Ethereum Layer 2 network Scroll completed an emergency mainnet upgrade on November 10, registering a patched proof verification contract for batch version 10. The update addresses a vulnerability reported via bug bounty on November 3 that could have allowed old valid proofs to be reused with new public inputs, potentially enabling finalization of arbitrary state roots and withdrawal roots.
Exploiting the flaw required either the permissioned prover role or forced batch mode, which activates only after seven days without finalization. Scroll confirmed the vulnerability was not exploited on mainnet, noting all 748 finalizations during the vulnerable period used normal proofs and forced mode was never activated. Verification contracts from earlier versions remain unaffected.
Scroll Patches Proof Verification Contract Vulnerability in Emergency Mainnet Upgrade
Disclaimer: The content provided on Phemex News is for informational purposes only. We do not guarantee the quality, accuracy, or completeness of the information sourced from third-party articles. The content on this page does not constitute financial or investment advice. We strongly encourage you to conduct you own research and consult with a qualified financial advisor before making any investment decisions.
