CVE-2024-34704

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-34704

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-34704.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-34704

Aliases

GHSA-22pj-7cvw-r3gc

Published

2024-05-13T19:13:27.510Z

Modified

2026-08-12T03:51:36.341006882Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

era-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimization

Details

era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the DAGCombine phase while visiting the XOR operation. The issue arises when attempting to fold the expression !(x cc y) into (x !cc y). To perform this transformation, the second operand of XOR should be a constant representing the true value. However, it was incorrectly assumed that -1 represents the true value, when in fact, 1 is the correct representation, so this transformation for this case should be skipped. This vulnerability is fixed in 1.4.1.

Database specific

{
    "cwe_ids": [
        "CWE-682"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34704.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/matter-labs/era-compiler-solidity

Affected ranges

Type

GIT

Repo

https://github.com/matter-labs/era-compiler-solidity

Events

Introduced

Last affected

cd75c8a1c36b9992109d244bc5a10c0a098c04a8

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.2.0"
        },
        {
            "last_affected": "1.4.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.3.23

1.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-34704.json"