Read the docs
TI-2024-23002 Aliases CVE-2024-34704

era-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimization

Priority MEDIUM 60CWE-682Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

era-compiler-solidity is the ZKsync compiler for Solidity. The problem occurred during instruction selection in the `DAGCombine` phase while visiting the XOR operation. The issue arises when attempting to fold the expression `!(x cc y)` into `(x !cc y)`. To perform this transformation, the second operand of XOR should be a constant representing the true value. However, it was incorrectly assumed that -1 represents the true value, when in fact, 1 is the correct representation, so this transformation for this case should be skipped. This vulnerability is fixed in 1.4.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00466 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
matter-labsera-compiler-solidity1.2.0 – 1.4.0—No fix listedCNA
  • era-compiler-solidity Vendormatter-labs Affected 1.2.0 – 1.4.0 Fixed in — No fix listed CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:matter-labs:era-compiler-solidity:1.2.0:*:*:*:*:*:*:*1.2.0—matter-labs
  • cpe:2.3:a:matter-labs:era-compiler-solidity:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 — ·matter-labs

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-34704

References

Other 1

  • TI-2024-29017 zkvyper ignored loop range bounds CVSS 3.1CRITICAL 9.1
  • TI-2024-30167 `fold (xor (shl 1, x), -1) -> (rotl ~1, x)` misoptimization in zksolc CVSS 3.1MEDIUM 5.9
  • TI-2024-25768 ZKsync Era invalid stack addressing conversion CVSS 3.1MEDIUM 6.5
  • TI-2023-24859 era-compiler-vyper First Immutable Variable Initialization vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2024-23299 ZKsync Era evaluation order of Yul function arguments CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences