ChainLight saved zkSync Era from $1.9B exploit

Exploiting the bug would have required the highest levels of security privileges across zkSync Era’s infrastructure

article-image

Alexander56891/Shutterstock modified by Blockworks

share

Blockchain security audit firm ChainLight identified a vulnerability in the zkSync Era protocol that, if exploited, could have led to a potential loss of $1.9 billion.

The bug was found in zkSync Era’s zk-circuits. These circuits are designed to validate the correctness of transaction data without exposing sensitive details about the counterparties involved.

A blog post from ChainLight detailed that the bug could have allowed a malicious actor to manipulate transactions within a block and still have them verified as accurate. This would have led to layer-1 smart contracts accepting these proofs, unaware of the manipulated transaction values they contained.

Had the attack been successful, the malicious prover could have drained 100,000 ether (ETH), worth an estimated $1.9 billion at the time of disclosure.

Despite this, zkSync Era had many security layers in place. These would have made it difficult for anyone to actually execute the exploit unless they were part of Matter Labs, the infrastructure team behind zkSync Era.

Read more: Security firms track FTX exploiter through Bitcoin mixer

Anton Astafiev, head of security at Matter Labs, told Blockworks that exploiting this bug would have required the highest level of security privilege across its infrastructure.  

An attacker would have needed to either access the protocol’s backend in order to directly inject the malicious code, or gain access to its validator private key used for signing blocks. They would also have had to endure a mandatory 21-hour waiting period before extracting any funds due to an execution delay.

“What’s more, the bug found is related to our old prover and not the current Boojum, meaning the code will soon enough be completely obsolete and retired,” Astafiev said.

After being made aware of the critical bug, ChainLight noted in an X post that the Matter Labs team had quickly reacted to the report, and fixed the issue. 

The ChainLight team was awarded 50,000 in USDC for discovering the bug.

“This bug in particular was not formally part of the existing bug bounty programs or public contest. When we receive out-of-scope findings, we always assess them based on real-world impact to determine their importance and the corresponding reward,” Astafiev said.

Astafiev noted that the Matter Labs team is looking forward to continued collaboration with ChainLight and other security-focused organizations. 

“These types of findings are healthy reminders of why multi-layer defense architectures like the ones Matter Labs implemented for zkSync are so critically important; no single layer of protection is ever perfectly secure, which is why there can be no single point of failure,” he said.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Unlocked by Template (7).png

Research

Union’s improvements upon Tendermint consensus through CometBLS, coupled with ZK proving through Galois, allow for a broadly scalable, cost efficient, and low latency IBC implementation that is feasibly scalable across every existing blockchain, virtual machine and runtime. The implementation offers modular crosschain interoperability without the need for trusted intermediaries.  

article-image

Kraken’s chief security officer Nick Percoco said the exchange turned the tables on a North Korean hacker

article-image

Or is it approximately the least cypherpunk thing we could do?

article-image

Over 20% of SOL-USD swap volume goes through SolFi

article-image

CEO Vlad Tenev calls expected clarity on listing crypto asset securities “a big opportunity”

article-image

Big Tech pulled US indexes back into the green Thursday, as investors waited for two more Mag 7 first-quarter reports after the bell

article-image

Charts and takeaways from Tuesday’s jobs report and Wednesday’s GDP print, as the economy digests the tariff war