CVE-2024-45056 `fold (xor (shl 1, x), -1) -> (rotl ~1, x)` misoptimization in zksolc
A compiler misoptimization in zksolc can generate incorrect bytecode for specific bitwise operations, potentially altering contract logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45056?
CVE-2024-45056 is a medium-severity vulnerability in matter-labs era-compiler-solidity, published on 29 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
zksolc is a Solidity compiler for ZKsync. All LLVM versions since 2015 fold `(xor (shl 1, x), -1)` to `(rotl ~1, x)` if run with optimizations enabled. Here `~1` is generated as an unsigned 64 bits number (`2^64-1`). This number is zero-extended to 256 bits on EraVM target while it should have been sign-extended. Thus instead of producing `roti 2^256 - 1, x` the compiler produces `rotl 2^64 - 1, x`. Analysis has shown that no contracts were affected by the date of publishing this advisory. This issue has been addressed in version 1.5.3. Users are advised to upgrade and redeploy all contracts. There are no known workarounds for this vulnerability.
Weakness: CWE-682
Which versions are affected by CVE-2024-45056?
It affects 1 product.
Products include Matter-Labs Zksolc.
How do I fix CVE-2024-45056?
No fix has been published for CVE-2024-45056 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-45056 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45056 exists.
Sources
Also known as GHSA-fpx7-8vc6-frjj.