ZKsync Announces EraVM Security Enhancements Before Six-Month Retirement

ZKsync developer Matter Labs has outlined a security-hardening program for chains running its EraVM execution environment, which will be retired within six months, according to a September 4 announcement on the project blog. The company said funds held in ordinary externally owned accounts require no action, while assets in smart contracts will need steps and dates that will be published in the coming weeks.

The post lists five changes. ZKsync recommends that public EraVM chains raise their execution delay from three hours to 24 hours, giving teams more time to detect and respond to an exploit before finalization, with an onchain proposal expected in the coming days. It is also working with every active EraVM chain to run an independent second node that confirms each executed batch, so an attacker would need to compromise two separately hosted infrastructures at once.

Matter Labs will publish covered Era protocol code three months after an upgrade ships, instead of immediately, to avoid handing attackers an advantage on frozen code, while independent auditors keep continuous access. On 24 August the Token Assembly approved GAP-5, which renames Emergency Upgrades to Instant Upgrades and requires a notice on the ZK Nation forums after each one. The company is also developing EraBender, an Airbender-based prover that would run alongside Boojum, so a flaw would have to exist in two independently built proving systems.

The company said artificial intelligence has changed the threat landscape, and that the public, permissionless nature of blockchains makes them attractive targets for autonomous exploit discovery. ZKsync introduced EraVM in 2023 as the first production zkEVM, but its successor, the Atlas upgrade, runs EVM natively and is where new protocol development will take place.

EraVM chains will keep settling value through the transition, but new protocol capabilities will ship on Atlas. The retirement does not apply to chains already running Atlas, and permissioned chains such as GRVT will communicate steps to their users directly.

ZKsync framed the work as ongoing rather than one-time, adding new monitoring layers, internal security reviews, and tooling to assert safety properties. The company said technical details may be temporarily withheld where disclosure creates a material security risk. The move builds on the project’s earlier protocol upgrade as it consolidates development around Atlas.