Ethereum Layer 2 network Scroll completes emergency upgrade to fix proof verification vulnerability

On November 11, according to disclosures on the Scroll governance forum, Scroll completed an emergency mainnet upgrade on November 10, registering the patched proof verification contract for batch version 10. The team stated that a bug bounty report was received on November 3, and investigation confirmed the vulnerability was not exploited on the mainnet.

The vulnerability could allow old valid proofs to be used with new public inputs, thereby enabling arbitrary state roots and withdrawal roots to be finalized. Exploiting the vulnerability would require licensed prover permissions, or waiting for the forced batch mode to be triggered after seven consecutive days without finalization.

Scroll stated that all 748 finalizations conducted while the affected verification contracts were active used standard proofs, the forced mode was never triggered, and earlier versions of the verification contracts were unaffected.