Loading...
Scroll received a bug bounty report on November 3rd indicating a vulnerability in the Bundle proof validator deployed on the Ethereum mainnet, and registered a fixed validator for Batch Version 10 on November 10th. Scroll confirms that the vulnerability has not been exploited on the mainnet. This vulnerability could allow an attacker to validate old, valid proofs against new, publicly available inputs, enabling them to validate arbitrary state roots and withdrawal roots. Exploiting this vulnerability requires either a permissioned prover role or a forced batch mode enabled after seven consecutive days of incomplete final validation. Forced mode was never enabled. All 748 final confirmations during the period the vulnerability existed were completed using normal proofs, and previous versions of the validator were unaffected.