feat: Update ZkSync_SpokePool to support new L2 ZkStack L2AssetRouter by nicholaspai · Pull Request #1190 · across-protocol/contracts

nicholaspai · 2025-11-25T01:10:26Z

This contract is designed to be used with ZkStack chains that migrate to the new ZkGateway system. For example, this will be required for ZkSync (chain ID 324) and Lens.

I don't know yet whether currently supported ZkStack chains like Lens will use this new architecture or the current one. Therefore, to deploy hot fixes to Lens we would need to checkout an older commit and deploy that version of the ZkSync_SpokePool.

~~The alternative is introducing a new contract, but I'd like to consolidate changes.~~

Lens will be upgraded with ZkSync, according to the ZkSync team.

nicholaspai · 2025-12-01T16:42:14Z

Test deployments with special testBridgeTokensToHubPool() functions to test out transfers:

fusmanii

looks good, just one q

fusmanii · 2025-12-01T21:56:22Z

    // are added, so that the total number of slots taken by this contract remains constant. Per-contract
    // storage layout information  can be found in storage-layouts/
    // This is at bottom of contract to make sure it's always at the end of storage.
    uint256[999] private __gap;


does this need to be updated given that new vars are added?

no because the new vars are constants or immutable so they don't add any storage slots

We need this code to finalize any withdrawals from ZkStack chains sent through the new `L2AssetRouter` contracts. See across-protocol/contracts#1190 for more details on L2 contract changes that will initiate these new withdrawals This PR is backwards compatible and can be merged today [test finalization can be seen here.](https://etherscan.io/tx/0x88f21e9730a6586155de9f8e46a8f82a78fde09193e3de3d48a783cf94c2dc41#eventlog)

grasphoper · 2026-01-15T04:03:12Z

@fusmanii what's our current plan for deploying elastic chain (zksync-like) contracts? Do we need any config changes to foundry or?

we have elastic chain deployment set up already, just need to install foundryup-zksync and it will pick up this config

This contract is designed to be used with ZkStack chains that migrate to the new [ZkGateway](https://forum.zknation.io/t/zip-6-prepare-zksync-for-zk-gateway/490#p-1247-changes-to-bridging-architecture-9) system. For example, this will be required for ZkSync (chain ID 324). The reason that I'm creating a new contract rather than updating the existing ZkSync_SpokePool is that I don't know yet whether currently supported (or future ones we plan to support) will use this new architecture or the current one, which might need to keep using ZkSync_SpokePool

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

socket-security · 2026-01-16T21:49:38Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@types/yargs@17.0.33
	yargs@17.7.2
	prettier@2.8.8

View full report

socket-security · 2026-01-16T21:49:43Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: npm `cipher-base` is missing type checks, leading to hash rewind and passing on crafted data CVE: GHSA-cpq7-6gpm-g9rc cipher-base is missing type checks, leading to hash rewind and passing on crafted data (CRITICAL) Affected versions: < 1.0.5 Patched version: 1.0.5 From: `?` → `npm/cipher-base@1.0.4` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/cipher-base@1.0.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `safer-buffer` is 94.0% likely obfuscated Confidence: 0.94 Location: Package overview From: `?` → `npm/safer-buffer@2.1.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/safer-buffer@2.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

nicholaspai changed the title ~~feat: Create ZkGateway_SpokePool~~ feat: Update ZkSync_SpokePool to support new L2 ZkStack L2AssetRouter Nov 25, 2025

nicholaspai marked this pull request as ready for review December 1, 2025 21:10

nicholaspai requested review from bmzig, mrice32 and pxrl as code owners December 1, 2025 21:10

fusmanii previously approved these changes Dec 1, 2025

View reviewed changes

nicholaspai dismissed fusmanii’s stale review via 9734af5 December 2, 2025 21:26

nicholaspai mentioned this pull request Dec 4, 2025

feat(zkSyncFinalizer): Support post-Gateway migration finalizations across-protocol/relayer#2801

