Scroll said it received a bug-bounty report on November 3 about a flaw in the bundle proof verifier deployed on Ethereum mainnet. On November 10, it registered a patched verifier for batch version 10.
According to the report, the flaw could have allowed an old valid proof to be accepted with new public inputs, potentially finalizing arbitrary state roots and withdrawal roots. Exploitation would have required the permissioned prover role or forced batch mode, which becomes available after seven days without finalization.
Scroll said forced batch mode was never activated and that all 748 finalizations while the flaw existed used normal proofs. It said it had confirmed the flaw was not exploited on mainnet and that earlier verifier versions were unaffected.
Originally reported by Foresight News on November 11, 2026, at 21:52 UTC+8.