Common mistakes with Scroll zkEVM bridging and OpenZeppelin audit

The OpenZeppelin audit of Across Protocol contracts identifies specific vulnerabilities for ZK-Stack implementations like Scroll. The audit of pull requests #941 and #944 reveals that the ZkStack_CustomGasToken_Adapter contract pulls custom gas tokens from the funder into the HubPool when bridging via CCTP, which leaves those tokens stuck in the HubPool because the system pulls the needed amount before the relayTokens function completes. Within the relayTokens function, the system emits an empty ZkStackMessageRelayed event when bridging USDC through CCTP because the _transferUsdc function bypasss the BRIDGE_HUB. Furthermore, the executeSlowRelayLeaf function in ZkSync_SpokePool causes relayer refunds to revert during USDC withdrawals through the custom ZK Stack bridge because the HubPool lacks enough approval to the zkUSDCBridge. The ZkStack_CustomGasToken_Adapter contract also directs the txBaseCost approval to the USDC_SHARED_BRIDGE instead of the intended sharedBridge contract. The removal of the SHARED_BRIDGE global variable from the ZkStack_Adapter.sol contract aims to avoid issues if the bridge contract address changes after deployment. These errors led to resolutions in pull requests #975, #973, #976, #982, #967, and #981.

Scroll technical architecture and bridging mechanics

Scroll scales Ethereum by bundling transactions off-chain and submitting them in batches to the Ethereum mainnet. The platform utilizes a bytecode-level zkEVM to interpret EVM bytecode, which allows developers to use all existing Ethereum tools without rewriting code or compromising security. The network employs an aggregation circuit that consolidates all proofs into a single proof to reduce on-chain verification costs. This architecture uses an optimized GPU prover with different kernels to speed up core computation. The decentralized prover network dispatches blocks to various provers through a coordinator to avoid single points of failure. The permissionless Roller network contributes to the infrastructure by generating proofs for Scroll Layer 2 blocks. I find the deposit process far more efficient than the withdrawal process. Deposits credit within minutes of a transaction confirming on Ethereum, but withdrawals wait for the batch to receive a validity proof and for Ethereum to finalize that proof.

Comparative performance of Layer 2 networks

Arbitrum One leads the market with $13.8 billion in TVL and $16.68 billion in Total Value Secured. Base provides higher transaction speeds with 89 average TPS and $11.2 billion in TVL. Scroll maintains a lower transaction volume with 14 average TPS and $2.1 billion in TVL. The Dencun upgrade introduced ephemeral blobs to reduce rollup data costs. The fee structure for Ethereum rollups depends on L2 execution, Ethereum data costs, bridge routing, and the specific complexity of the smart contract being used for a specific transaction during a period of high congestion. I would prioritize Arbitrum for DeFi because its liquidity depth reduces slippage. Optimism maintains a significant presence with $5.6 billion in TVL, while Starknet holds $1.5 billion in TVL.

Troubleshooting transaction failures and gas management

Users experience stuck transactions when they set low gas limits. A transaction sits in the mempool until a block producer selects it. A stuck transaction at a specific nonce prevents all subsequent transactions from that account from processing. Users often try to push a transaction through by sending more transactions, which only adds more stuck transactions to the queue. You should use the speed-up option in MetaMask to re-broadcast the same nonce with a higher fee. You should check the official Scroll Bridge URL to avoid phishing websites. Scammers contact users in direct messages claiming they can release funds for a fee. The Ethereum gas market uses EIP-1559, which requires a base fee and a tip for the producer. If the network demand increases after you send a transaction, the price you paid might no longer suffice to secure a block. How will developers manage these modular updates as the ZK-Stack ecosystem expands?