CVE-2024-34704 MEDIUM

CVE-2024-34704: era-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimization

Vendor Matter-Labs
Product era-compiler-solidity
Weakness CWE-682
Published May 13, 2024
Last update August 2, 2024

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the `DAGCombine` phase while visiting the XOR operation. The issue arises when attempting to fold the expression `!(x cc y)` into `(x !cc y)`. To perform this transformation, the second operand of XOR should be a constant representing the true value. However, it was incorrectly assumed that -1 represents the true value, when in fact, 1 is the correct representation, so this transformation for this case should be skipped. This vulnerability is fixed in 1.4.1.

Key dates

02Disclosure timeline

May 13, 2024 CVE published
August 2, 2024 Record updated