Ethereum Layer-2 Network Scroll Completes Emergency Upgrade to Fix Proof Verification Vulnerability

TechFlow reported on November 11 that, according to disclosures on the Scroll governance forum, Scroll completed an emergency mainnet upgrade on November 10, registering a patched proof verification contract for batch version 10. The project team said it received a bug bounty report on November 3 and, after investigation, found no evidence that the vulnerability had been exploited on mainnet.

The vulnerability could allow old valid proofs to be reused for new public inputs, thereby permitting arbitrary state roots and withdrawal roots to be finalized. Exploiting the vulnerability would require permissioned prover privileges, or waiting seven consecutive days without finalization to enable forced batch mode.

Scroll said that during the period the affected verification contract was in operation, all 748 finalizations used normal proofs, forced mode was never enabled, and earlier versions of the verification contract were unaffected.

Source: TechFlow