Submitted by minhtrng, also found by Koolex, BARW, rvierdiiev, and anon
An incorrect check allows an L1->L2 transaction to be sent that does not cover the sum of overhead and intrinsic costs for the operator.
The gasLimit required for a transaction consists of (see docs):
{totalGasLimit} = {overhead + actualGasLimit} = {overhead + (intrinisicCosts + executionCosts)}
The function TransactionValidator.getMinimalPriorityTransactionGasLimit calculates the intrinsic costs that will be incurred for the processing of a transaction on L2. The calculated value is checked in TransactionValidator.validateL1ToL2Transaction like this:
The issue is that _transaction.gasLimit is the total gasLimit including the overhead for the operator. The overhead costs are already checked before that in TransactionValidator.getTransactionBodyGasLimit
The value returned by this function is the actualGasLimit (see formula above) that will be available for the processing of the transaction and which should be used to check if the intrinsic costs are covered.
In the current implementation the totalGasLimit is checked twice if its greater than overhead and intrinsic costs (separately, not the sum). The bootloader does things correctly by subtracting the overhead from the totalGasLimit first and then checking if the rest covers the intrinsic costs (also called preparation costs):
That means users will not be able to execute transactions for cheap. However, since the L1->L2 transaction have to be processed (due to the way the priority queue works), it would be possible to grief the operator by submitting transactions that only cover the following:
{max(overhead, intrinsicCosts)}
Those transactions would not have enough gas to be executed on L2, but the overhead and intrinsic costs would still be incurred.
In TransactionValidator.validateL1ToL2Transaction change the check like this:
l2GasForTxBody is what remains after subtracting the overhead from the totalGasLimit.
miladpiri (zkSync) confirmed and commented via duplicate issue #975:
Alex the Entreprenerd (judge) commented via duplicate issue #975:
