CVE-2024-34704

era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the `DAGCombine` phase while visiting the XOR operation. The issue arises when attempting to fold the expression `!(x cc y)` into `(x !cc y)`. To perform this transformation, the second operand of XOR should be a constant representing the true value. However, it was incorrectly assumed that -1 represents the true value, when in fact, 1 is the correct representation, so this transformation for this case should be skipped. This vulnerability is fixed in 1.4.1.

• CWE-682

• https://github.com/matter-labs/era-compiler-solidity/security/advisories/GHSA-22pj-7cvw-r3gc
• https://github.com/matter-labs/era-compiler-solidity/security/advisories/GHSA-22pj-7cvw-r3gc

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34698FreeScout is a free, self-hosted help desk and shared mailbo…6.3
• CVE-2024-34699GZ::CTF is a capture the flag platform. Prior to 0.20.1, unp…6.5
• CVE-2024-3470An Improper Privilege Management vulnerability was identifie…7.2
• CVE-2024-34701CreateWiki is Miraheze's MediaWiki extension for requesting …5.9
• CVE-2024-34702Botan is a C++ cryptography library. X.509 certificates can …5.3
• CVE-2024-34703Botan is a C++ cryptography library. X.509 certificates can …7.5
• CVE-2024-34706Valtimo is an open source business process and case manageme…9.8
• CVE-2024-34707Nautobot is a Network Source of Truth and Network Automation…4.8
• CVE-2024-34708Directus is a real-time API and App dashboard for managing S…4.9
• CVE-2024-34709Directus is a real-time API and App dashboard for managing S…5.4
• CVE-2024-3471The Button Generator WordPress plugin before 3.0 does not h…3.4
• CVE-2024-34710Wiki.js is al wiki app built on Node.js. Client side templat…7.1