Submitted by erebus, also found by Audittens, AkshaySrivastav, twcctop, anon, and dontonka
If any of the governance actors, either securityCouncil or owner, gets compromised, the whole governance logic will enter a deadlock (not a centralization risk as the Governance contract is exactly designed to prevent this kind of issues).
The actions that each governance actor can do are the following:
By extension, as the Governance contract can call itself through execute and executeInstant and the only one who can propose upgrades is owner, then he can do the following too:
It becomes clear that:
So the governance logic will be broken.
After a talk with the sponsor, it seems in the future there will be some sort of escape hatch mechanism in which users will be able to withdraw their funds from zkSync Era to Ethereum or another L2 if any of the above happens. For the time being, the solutions we talked about were:
Governance, function updateDelay
The constant MINIMUM_UPGRADE_DELAY is going to be a config one whose value is higher than the Solidity 1 day, as withdrawals from zkSync Era to Ethereum takes around 1 day. Users would have enough time to withdraw their funds if a malicious upgrade is ever scheduled.
miladpiri (zkSync) confirmed and commented:
Alex the Entreprenerd (judge) commented:
