Scroll’s mainnet upgrade report says the company fixed a verifier flaw after a bug bounty report and that the defect was not exploited, addressing a security concern in Ethereum batch processing.
The problem affected the Bundle proof verifier deployed on Ethereum mainnet. A valid proof could have been reused with new public inputs, potentially allowing an attacker to finalize an arbitrary state root and withdraw root.
An attacker would have needed the permissioned prover role or an open enforced batch mode, which becomes available after seven days without finalization; Scroll said the mode never opened.
Scroll received the bug bounty report Nov. 3 and registered the repaired verifier for Batch Version 10 on Nov. 10. The company said the flaw did not affect earlier verifier versions.
Separately, Scroll’s tally for the vulnerability period lists 748 batch finalizations, each using a regular proof.
