Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to verify contracts with any suppressed solidity compiler errors (eg. --suppress-errors sendtransfer) #3205

Open
fmunshi opened this issue Oct 30, 2024 · 2 comments
Labels
bug Something isn't working

Comments

@fmunshi
Copy link

fmunshi commented Oct 30, 2024

🐛 Bug Report

Unable to verify contracts that were compiled with supressed errors

📝 Description

I have a successfully deployed contract that was compiled using hardhat zksolc configuration that looks like as follows

  zksolc: {
    version: "1.5.6",
    compilerSource: "binary",
    settings: {
      suppressedErrors: ['txorigin', 'sendtransfer'],
    },
  },

🔄 Reproduction Steps

Deploy a contract with this vulnerability present but supressed https://docs.soliditylang.org/en/latest/security-considerations.html#reentrancy

Attempt to verify the contract against https://explorer.sepolia.era.zksync.dev/contract_verification using hardhat verify

Receive the following error

Backend verification error: Compilation errorError: You are using '<address Y>.send/transfer(<X>)' without providing the gas amount.
Such calls will fail depending on the pubdata costs.

Please use 'Y(<address>).call{value: <X>}("")' instead, but be careful with the
reentrancy attack. `send` and `transfer` send limited amount of gas that prevents reentrancy,
whereas `<address>.call{value: <X>}` sends all gas to the callee.

In Solidity v0.4, where there is no `payable` type, this may be a false positive
if `using X for address` is used with `X` implementing its own `send` or `transfer` functions.

Learn more about reentrancy at https://docs.soliditylang.org/en/latest/security-considerations.html#reentrancy

You may disable this error with:
    1. `suppressedErrors = ["sendtransfer"]` in standard JSON.
    2. `--suppress-errors sendtransfer` in the CLI.
     |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

🤔 Expected Behavior

Since the warning is something that can be suppressed via the solidity compiler it should be able to pass verification here.

😯 Current Behavior

Unable to verify the contract despite being able to build it locally.

🖥️ Environment

    "@matterlabs/hardhat-zksync-verify": "^1.6.0",
     "@matterlabs/hardhat-zksync-deploy": "^1.6.0",
    "@matterlabs/hardhat-zksync-solc": "^1.2.5",
    "@nomicfoundation/hardhat-chai-matchers": "^1.0.6",
    "@nomicfoundation/hardhat-ethers": "^3.0.8",
    "@nomicfoundation/hardhat-network-helpers": "^1.0.12",
    "@nomicfoundation/hardhat-verify": "^2.0.11",
    ...
    "ethers": "~6.13.4",

📋 Additional Context

This was added in hardhat zksync
matter-labs/hardhat-zksync#1375

📎 Log Output

Paste any relevant log output here.
@fmunshi fmunshi added the bug Something isn't working label Oct 30, 2024
@fmunshi
Copy link
Author

fmunshi commented Oct 30, 2024

Closing and opening at https://github.com/matter-labs/block-explorer

@fmunshi fmunshi closed this as not planned Won't fix, can't repro, duplicate, stale Oct 30, 2024
@fmunshi
Copy link
Author

fmunshi commented Oct 30, 2024

Actually - reopening as this does seem to be the right place to open this issue

@fmunshi fmunshi reopened this Oct 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant