CVE-2024-35229

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-35229
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35229.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-35229
Aliases
  • GHSA-jf9w-7f5g-j95p
Published
2024-05-27T16:20:27.432Z
Modified
2025-12-05T04:21:31.369417Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
ZKsync Era evaluation order of Yul function arguments
Details

ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern f(a(),b()); check_if_a_executed_last() in Yul that exposes a bug in evaluation order of Yul function arguments. This vulnerability has been fixed in version 1.3.10. As a workaround, update and redeploy affected contracts.

Database specific 
{
    "cwe_ids": [
        "CWE-696"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35229.json"
}
References

Affected packages

Git / github.com/matter-labs/era-compiler-solidity

Affected ranges

Type
GIT
Repo
https://github.com/matter-labs/era-compiler-solidity
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
46ce047b51576495779b9f67534207d8154eab79

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35229.json"