# Lack of access to ETH on L2 through L1->L2 transactions

zkSync DefaultAccount leaves executeTransactionFromOutside empty, so L1->L2 txs cannot spend L2 ETH, trapping funds if a malicious operator censors L2 txs.

- Payout: Contest reward
- Severity: medium
- Program: zkSync
- Credited: Audittens
- Disclosed: 2024-02-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-zksync-findings/issues/803
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-09
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Mailbox L1->L2 transaction handling and DefaultAccount system contract
**Root cause:** Mailbox::_requestL2Transaction only allows msg.value from L1 ETH to be minted on L2, and DefaultAccount::executeTransactionFromOutside is unimplemented, so L1->L2 txs cannot draw on an EOA's existing L2 ETH balance.
**Steps:**
1. Observe Mailbox.sol L305-L306/L318/L323: L1->L2 msg.value is restricted to ETH minted during L2 processing.
2. Observe bootloader.yul L2321/L2328-L2333 enforcing the same invariant.
3. Observe DefaultAccount.sol L124-L125: executeTransactionFromOutside is empty, assuming L1->L2 txs cover it.
4. Assume a malicious operator processes only L1->L2 txs and ignores L2 txs.
5. Attempt to withdraw an EOA's L2 ETH via an L1->L2 transaction: msg.value cannot use the L2 balance, so funds remain trapped.
**How found:** Code review of Mailbox L1->L2 value handling, bootloader invariant enforcement, and DefaultAccount's empty executeTransactionFromOutside, noticing the comment's assumption conflicts with the value restriction.
**Exploitation:** A malicious operator censors all L2 transactions and only includes L1->L2 transactions; users cannot move their existing L2 ETH because L1->L2 msg.value is limited to newly minted L1 ETH and executeTransactionFromOutside is empty, so funds cannot be withdrawn before a malicious upgrade.
**Insight:** On rollups, check whether the escape-hatch path (L1->L2 forced transactions) can actually move a user's existing L2 balance, not just mint new value; an empty executeTransactionFromOutside is a red flag for censorship-resistance invariants.