Polygon zkEVM fixes bug preventing L1 assets from being bridged to L2, no funds at risk

Scroll blockchain security researcher iczc tweeted that a vulnerability was found in Polygon zkEVM and received the Immunefi L2 bug bounty from the Web3 bug bounty platform. This vulnerability prevents assets bridged from L1 to Polygon zkEVM (L2) from being properly claimed in L2, preventing L1 to L2 asset migration. iczc found in the code logic of processing the pre-execution results of the claim transaction (claim tx) that malicious attackers can bypass the "isReverted" pre-execution check on the claim transaction by setting the gas fee to non-zero, so that it can send a large number of Low-cost claims DoS attacks on sequencers and validators, increasing computational overhead. Also, transactions are not immediately removed from the pool after execution. The status is updated from Pending to Selected and continues to exist in the PostgreSQL database. Currently, there is only one trusted sequencer capable of fetching transactions from the transaction pool and executing them. Therefore, another vulnerability is to maliciously mark any deposit amount by sending a failed transaction. This will cause claim transactions that correctly use credits to be rejected because the credits are already used. This makes the L2 network unusable for new users. The Polygon zkEVM team fixed this vulnerability by removing the specific gas logic for claiming transactions, with no funds at risk.