Azoundria at 18:16, 23 May 2025

2025-05-23T18:16:04Z

← Older revision		Revision as of 12:16, 23 May 2025
Line 2:		Line 2:
	{{Unattributed Sources}}		{{Unattributed Sources}}

	[[File:Zksync.jpg\|thumb\|~~ZKSync~~]]ZKsync is a scalable, cryptographically secure blockchain network composed of high-performance ZK chains—modular rollups and validiums—that enable seamless, trustless interoperability across an expanding ecosystem. A misconfigured admin key on legacy airdrop contracts from June 2024 allowed an attacker to mint $5 million in unclaimed tokens due to poor post-deployment controls. Though the attacker returned 90% of the funds under a safe harbor deal, the incident exposed gaps in contract governance and auditing. In response, ZKsync is implementing key security reforms and reaffirming its commitment to trust-minimized, decentralized infrastructure.<ref name="zksyncignitetwitter-18451" /><ref name="zksynchomepage-15546" /><ref name="zksyncfinalreport-19698" /><ref name="unauthorizedminting-19699" /><ref name="zksynctweet1-19700" /><ref name="requesthacker-19701" /><ref name="zksynctweet2-19702" /><ref name="etherrefunded-19703" /><ref name="zksyncwallet-19704" />		[[File:Zksync.jpg\|thumb\|ZkSync Logo/Homepage]]ZKsync is a scalable, cryptographically secure blockchain network composed of high-performance ZK chains—modular rollups and validiums—that enable seamless, trustless interoperability across an expanding ecosystem. A misconfigured admin key on legacy airdrop contracts from June 2024 allowed an attacker to mint $5 million in unclaimed tokens due to poor post-deployment controls. Though the attacker returned 90% of the funds under a safe harbor deal, the incident exposed gaps in contract governance and auditing. In response, ZKsync is implementing key security reforms and reaffirming its commitment to trust-minimized, decentralized infrastructure.<ref name="zksyncignitetwitter-18451" /><ref name="zksynchomepage-15546" /><ref name="zksyncfinalreport-19698" /><ref name="unauthorizedminting-19699" /><ref name="zksynctweet1-19700" /><ref name="requesthacker-19701" /><ref name="zksynctweet2-19702" /><ref name="etherrefunded-19703" /><ref name="zksyncwallet-19704" />

	== About ZKSync ==		== About ZKSync ==

Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/zksyncunauthorizedairdropmintingprivatekeyleakage.php}} {{Unattributed Sources}} ZKSyncZKsync is a scalable, cryptographically secure blockchain network composed of high-performance ZK chains—modular rollups and validiums—that enable seamless, trustless interoperability across an expanding ecosystem. A misconfigured admin key on legacy airdrop contracts fro..."

2025-05-23T18:15:18Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/zksyncunauthorizedairdropmintingprivatekeyleakage.php}} {{Unattributed Sources}} thumb|ZKSyncZKsync is a scalable, cryptographically secure blockchain network composed of high-performance ZK chains—modular rollups and validiums—that enable seamless, trustless interoperability across an expanding ecosystem. A misconfigured admin key on legacy airdrop contracts fro..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/zksyncunauthorizedairdropmintingprivatekeyleakage.php}}
{{Unattributed Sources}}

[[File:Zksync.jpg|thumb|ZKSync]]ZKsync is a scalable, cryptographically secure blockchain network composed of high-performance ZK chains—modular rollups and validiums—that enable seamless, trustless interoperability across an expanding ecosystem. A misconfigured admin key on legacy airdrop contracts from June 2024 allowed an attacker to mint $5 million in unclaimed tokens due to poor post-deployment controls. Though the attacker returned 90% of the funds under a safe harbor deal, the incident exposed gaps in contract governance and auditing. In response, ZKsync is implementing key security reforms and reaffirming its commitment to trust-minimized, decentralized infrastructure.<ref name="zksyncignitetwitter-18451" /><ref name="zksynchomepage-15546" /><ref name="zksyncfinalreport-19698" /><ref name="unauthorizedminting-19699" /><ref name="zksynctweet1-19700" /><ref name="requesthacker-19701" /><ref name="zksynctweet2-19702" /><ref name="etherrefunded-19703" /><ref name="zksyncwallet-19704" />

== About ZKSync ==
"ZKsync is an ever expanding verifiable blockchain network, secured by math."

