CVE-2024-35229 (Other, published 2024-05-27T17:15Z)
Description: value: ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a very specific pattern `f(a(),b()); check_if_a_executed_last()` in Yul that exposes a bug in evaluation order of Yul function arguments. This vulnerability has been fixed in version 1.3.10. As a workaround, update and redeploy affected contracts.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/matter-labs/era-compiler-solidity
Files changed:
.cargo/config.toml
CHANGELOG.md
Cargo.lock
Cargo.toml
README.md
src/yul/parser/statement/expression/function_call/mod.rs
Commit message: Release v1.3.10


Vulnerable code:
LLVM_SYS_150_PREFIX = { value = "./target-llvm/target-final/", relative = true, force = true }
version = "1.3.9"
version = "1.3.9"
   MUSL-based static builds do not depend on system libraries and run on any recent Linux distribution.
   Only Windows 10 has been tested so far, but other versions should be OK as well.
1. Download a version of the [solc](https://docs.soliditylang.org/en/develop/installing-solidity.html) compiler.  If it is not named exactly `solc` in your `$PATH`, see the `--solc` option below
                for argument in self.arguments.into_iter() {
                for argument in self.arguments.into_iter() {
                let arguments = self.pop_arguments_llvm_log::<D, 2>(context)?;
                let arguments = self.pop_arguments_llvm_log::<D, 3>(context)?;
                let arguments = self.pop_arguments_llvm_log::<D, 4>(context)?;
                let arguments = self.pop_arguments_llvm_log::<D, 5>(context)?;
                let arguments = self.pop_arguments_llvm_log::<D, 6>(context)?;
        for expression in self.arguments.drain(0..N) {
        for expression in self.arguments.drain(0..N) {

        Ok(arguments.try_into().expect("Always successful"))
    }

    ///
    /// Pops the specified number of arguments, converted into their LLVM values.
    ///
    /// This function inverts the order of event topics, taking into account its behavior in EVM.
    ///
    fn pop_arguments_llvm_log<'ctx, D, const N: usize>(
        &mut self,
        context: &mut compiler_llvm_context::Context<'ctx, D>,
    ) -> anyhow::Result<[inkwell::values::BasicValueEnum<'ctx>; N]>
    where
        D: compiler_llvm_context::Dependency,
    {
        self.arguments[2..].reverse();
        let mut arguments = Vec::with_capacity(N);
        for expression in self.arguments.drain(0..N) {
            arguments.push(expression.into_llvm(context)?.expect("Always exists").value);
        }
        arguments[2..].reverse();

Fixed code:
LLVM_SYS_150_PREFIX = { value = "./target-llvm/target-final/", relative = true, force = false }
## [1.3.10] - 2023-04-23

### Fixed

- The evaluation order of Yul function arguments

version = "1.3.10"
version = "1.3.10"
   MUSL-based static builds do not depend on system libraries and can be run on any recent Linux distribution.
   Only Windows 10 has been tested so far, but other versions should be OK. 
1. Download a version of the [solc](https://docs.soliditylang.org/en/develop/installing-solidity.html) compiler.  If it is not named exactly `solc` and in your `$PATH`, see the `--solc` option below
#### `--metadata-hash`
Set the metadata hash mode.  
The only supported value is `none` that disables appending the metadata hash.  
Is enabled by default.

                for argument in self.arguments.into_iter().rev() {
                values.reverse();
                for argument in self.arguments.into_iter().rev() {
                values.reverse();
                let arguments = self.pop_arguments_llvm::<D, 2>(context)?;
                let arguments = self.pop_arguments_llvm::<D, 3>(context)?;
                let arguments = self.pop_arguments_llvm::<D, 4>(context)?;
                let arguments = self.pop_arguments_llvm::<D, 5>(context)?;
                let arguments = self.pop_arguments_llvm::<D, 6>(context)?;
        for expression in self.arguments.drain(0..N).rev() {
        arguments.reverse();
        for expression in self.arguments.drain(0..N).rev() {
        arguments.reverse();