Polygon announced the results of the Polygon zkEVM audit: 16 problems were found, all of which have been fixed

Polygon announced the results of the audit of Polygon zkEVM by the security team Hexens, and found 9 vulnerabilities in the documentation of Polygon zkEVM, ranging in severity from critical to low, and 7 additional recommendations related to information gaps. Currently all 16 issues are fixed. A total of four critical vulnerabilities were found in Hexens’ audit, one relying on the exploitation of mechanisms that make Polygon zkEVM censorship-resistant, and the other exploiting the scaling properties of ERC-777 tokens to launch reentrancy attacks on bridged smart contracts. Two other critical vulnerabilities rely on the manipulation of missing binary constraints: one in the memory state machine and one in ROM. In addition to Hexens, another security team, Spearbit, also conducted a parallel audit of the Polygon zkEVM smart contract. The Polygon Hermez team is also conducting its own internal audit. Last week, Spearbit began another audit focusing on ZK circuits and cryptography.