Submitted by xuwinnie
Nonce order of an EOA should always be sequential, otherwise the transaction cannot be validated. The default account does not allow user to call function updateNonceOrdering of ContractDeployer. However, the restriction can be bypassed if user call updateNonceOrdering through an L1 priority transaction. As a result, the users account will be permanently frozen.
incrementMinNonceIfEquals is used in _validateTransaction. It always uses a sequential nonce.
The bootloader calls validateNonceUsage too, which considers the arbitrary ordering.
We need to prevent default account from changing nonce ordering type; otherwise, these two methods will conflict. If users current minNonce is 13, nonce of new tx also needs to be 13, but if some value is already stored under 14, isNonceUsed will return true. Which means the user will no longer be able to initiate new transactions.
Flag isSystemCall is only set true when calling deployment method of ContractDeployer, so if user tries to call function updateNonceOrdering of ContractDeployer, isSystemCall will be false and the call will fail.
However, if the transaction is initiated on L1, selector is not checked. Flag isSystem is set true as long as the target is ContractDeployer. The transaction to updateNonceOrdering will succeed.
Once updated, the change is permanent. The account can no longer initiate any new transactions.
Dont allow EOA to call updateNonceOrdering. Do the check on L1 side.
Context
miladpiri (zkSync) confirmed, but disagreed with severity
Alex the Entreprenerd (judge) commented:
Note: For full discussion, see here.
