CVE-2024-35229

ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern `f(a(),b()); check_if_a_executed_last()` in Yul that exposes a bug in evaluation order of Yul function arguments. This vulnerability has been fixed in version 1.3.10. As a workaround, update and redeploy affected contracts.

• CWE-696

• https://github.com/matter-labs/era-compiler-solidity/commit/46ce047b51576495779b9f67534207d8154eab79
• https://github.com/matter-labs/era-compiler-solidity/security/advisories/GHSA-jf9w-7f5g-j95p
• https://github.com/matter-labs/era-compiler-solidity/commit/46ce047b51576495779b9f67534207d8154eab79
• https://github.com/matter-labs/era-compiler-solidity/security/advisories/GHSA-jf9w-7f5g-j95p

Published

May 27, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35223Dapr is a portable, event-driven, runtime for building distr…5.3
• CVE-2024-35224OpenProject is the leading open source project management so…5.4
• CVE-2024-35225Jupyter Server Proxy allows users to run arbitrary external …6.1
• CVE-2024-35226Smarty is a template engine for PHP, facilitating the separa…7.3
• CVE-2024-35227Discourse is an open-source discussion platform. Prior to ve…7.5
• CVE-2024-35228Wagtail is an open source content management system built on…5.5
• CVE-2024-3523A vulnerability classified as critical was found in Campcode…8.8
• CVE-2024-35230GeoServer is an open source software server written in Java …5.3
• CVE-2024-35231rack-contrib provides contributed rack middleware and utilit…8.6
• CVE-2024-35232github.com/huandu/facebook is a Go package that fully suppor…3.7
• CVE-2024-35234Discourse is an open-source discussion platform. Prior to ve…6.1
• CVE-2024-35235OpenPrinting CUPS is an open source printing system for Linu…6.7