# Burning of the user gas in the sendCompressedBytecode function

zkSync bootloader uses nearCallPanic on Compressor.publishCompressedBytecode failure, letting the operator force OOG and burn all gas of an L2 transaction publishing bytecode.

- Payout: Contest reward
- Severity: medium
- Program: zkSync
- Credited: Audittens
- Disclosed: 2024-02-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-zksync-findings/issues/805
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-08
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm technique:source-review vuln:dos

**Target:** bootloader.yul sendCompressedBytecode / Compressor.publishCompressedBytecode
**Root cause:** On unsuccessful Compressor::publishCompressedBytecode call the bootloader invokes nearCallPanic instead of revertWithReason, so a revert (e.g. invalid operator-supplied compressed data failing Compressor's decode/length checks) panics the near call and consumes all remaining gas.
**Steps:**
1. L2 tx includes at least one bytecode to publish, triggering ZKSYNC_NEAR_CALL_markFactoryDepsL2 -> sendCompressedBytecode.
2. Operator supplies invalid _rawCompressedData/dictionary/encodedData so Compressor.publishCompressedBytecode reverts on its internal length/decoding checks.
3. bootloader hits nearCallPanic at bootloader.yul L1573-L1579, panicking the near call and burning all gas of the L2 transaction.
**How found:** Code review of bootloader.yul sendCompressedBytecode error handling, noting nearCallPanic used for Compressor call failure and enumerating Compressor revert conditions controllable by the operator.
**Exploitation:** Malicious/compromised operator crafts the compressed bytecode payload so the Compressor call reverts, causing nearCallPanic to consume the user's entire gas allotment; user transaction fails with all gas burned.
**Insight:** In sequencer/operator-trusted rollup designs, audit every nearCallPanic vs revertWithReason branch: any operator-controllable revert path that panics converts into full gas burn and forced tx failure, breaking trust assumptions.