"ZK chains are high performance, verifiable, modular rollups and validiums powered by ZKsync. United in an elastic network, ZK chains can be added or expanded to handle increased transaction volume without affecting costs or hardware requirements for verification."

"ZK chains provide native, frictionless interoperability presented in a consistent and easy-to-use interface. This enables trustless communication and asset transfers between chains leveraging the full range of users and liquidity across the entire ZK chain ecosystem. Unlike traditional, centralized solutions, this protocol relies solely on cryptography for security."

"ZKsync offers secure one-tap onboarding via FaceID/Passkeys, eliminating the need for seed phrases and reducing the risk of hacks. By automatically creating modular smart accounts at the protocol level, ZKsync enables a delightful, customizable UX, allowing users to seamlessly access all ZK chains with what feels like a single account directly from their application."

== The Reality ==
The smart contracts related to airdrop distribution, intended for governance use post-airdrop, were not classified as high risk and therefore were excluded from comprehensive security audits. The multisig admin had never been transitioned to the ZKsync Token Governor as intended. Notably, the admin multisig was created by a former ZKsync contributor no longer affiliated with the project.

There was a failure to reconfigure the admin permissions post-deployment. While the sweepUnclaimed() function was originally included to support potential future governance decisions, it became an attack vector due to the insecure admin setup. As of now, the exact method by which the attacker obtained access to the multisig signer’s private key remains unknown.

== What Happened ==
A compromised admin key on outdated ZK token distributor contracts allowed an attacker to mint over 111 million unclaimed tokens without governance approval.
{| class="wikitable"
|+Key Event Timeline - ZKSync Unauthorized Airdrop Minting Private Key Leakage
!Date
!Event
!Description
|-
|June 17th, 2024
|ZKSync Airdrop Conducted
|ZKSync conducts an airdrop of tokens. This left three specific ZK token Merkle distributor contracts from the airdrop with remaining unclaimed tokens, which could be minted in the future. The minting function did not have any multi-signature protection, and only a single private key protected them.
|-
|April 13th, 2025 6:18:03 AM MDT
|Unauthorized Airdrop Minting
|The breach occurred on April 13, 2025, when the attacker exploited a misconfigured 1/1 multisig admin key associated with the distributor contracts and triggered the sweepUnclaimed() function.
|-
|April 15th, 2025 6:05:00 AM MDT
|Matter Labs Add Filter
|The attack was detected and transaction filtering were applied by Matter Labs on April 15th after community alerts, prompting immediate investigation and mitigation efforts, including blocking the hacker’s account via transaction filtering.
|-
|April 21st, 2025 9:03:59 AM MDT
|Security Council Safe Harbour Deal
|The ZKsync Security Council offers the exploiter a safe harbor deal, granting the hacker a 10% bounty in exchange for the return of 90% of the stolen funds. The hacker is granted 72 hours to "resolve this matter amicably in the spirit of safe harbor". Specific details were provided of what funds to send where for the 90%. The message is also shared on Twitter/X 17 minutes later.
|-
|April 23rd, 2025 8:53:35 AM MDT
|Hacker Returns Funds
|The hacker complied on April 23rd, returning both ZK tokens and ETH, and thereby avoiding legal action.
|-
|April 24th, 2025 7:42:00 AM MDT
|Transaction Filtering Lifted
|Matter Labs lifts the temporary transaction filtering which had been originally applied.
|-
|April 25th, 2025 7:55:41 AM MDT
|Final Incident Report Published
|ZKSync publishes the final incident report for the compromised admin key that allowed a hacker to mint and steal over 111 million unclaimed ZK tokens (worth approximately $5 million) from three Merkle distributor contracts linked to its June 2024 airdrop.
|}

== Technical Details ==
The abnormal activity in the ZKsync network was traced back to three Merkle distributor contracts used during the June 2024 ZK token airdrop. These contracts—each responsible for distributing a portion of the airdrop—were administered by a single-signature (1/1) multisig wallet. This setup deviated from the standard 3/5 multisig configuration typically used across ZKsync’s smart contracts and was never updated to transfer control to the Token Governor, as originally intended.

