According to Scroll's official statement, the protocol deployed a fixed bundle proof verifier for batch version 10 on November 10 following a vulnerability disclosure received on November 3. The flaw, reported through the bug bounty program, allowed old valid proofs to be accepted for new public inputs, potentially enabling arbitrary state root and withdrawal root confirmation. Scroll confirmed the vulnerability was never exploited on mainnet and affected versions of the verifier remain unimpacted. The attack required either a permissioned prover role or activation of forcing mode—which never occurred. All 748 state finalizations during the vulnerability window used legitimate proofs.

View Source

Disclaimer: This content is for informational purposes only and does not constitute investment advice or encourage the buying or selling of crypto assets. It is intended to provide information about industry developments and is not directly related to the services offered by Gate TR. Although information obtained from third-party sources has been carefully reviewed, Gate TR assumes no responsibility for any errors or omissions. Crypto assets involve high risks and may experience significant price fluctuations. Before making any investment decisions, you should assess your financial situation and risk tolerance, conduct your own research, and make decisions independently.