# Operator can steal all gas provided by ANY user for L1→L2 transactions

Malicious zkSync operator inflates refundGas in bootloader processL1Tx, overflowing the add and stealing all user-provided L1→L2 gas.

- Payout: Contest reward
- Severity: medium
- Program: zkSync
- Credited: erebus
- Disclosed: 2024-02-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-10-zksync-findings/issues/255
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-14
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** bootloader processL1Tx L1→L2 transaction gas refund logic
**Root cause:** refundGas and reservedGas are summed with unchecked assembly add; operator-controlled refundGas can overflow the sum to zero, making payToOperator equal gasPrice*gasLimit.
**Steps:**
1. User submits L1→L2 transaction with gasLimit G and gasPrice P.
2. Malicious operator returns overinflated refundGas such that refundGas + reservedGas overflows to 0.
3. Bootloader executes `refundGas := add(refundGas, reservedGas)` yielding 0.
4. Check `gt(refundGas, gasLimit)` passes since 0 < G.
5. payToOperator = safeMul(P, safeSub(G, 0)) = P*G, operator receives all gas.
**How found:** Code review of bootloader.yul processL1Tx identified unchecked assembly add of refundGas and reservedGas, and reasoned that operator-controlled refundGas could overflow the sum.
**Exploitation:** Operator controls the refundGas value returned during L1→L2 transaction processing; by choosing a value that overflows the unchecked add with reservedGas, refundGas becomes 0, so the operator is paid for the full gasLimit while the user receives no refund.
**Insight:** In assembly-based bootloaders, any operator-supplied numeric field combined with unchecked add/sub can be weaponized to zero out refunds; audit every arithmetic op on externally influenced values for overflow even when Solidity safeMath is used elsewhere.