# Wrong encoding of the data in the sendCompressedBytecode function

zkSync bootloader's sendCompressedBytecode lacked offset validation and used unsafe arithmetic, letting the operator inject extra calldata or force Compressor.publishCompressedBytecode to revert.

- Payout: Contest reward
- Severity: medium
- Program: zkSync
- Credited: Audittens
- Disclosed: 2024-02-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-zksync-findings/issues/807
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** bootloader.yul sendCompressedBytecode / Compressor.publishCompressedBytecode
**Root cause:** sendCompressedBytecode does not verify originalBytecodeOffset == afterSelectorPtr + 64 and uses raw add instead of safeAdd in offset/length calculations, so unchecked arithmetic lets malformed calldata pass encoding checks.
**Steps:**
1. Craft calldata with `_bytecode` offset V and `_rawCompressedData` offset V+32+rounded_len(_bytecode), inserting (V-64) arbitrary ignored bytes before the length fields.
2. Alternatively set `_bytecode` offset to `2**256 - 64` so originalBytecodeOffset passes checkOffset; overflow in lengthRoundedByWords/validateBytes bypasses checks.
3. Call Compressor.publishCompressedBytecode via bootloader; extra bytes consume gas or the call reverts.
**How found:** Code review of bootloader.yul sendCompressedBytecode encoding checks against Compressor.publishCompressedBytecode ABI decoding; noticed missing offset equality check and unsafe arithmetic in offset/length computations.
**Exploitation:** Operator submits a compressed-bytecode transaction with malformed calldata that passes bootloader encoding checks, spending up to ~1MB of extra calldata gas from the L2 transaction gas limit or forcing the Compressor call to revert.
**Insight:** When a bootloader/VM manually re-encodes ABI calldata for an internal call, diff the hand-built layout against the callee's ABI decoder assumptions and check every offset with safe arithmetic; missing offset==expected checks allow arbitrary ignored padding.