CVE-2024-35229

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern `f(a(),b()); check_if_a_executed_last()` in Yul that exposes a bug in evaluation order of Yul function arguments. This vulnerability has been fixed in version 1.3.10. As a workaround, update and redeploy affected contracts.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-696

Affected software

Vendor	Product	Versions
matter-labs	era-compiler-solidity	< 1.3.10
matter-labs	era-compiler-solidity	< 1.3.10

References

Timeline

Published: May 27, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-35238.8A vulnerability classified as critical was found in Campcodes Online Event Management System 1.0. This vulnerability affects unknown code of CVE-2024-352305.3GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the we CVE-2024-352318.6rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5 CVE-2024-352323.7github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. acc CVE-2024-352346.1Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed`CVE-2024-352356.7OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when sta CVE-2024-352364.8Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious scripts inside leads CVE-2024-352377.5MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Disc CVE-2024-352385.3Minder by Stacklok is an open source software supply chain security platform. Minder prior to version 0.0.51 is vulnerable to a denial-of-se CVE-2024-352395.4Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may i CVE-2024-35245.4A vulnerability, which was classified as problematic, has been found in Campcodes Online Event Management System 1.0. This issue affects som CVE-2024-352405.4Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scripting (XSS) issue wh