`fold (xor (shl 1, x), -1) -> (rotl ~1, x)` misoptimization in zksolc

Vulnerability

A misoptimization in LLVM's DAGCombiner, present in all LLVM versions since 2015, incorrectly folds (xor (shl 1, x), -1) to (rotl ~1, x) when optimizations are enabled [1]. In the context of zksolc (the Solidity compiler for ZKsync), the constant ~1 is generated as an unsigned 64-bit number (2^64-1) and then zero-extended to 256 bits on the EraVM target, whereas it should have been sign-extended. This results in the compiler producing rotl 2^64 - 1, x instead of the correct rotl 2^256 - 1, x. The bug is reproducible in Solidity with the pattern uint256 bit = 1 << index; data &= ~bit; [2]. All versions of zksolc prior to 1.5.3 are affected.

Exploitation

An attacker would need to deploy a smart contract that contains the vulnerable bitwise pattern and is compiled with an affected version of zksolc with optimizations enabled. The attacker would then rely on the incorrect constant to cause unintended behavior in the contract's logic. However, analysis by the zksolc maintainers has confirmed that no contracts were affected by the date of publishing this advisory [2].

Impact

Successful exploitation could lead to incorrect results in bitwise operations, potentially causing logic errors in contracts that depend on clearing specific bits. The impact is limited to contracts that use the exact vulnerable pattern and are compiled with optimizations. No remote code execution or data disclosure is possible; the vulnerability is a compiler bug that produces wrong bytecode.

Mitigation

The issue has been fixed in zksolc version 1.5.3 [2]. Users are advised to upgrade to this version and redeploy all contracts. There are no known workarounds for this vulnerability; upgrading and redeploying is the only remedy.