Closed

grasphoper reviewed Dec 4, 2025

View reviewed changes

Comment thread contracts/ZkSync_SpokePool.sol

grasphoper reviewed Dec 4, 2025

View reviewed changes

Comment thread contracts/ZkSync_SpokePool.sol

nicholaspai added the need to audit This PR needs to be audited externally before deploying label Dec 5, 2025

grasphoper reviewed Jan 15, 2026

View reviewed changes

grasphoper changed the base branch from master to audit-jan19 January 15, 2026 17:02

nicholaspai added 15 commits January 15, 2026 13:26

Move changes into ZkSync_SpokePool

1c27d71

Update ZkSync_SpokePool.sol

9dc3685

Update ZkSync_SpokePool.sol

1bfcc6a

Update eraVM_EIP7702.sol

9e8f5ec

Update Lens_SpokePool.sol

2856711

Rename contracts and use hardcoded L2 system addresses

37242bc

wip

d24331c

Update Lens_SpokePool.sol

9c859d9

Fix deployments

223d735

Update ZkSync_SpokePool.json

65dd7a6

Update eraVM_EIP7702.sol

196d124

test

fc5c025

Update ZkSync_SpokePool.sol

ce2c4bf

Update ZkSync_SpokePool.ts

ca87387

nicholaspai and others added 5 commits January 15, 2026 13:26

Update ZkSync_SpokePool.ts

22c155a

Fix

d5cf275

Update ZkSync_SpokePool.ts

dcb37f8

Deploy test contracts

c1af3b4

match zksolc versions

a9af784

Signed-off-by: Faisal Usmani <faisal.of.usmani@gmail.com>

grasphoper force-pushed the zksync-spokepool branch from b4319e6 to a9af784 Compare January 15, 2026 21:26

grasphoper mentioned this pull request Jan 15, 2026

feat: audit Jan 19 #1248

Closed

grasphoper deleted the branch master January 16, 2026 21:15

grasphoper closed this Jan 16, 2026

grasphoper reopened this Jan 16, 2026

grasphoper requested review from Reinis-FRP, chrismaree and md0x as code owners January 16, 2026 21:49

grasphoper changed the base branch from audit-jan19 to master January 16, 2026 21:49

grasphoper changed the base branch from master to audit-jan19 January 16, 2026 21:55

grasphoper changed the base branch from audit-jan19 to master January 16, 2026 21:55

grasphoper mentioned this pull request Jan 16, 2026

feat: Update ZkSync_SpokePool to support new L2 ZkStack L2AssetRouter #1252

Merged

grasphoper closed this Jan 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Update ZkSync_SpokePool to support new L2 ZkStack L2AssetRouter#1190

feat: Update ZkSync_SpokePool to support new L2 ZkStack L2AssetRouter#1190
nicholaspai wants to merge 20 commits intomasterfrom
zksync-spokepool

nicholaspai commented Nov 25, 2025 •

edited

Loading

Uh oh!

nicholaspai commented Dec 1, 2025 •

edited

Loading

Uh oh!

fusmanii left a comment

Uh oh!

fusmanii Dec 1, 2025

Uh oh!

nicholaspai Dec 2, 2025

Uh oh!

Uh oh!

Uh oh!

grasphoper Jan 15, 2026

Uh oh!

fusmanii Jan 15, 2026

Uh oh!

socket-security Bot commented Jan 16, 2026

Uh oh!

socket-security Bot commented Jan 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

nicholaspai commented Nov 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nicholaspai commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fusmanii left a comment

Choose a reason for hiding this comment

Uh oh!

fusmanii Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

nicholaspai Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

grasphoper Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

fusmanii Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

socket-security Bot commented Jan 16, 2026

Uh oh!

socket-security Bot commented Jan 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nicholaspai commented Nov 25, 2025 •

edited

Loading

nicholaspai commented Dec 1, 2025 •

edited

Loading