CVE-2024-35229: Matter-Labs Era-Compiler-Solidity

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern `f(a(),b()); check_if_a_executed_last()` in Yul that exposes a bug in evaluation order of Yul function arguments. This vulnerability has been fixed in version 1.3.10. As a workaround, update and redeploy affected contracts.

Affected products

• Matter-Labs Era-Compiler-Solidity: before 1.3.10 (fixed in 1.3.10)

Published 2024-05-27. Last modified 2026-06-17.