# Potential Gas Manipulation via Bytecode Compression

zkSync operator can pad the compression dictionary with unused chunks, inflating L1 message length and overcharging users' gas.

- Payout: Contest reward
- Severity: medium
- Program: zkSync
- Credited: anon
- Disclosed: 2024-02-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-zksync-findings/issues/71
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-22
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass vuln:misconfiguration

**Target:** Compressor.publishCompressedBytecode system contract
**Root cause:** publishCompressedBytecode validates that encoded chunks match the original bytecode but never checks that every dictionary chunk is referenced, so unused dictionary entries can be appended.
**Steps:**
1. User submits L2 tx with factoryDeps; bootloader calls sendCompressedBytecode -> Compressor.publishCompressedBytecode.
2. Operator takes valid `_rawCompressedData` e.g. `0x0003ABC0000000100020001` (dictionary ABC, encodedData 0,1,2,1).
3. Operator appends an unused 8-byte chunk X and bumps dictionary length: `0x0004ABCX0000000100020001`.
4. encodedData still references only 0,1,2,1; decoding yields original bytecode, so all existing requires pass.
5. L1Messenger.sendToL1 publishes the longer `_rawCompressedData`; gas charged to user scales with message length.
**How found:** Code reading of the compression/decompression flow: noticed the decoder only checks that encoded indices are in-bounds and match the original bytecode, but never verifies dictionary chunks are actually used, so extra chunks are accepted.
**Exploitation:** A malicious operator (or validator controlling batch compression) pads the dictionary of every user's compressed factoryDeps with unused chunks, increasing the L1 message size and thus the user's gas charge; the excess gas is burned/refunded in a way that conflicts with the refund system, maximizing operator profit.
**Insight:** When auditing compression schemes, check both directions: not only that encoded references are valid, but that every dictionary entry is consumed; unused entries are free padding an untrusted party can use to inflate cost.