Scroll stated that it has fixed a vulnerability in the mainnet proof verification contract and said that no exploitation of it was found during the review.
PANews November 11 news, Ethereum Layer 2 network Scroll published a report on its governance forum stating that it received a bug bounty report on November 3 regarding the bundle proof verification contract on the Ethereum mainnet, and registered the fixed verification contract for batch version 10 on November 10. The vulnerability could allow old valid proofs to be used with new public inputs, potentially enabling the final confirmation of arbitrary state roots and withdrawal roots, but exploiting the vulnerability required holding the permissioned prover role or activating forced batch mode after 7 days without finalization. Scroll stated that, upon verification, the vulnerability was not exploited on the mainnet; all 748 finalizations during the period when the vulnerable verification contract was active used normal proofs, forced mode was never activated, and previous versions of the verification contract were unaffected.
Scroll published a report on the governance forum stating that on November 3, it received a bug bounty report regarding the bundle proof verification contract on the Ethereum mainnet.
02
Scroll stated that on November 10 it registered the repaired verification contract for batch version 10.
03
The vulnerability could allow old valid proofs to be used for new public inputs, potentially to finalize arbitrary state roots and withdrawal roots.
04
Scroll stated that exploiting this vulnerability requires having the permissioned prover role, or the forced batch mode that is enabled after 7 days without final confirmation.
05
Scroll stated that, upon verification, the vulnerability was not exploited on the mainnet; all 748 final confirmations during the active period of the vulnerability verification contract used normal proofs, and forced mode was never enabled.
06
Scroll stated that the verification contracts of previous versions are not affected.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
The proof verification contract is used to check the proofs submitted in batches. The reported vulnerability could potentially allow old proofs to be paired with new public inputs, thereby affecting the final confirmation of state roots or withdrawal roots. Scroll stated that a fixed version has been registered and that reviews found no exploitation on mainnet.
Why it matters to readers
The state root and withdrawal root relate to the confirmation of network state and withdrawals, so this type of verification vulnerability could have significant security implications. The information in the article about the unexploited status and the fixes comes from Scroll's report as relayed.
This message concerns a security fix for the Scroll mainnet. Newcomers can watch whether the patched verification contract continues to function normally, and whether there is any follow-up technical retrospective or independent audit information.
Risks and unknowns
The original text does not provide independent audit evidence or a complete technical post-mortem.
The conclusion that the vulnerability was not exploited, that all 748 confirmations used valid proofs, and that previous versions were unaffected comes from the statements in the Scroll report.
Related Developments
Loading event timeline…
Related concepts
Proof verification contract
This term is not in the glossary yet. Browse related concepts in the glossary.
