# State transition manager is unable to force upgrade a deployed ST, which invalidates the designed safeguard for 'urgent high risk situation'

StateTransitionManager lacks any path to force-upgrade a deployed chain, so the documented emergency upgrade safeguard cannot be executed.

- Payout: Contest reward
- Severity: medium
- Program: zkSync
- Credited: oakcobalt
- Disclosed: 2024-05-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-zksync-findings/issues/53
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-zksync%3AM-03
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** L1 StateTransitionManager and Admin facet upgrade functions
**Root cause:** executeUpgrade() is onlyStateTransitionManager but is only reachable via _setChainIdUpgrade() during createNewChain(); upgradeChainFromVersion() is callable by STM but no STM method invokes it.
**Steps:**
1. Read docs: STM 'might force upgrade the contract' in urgent high-risk situations.
2. Inspect Admin.sol: `upgradeChainFromVersion()` gated by onlyAdminOrStateTransitionManager; `executeUpgrade()` gated by onlyStateTransitionManager.
3. Trace StateTransitionManager.sol: `executeUpgrade` only called inside `_setChainIdUpgrade()`, which is only called in `createNewChain()`.
4. Confirm no STM function calls either upgrade entrypoint post-genesis, so forced upgrade is impossible.
**How found:** Code-reading against documented design: compared the doc's emergency force-upgrade guarantee to the actual call graph of upgrade entrypoints and found no reachable path from STM after chain creation.
**Insight:** When a protocol documents an emergency/admin override, trace every privileged entrypoint's call graph to confirm the override is actually reachable post-deployment, not just access-controlled.