Scroll Patches Ethereum Proof Verifier Flaw, Says It Was Not Exploited

Scroll patched a vulnerability in the proof verifier for its Ethereum mainnet system after a bug bounty report and said the flaw was not exploited.

Scroll received the report on Nov. 3. On Tuesday, Nov. 10, it registered a corrected verifier for Batch Version 10, addressing a flaw in the Bundle proof verifier deployed on Ethereum mainnet.

The vulnerability could have allowed an attacker to reuse an old, valid proof with new public inputs. That could have enabled the attacker to finalize arbitrary state roots and withdrawal roots. Exploitation required access to a permissioned prover role or activation of forced batch mode, which becomes available after seven consecutive days without finalization.

Scroll said forced batch mode was never activated. It also said all 748 finalizations during the period when the vulnerability was present used normal proofs. Earlier versions of the verifier were unaffected.

The issue affected proof verification for batches on Ethereum mainnet. Scroll’s remediation was to register the corrected verifier for Batch Version 10.