It means that if a chain gets freezed by StateTransitionManager or the Admin of a chain, StateTransitionManager won't be able to unfreeze the chain again.
Note that the admin of a chainId is able to call unfreezeDiamond directly from the Admin.sol facet, but this does not mitigate the bug in the unfreezeChain function. Despite the admin's capability to unfreeze the chain, the bug persists as the StateTransitionManager should adhere to the invariants by being able to both freeze and unfreeze a chain.
Tools Used
VSCode
Recommended Mitigation Steps
diff --git a/StateTransitionManager.sol.orig b/StateTransitionManager.sol
index 0c27439..c74df7a 100644
--- a/StateTransitionManager.sol.orig
+++ b/StateTransitionManager.sol
@@ -161,9 +161,9 @@ contract StateTransitionManager is IStateTransitionManager, ReentrancyGuard, Own
IZkSyncStateTransition(stateTransition[_chainId]).freezeDiamond();
}
- /// @dev freezes the specified chain
+ /// @dev unfreezes the specified chain
function unfreezeChain(uint256 _chainId) external onlyOwner {
- IZkSyncStateTransition(stateTransition[_chainId]).freezeDiamond();
+ IZkSyncStateTransition(stateTransition[_chainId]).unfreezeDiamond();
}
/// @dev reverts batches on the specified chain
Lines of code
https://github.com/code-423n4/2024-03-zksync/blob/4f0ba34f34a864c354c7e8c47643ed8f4a250e13/code/contracts/ethereum/contracts/state-transition/StateTransitionManager.sol#L166
Vulnerability details
Impact
This bug hampers the
StateTransitionManager
's ability to manage chain freezing.Proof of Concept
In
StateTransitionManager.sol
there are two functions available to freeze and unfreeze a chain:freezeChain
unfreezeChain
The problem is that both functions are calling
freezeDiamond()
which will freeze the chain.freezeDiamond()
:It means that if a chain gets freezed by
StateTransitionManager
or the Admin of a chain,StateTransitionManager
won't be able to unfreeze the chain again.Note that the admin of a chainId is able to call
unfreezeDiamond
directly from theAdmin.sol
facet, but this does not mitigate the bug in theunfreezeChain
function. Despite the admin's capability to unfreeze the chain, the bug persists as theStateTransitionManager
should adhere to the invariants by being able to both freeze and unfreeze a chain.Tools Used
VSCode
Recommended Mitigation Steps
Assessed type
Error