Scroll says it received a bug-bounty report on November 3, 2026, identifying a flaw in a bundle proof verifier deployed on Ethereum mainnet. On November 10, it registered a fixed verifier for batch version 10.
According to Scroll, the flaw could have allowed an old valid proof to be accepted with new public inputs, potentially finalizing arbitrary state roots and withdrawal roots. Exploitation would have required the permissioned prover role or forced-batch mode, which becomes available after seven days without finalization.
Scroll says forced-batch mode was never activated, all 748 finalizations while the flaw existed used normal proofs, and the vulnerability was not exploited on mainnet. Earlier verifier versions were unaffected.
Original report: ChainCatcher, published November 11, 2026, at 21:55 (UTC+8).