[Security Bulletin] Batched Immunefi-reported Weakness Disclosure — March 2026 (funds not at risk)

[tamtamchik]

@TheDZhon

A smart contract upgrade to the L1 bridge will enforce that only wstETH (the supported l1Token) can be used in claimFailedDeposit(), eliminating the token mismatch entirely. This upgrade is planned for the upcoming omnibus vote, after which deposits will be re-enabled.

As per planned actions:

• The fix has undergone an external audit by Cantina: audits/L2/zkSync-2026-03-05-Cantina-PR-85-fix-report.pdf at main · lidofinance/audits · GitHub
• The updated implementation has been deployed: 0x43a66b32c9adca1a59b273e69b61da5197c21ccd.

Proposed items for the upcoming vote:

• Upgrade the ZKSync L1ERC20Bridge proxy at 0x41527B2d03844dB6b0945f25702cB958b6d55989 to the new fixed implementation: 0x43a66b32c9adca1a59b273e69b61da5197c21ccd.
• Call enableDeposits on the ZKSync L1ERC20Bridge proxy at 0x41527B2d03844dB6b0945f25702cB958b6d55989 to re-enable deposits, which are currently paused.