Scroll said it received a bug-bounty report on November 3, 2026, identifying a flaw in its bundle proof verifier deployed on Ethereum mainnet. On November 10, it registered a fixed verifier for batch version 10. Scroll said it confirmed the flaw was not exploited on mainnet.
According to the report, the flaw could have allowed an old valid proof to be accepted for new public inputs, potentially permitting arbitrary state roots and withdrawal roots to be finalized. Exploiting it would have required either the permissioned prover role or forced-batch mode, which becomes available after seven days without finalization.
Scroll said forced-batch mode was never enabled, all 748 finalizations during the period when the flaw existed used normal proofs, and earlier verifier versions were unaffected.
Original report published November 11, 2026, at 21:52 UTC+8: Foresight News.