# Deployment Nonce Does not Increment For a Reverted Child Contract

zkSync Era rolls back the factory deployment nonce when a child constructor reverts, unlike the EVM, desynchronizing CREATE-derived addresses across chains.

- Payout: Contest reward
- Severity: medium
- Program: zkSync
- Credited: anon
- Disclosed: 2024-02-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-10-zksync-findings/issues/91
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-21
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:regression technique:source-review vuln:business-logic

**Target:** ContractDeployer system contract / CREATE opcode
**Root cause:** In zkSync Era the deployment nonce increments inside ContractDeployer.create during deployment, so a revert in the child constructor reverts the whole transaction including the nonce increment; the EVM increments the factory nonce before the snapshot and never rolls it back.
**Steps:**
1. Deploy a Factory that uses assembly `create(0, add(bytecode,0x20), mload(bytecode))` and a `predict()` that hashes factory address + incrementing nonce.
2. Call deploy(false) -> child deploys, predicted == deployed.
3. Call deploy(true) -> child constructor reverts, create returns address(0).
4. Call deploy(false) again and compare predicted vs deployed addresses.
5. On EVM predicted3 == deployed3; on zkSync Era deployed3 == predicted2, showing the nonce did not advance on the reverted deploy.
**How found:** Compared GETH's CREATE implementation (nonce incremented at evm.go L431 before snapshot at L443) against zkSync's ContractDeployer.create/create2 flow, noticing the nonce increment lives inside the reverted deployment path; confirmed with a differential PoC on both chains.
**Escalation:** Cross-chain factories intended to produce identical proxy addresses on Ethereum and zkSync Era (or forks) diverge after any failed child creation, breaking address synchronization for all subsequent deployments.
**Insight:** When auditing EVM-equivalent L2s, diff state-mutation ordering against GETH line-by-line: any counter (nonce, salt, id) incremented inside a revertible frame instead of before the snapshot produces cross-chain address divergence that factories relying on deterministic addresses will hit.