# User transactions can call system contracts directly

DefaultAccount's EfficientCall.rawCall forwards the isSystem flag through MsgValueSimulator when ETH is sent, letting users invoke system contracts directly.

- Payout: Contest reward
- Severity: medium
- Program: zkSync
- Credited: Jeiwan
- Disclosed: 2023-06-14
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-03-zksync-findings/issues/146
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-zksync%3AM-02
- Tags: domain:web3 impact:privesc kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:auth-bypass

**Target:** zkSync Era DefaultAccount / EfficientCall library
**Root cause:** EfficientCall.rawCall sets the forward mask to 1 when routing value-bearing calls through MsgValueSimulator, so MsgValueSimulator propagates isSystemCall=true to the destination, unlike the bootloader which only forwards the flag for ContractDeployer.
**Steps:**
1. User transaction targets any non-ContractDeployer contract with msg.value > 0
2. DefaultAccount._execute calls EfficientCall.rawCall
3. rawCall routes to MsgValueSimulator with forward mask = MSG_VALUE_SIMULATOR_IS_SYSTEM_BIT (1)
4. MsgValueSimulator extracts mask, sets isSystemCall=true, forwards it to the destination call
5. Destination call executes as a system call, permitting direct invocation of system contracts
**How found:** Code review of DefaultAccount._execute and EfficientCall.rawCall; noticed the forward mask set to 1 mirrors SystemContractsCaller.systemCall (intended for system callers) and diverges from bootloader msgValueSimulatorMimicCall which only forwards isSystem for ContractDeployer.
**Exploitation:** A user submits a value-bearing transaction to a contract that then calls a system contract; because the isSystem flag is forwarded, the system contract accepts the call as if from the system, bypassing the intended restriction. No concrete dangerous operation or fund loss demonstrated.
**Insight:** When auditing call-forwarding helpers, compare the forward mask / isSystem propagation against the bootloader's equivalent path; a copied helper from a privileged caller context (SystemContractsCaller) reused in a user-facing path leaks the system flag.