500K | $322M | PASS | |
| 28 | | Max payout > $10K | $100K minimum | PASS | |
| 29 | | Simple protocol? | 750K LOC, L1↔L2 bridge + ZK + governance | PASS (complex) | |
| 30 | | < 500 lines? | 750K LOC | PASS | |
| 31 | | **Audit quality** | OpenZeppelin (top-tier) on ALL critical paths | **WARNING** | |
| 32 | |
| 33 | > **REFINEMENT**: Pre-dive should weight audit quality MORE for large protocols. |
| 34 | > A protocol passing TVL/LOC/payout checks can still be unhuntable if OZ/ToB audited the exact code you'd hunt. |
| 35 | > Add "audit firm tier" as a SOFT kill signal for 500K+ LOC protocols. |
| 36 | |
| 37 | --- |
| 38 | |
| 39 | ## ARCHITECTURE (What Makes It Hardened) |
| 40 | |
| 41 | ### L1 Bridge Stack |
| 42 | ``` |
| 43 | Bridgehub (router) |
| 44 | ├── L1AssetRouter (token routing) |
| 45 | │ ├── L1Nullifier (deposit/withdrawal state) |
| 46 | │ └── L1NativeTokenVault (token custody) |
| 47 | ├── ChainTypeManager (chain registration) |
| 48 | └── ValidatorTimelock (RBAC execution delay) |
| 49 | ``` |
| 50 | |
| 51 | ### L2 System Contracts (kernel space 0x8000-0xFFFF) |
| 52 | ``` |
| 53 | Bootloader (0x8001) → AccountCodeStorage, NonceHolder, KnownCodeStorage, |
| 54 | ImmutableSimulator, ContractDeployer, L1Messenger (0x8008), |
| 55 | MsgValueSimulator, L2BaseToken (0x800a), SystemContext (0x800b), |
| 56 | BootloaderUtilities, Compressor, ComplexUpgrader |
| 57 | ``` |
| 58 | |
| 59 | ### L2 User Space Contracts (0x10000+) |
| 60 | ``` |
| 61 | Create2Factory, Bridgehub, AssetRouter, NativeTokenVault, MessageRoot |
| 62 | ``` |
| 63 | |
| 64 | ### Diamond Proxy Pattern (EIP-2535) |
| 65 | - All facets (Admin, Executor, Mailbox, Getters) share single `ZKChainStorage` struct |
| 66 | - No storage collision possible between facets |
| 67 | - Function selectors explicitly mapped in DiamondCut |
| 68 | |
| 69 | --- |
| 70 | |
| 71 | ## ALL 25 ATTACK VECTORS TESTED |
| 72 | |
| 73 | ### Critical Path (Vectors 1-8) |
| 74 | |
| 75 | | # | Vector | Target | Why It Failed | |
| 76 | |---|--------|--------|---------------| |
| 77 | | 1 | UnsafeBytes offset miscalculation | L1Nullifier `_parseL2WithdrawalMessage` | All callers pre-validate message length before UnsafeBytes calls | |
| 78 | | 2 | Legacy/new boundary double-withdrawal | L1Nullifier | `_isLegacyTxDataHash` try/catch returns false on decode failure; encoding prefix discriminator prevents collision | |
| 79 | | 3 | `secondBridgeAddress` return value manipulation | Bridgehub `requestL2TransactionTwoBridges` | `>0xFFFF` check blocks system contracts; L2-side `msg.sender` auth makes crafted returns useless | |
| 80 | | 4 | Failed deposit claim wrong amount (legacy encoding) | L1Nullifier `claimFailedDeposit` | Legacy hash uses try/catch; `depositHappened` correctly tracks per-encoding-version | |
| 81 | | 5 | V29 interop root forgery | Executor | `addChainBatchRoot` requires `onlyChain + onlyL2`; historical roots verified via Merkle | |
| 82 | | 6 | Missing access control on sibling function | All bridge contracts | Every external function has appropriate modifier; checked all 50+ external functions | |
| 83 | | 7 | Fee-on-transfer token accounting desync | NativeTokenVault | L1ERC20Bridge: `if (amount != _amount) revert TokensWithFeesNotSupported()` | |
| 84 | | 8 | Governance timelock bypass | ValidatorTimelock | 5-role RBAC via AccessControlEnumerable; `block.timestamp >= commitTimestamp + delay` | |
| 85 | |
| 86 | ### Extended Surface (Vectors 9-25) |
| 87 | |
| 88 | | # | Vector | Why It Failed | |
| 89 | |---|--------|---------------| |
| 90 | | 9 | GatewayTransactionFilterer bypass | Era mainnet: `transactionFilterer == address(0)`, not used | |
| 91 | | 10 | Precommitment sentinel collision | `_revertBatches` properly resets precommitment; sentinel values don't collide | |
| 92 | | 11 | L2→L1 message forgery via `sendToL1` | Anyone can call `sendToL1`, but L1 verifies `sender=0x8008` in log — can't forge system log sender | |
| 93 | | 12 | Compressor state diff manipulation | `publishCompressedBytecode` called only from bootloader context | |
| 94 | | 13 | Admin privilege escalation | Diamond proxy admin is governance; no facet can self-modify | |
| 95 | | 14 | Fee calculation overflow | All fee math uses SafeMath or checked arithmetic | |
| 96 | | 15 |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