Matter Labs discovered that the admin key controlling these contracts had been compromised. This admin had access to a single function, sweepUnclaimed(), which became executable only after the airdrop claim period ended on January 3, 2025. On April 13, 2025, the attacker exploited this function to mint 111,881,122 unclaimed ZK tokens, bypassing governance approval. The transaction was unauthorized and directly violated the intended role of the Token Assembly, which was supposed to determine the fate of unclaimed tokens.

== Total Amount Lost ==
The attacker minted 111 million unclaimed ZK tokens (worth approximately $5 million).

The total amount lost has been estimated at $5,000,000 USD.

== Immediate Reactions ==
In response, the ZKsync Security Council offered a safe harbor deal, granting the hacker a 10% bounty in exchange for the return of 90% of the stolen funds.

== Ultimate Outcome ==
The hacker complied on April 23rd, returning both ZK tokens and ETH, and thereby avoiding legal action. With the funds now in Security Council custody, governance will determine their future use. ZKsync has since taken several preventative steps, including improved key rotation policies, real-time contract monitoring, and governance process upgrades to prevent similar incidents.

== Total Amount Recovered ==
Following a safe harbor offer from the ZKsync Security Council, the attacker returned 90% of the stolen funds—both ZK tokens and ETH—before the deadline, avoiding legal action. The recovered assets are now in the custody of the Security Council, and a governance process will determine how they are ultimately handled.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
No malicious intent has been established. The exact method of the key compromise remains unknown.

No further ZK tokens can be minted from any of the distributor contracts, as each has already reached its maximum capped supply. As a result, this admin key can no longer be used to exploit these contracts.

No other ZKsync protocol components are believe to have been affected. ZKSync is reportedly implementing robust changes to ensure enhanced security and transparency going forward.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="zksyncignitetwitter-18451">[https://twitter.com/ZKsyncIgnite ZKSync Ignite Twitter Account] (Accessed Mar 10, 2025)</ref>

<ref name="zksynchomepage-15546">[https://zksync.io/ ZKsync] (Accessed Sep 18, 2024)</ref>

<ref name="zksyncfinalreport-19698">[https://zksync.mirror.xyz/W5vPDZqEqf2NuwQ5x7SyFnIxqqpE1szAFD69iaaBFnI Incident Report: Compromised admin key to unclaimed airdrop tokens - ZkSync Mirror.xyz] (Accessed May 23, 2025)</ref>

<ref name="unauthorizedminting-19699">[https://explorer.zksync.io/tx/0x14b120ff26e8d678fdaa26eef81cf166cb8bc1a20e9bdef6a02fd2af2ee0071e Transaction Minting ZKSync Tokens - ZKSync Explorer] (Accessed May 23, 2025)</ref>

<ref name="zksynctweet1-19700">[https://twitter.com/TheZKNation/status/1914338338804244511 ZKSync - "To resolve this matter amicably in the spirit of safe harbor, we are offering a 10% bounty for your cooperation if you return 90% of the funds involved in the exploit." - Twitter/X] (Accessed May 23, 2025)</ref>

<ref name="requesthacker-19701">[https://etherscan.io/tx/0xca7b921ae9174616fc443e36f4aec8610ee3c7da0f8dc49b3cd97f9d38a05b1b ZKSync Request To Exploiter - Etherscan] (Accessed May 23, 2025)</ref>

<ref name="zksynctweet2-19702">[https://twitter.com/TheZKNation/status/1915110305790660939 ZKSync - "We’re pleased to share that the hacker has cooperated and returned the funds within the safe harbor deadline. As stated in the original Security Council message, the case is now considered resolved." - Twitter/X] (Accessed May 23, 2025)</ref>

<ref name="etherrefunded-19703">[https://etherscan.io/tx/0xa344a0e759652246e51b1def91c8081b3527bdbbcab92128100f8fbc11c204df Transaction Returning 776 ETH To ZKSync Security Council - Etherscan] (Accessed May 23, 2025)</ref>

<ref name="zksyncwallet-19704">[https://explorer.zksync.io/address/0xfFB6126FF8401665081b771bB11cCD0e09f95D5A#transfers ZKSync Security Council Wallet - ZkSync Explorer] (Accessed May 23, 2025)</ref></references>

ZKSync Unauthorized Airdrop Minting Private Key Leakage - Revision history

Azoundria at 18:16, 23 May 2025