matter-labs / zksync

zkSync: trustless scaling and privacy engine for Ethereum
https://zksync.io
Apache License 2.0
4.86k stars 2.69k forks source link

Security Risk in Fund Transfer #568

Open rasouleskandari opened 4 months ago

rasouleskandari commented 4 months ago

The contract transfers Ether to BOOTLOADER_FORMAL_ADDRESS without any checks or validations. This could potentially be a security risk if the destination address is not properly controlled or validated. the route is: core/tests/ts-integration/contracts/paymaster-nonce/Paymaster.sol