CVE-2024-34704 era-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimization
A misoptimization in the ZKsync Solidity compiler incorrectly transforms boolean logic, potentially leading to incorrect smart contract behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-34704?
CVE-2024-34704 is a medium-severity vulnerability in matter-labs era-compiler-solidity, published on 13 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the `DAGCombine` phase while visiting the XOR operation. The issue arises when attempting to fold the expression `!(x cc y)` into `(x !cc y)`. To perform this transformation, the second operand of XOR should be a constant representing the true value. However, it was incorrectly assumed that -1 represents the true value, when in fact, 1 is the correct representation, so this transformation for this case should be skipped. This vulnerability is fixed in 1.4.1.
Weakness: CWE-682
Which versions are affected by CVE-2024-34704?
How do I fix CVE-2024-34704?
No fix has been published for CVE-2024-34704 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-34704 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34704 exists.
Sources
Also known as GHSA-22pj-7cvw-r3gc.