# Loss of funds for the sender when L1->L2 TX fails in the bootloader on L2

zkSync bootloader burns all remaining L2 execution gas when an L1->L2 transaction reverts, denying the sender the unused-gas refund they'd get on a normal EVM revert.

- Payout: Contest reward
- Severity: medium
- Program: zkSync
- Credited: Koolex
- Disclosed: 2024-02-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-10-zksync-findings/issues/979
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** bootloader.yul L1->L2 transaction execution path
**Root cause:** On tx failure the bootloader calls nearCallPanic(), which exhausts all gas of the near-call frame via precompileCall(gas()) to trigger an out-of-gas panic instead of a revert; this burns the entire execution gas limit rather than only gas actually consumed.
**Steps:**
1. Call Mailbox.requestL2Transaction with a large _l2GasLimit and calldata that reverts on L2.
2. Bootloader computes gasLimitForTx and calls getExecuteL1TxAndGetRefund with gasLimitForTx - gasUsedOnPreparation.
3. ZKSYNC_NEAR_CALL_executeL1Tx executes the tx; on revert success=0.
4. nearCallPanic() runs precompileCall(gas()) exhausting the frame, so potentialRefund stays 0.
5. Sender loses the full gasLimit cost instead of only the gas actually used before revert.
**How found:** Code-reading of bootloader.yul: noticed getExecuteL1TxAndGetRefund returns potentialRefund only when gasSpentOnExecution <= gasForExecution, and that nearCallPanic() deliberately exhausts all frame gas on failure, so refund is always zero on revert. Built a Solidity mock simulating near_call to demonstrate success vs failure refund behavior.
**Exploitation:** Not an attacker-driven exploit; a sender (or protocol) submitting an L1->L2 tx that reverts on L2 loses the entire prepaid gas limit rather than receiving a refund for unused execution gas. Impact scales with the trusted gas limit the operator grants for computationally intensive txs.
**Insight:** When auditing VM/bootloader fee logic, compare refund computation on success vs failure paths; a panic mechanism that burns gas to avoid reverting the parent frame silently converts a revert into a full gas-limit charge, breaking EVM REVERT semantics and user refund expectations.