CVE-2024-35229: ZKsync Era evaluation order of Yul function arguments

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-27 · updated 2026-06-17
Weakness: CWE-696

Description

ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern `f(a(),b()); check_if_a_executed_last()` in Yul that exposes a bug in evaluation order of Yul function arguments. This vulnerability has been fixed in version 1.3.10. As a workaround, update and redeploy affected contracts.

Affected products

matter-labs era-compiler-solidity: before 1.3.10 — fixed in 1.3.10

How to fix

Upgrade to a fixed version: matter-labs era-compiler-solidity 1.3.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-35229 or the next vulnerability affects your stack