Scroll, an Ethereum Layer 2 network, said it received a bug bounty report on 3 November about a vulnerability in its bundle proof verifier contract on Ethereum mainnet. According to a report the project published in its governance forum, it registered a fixed verifier contract for batch version 10 on 10 November.
The account was relayed on 11 November by Chinese-language outlet PANews. Scroll says the flaw was not exploited on mainnet.
What the flaw could have allowed
According to Scroll, the vulnerability could let an old valid proof be reused with new public inputs. In theory, this could allow arbitrary state roots and withdrawal roots to be finalized, which are central to how a rollup settles its state and withdrawals on Ethereum.
Scroll says exploiting the flaw was not open to anyone. It required either a permissioned prover role or the forced batch mode, which opens after 7 days without finalization.
Scroll says there was no exploit
Scroll says its checks showed that all 748 finalizations during the period the vulnerable verifier was active used valid proofs, and that forced mode was never enabled. The project also says earlier versions of the verifier contract were not affected.
What remains unknown
The claims rest on a single source: Scroll’s own report, as relayed by PANews. It is not clear whether an independent audit or on-chain analysis has verified the no-exploit statement. The identity of the bug bounty reporter and the bounty amount have not been disclosed in the available material, nor has the date the vulnerable verifier contract was deployed.
The item also does not link to the original governance forum report, so readers cannot yet check Scroll’s wording against the primary document.
Sources
- panewslab.com PANews — Scroll完成主网紧急升级，修复证明验证合约漏洞 Accessed
Comments