Odaily: Scroll has stated that on November 3, it received a bug bounty report indicating a vulnerability in the Bundle proof verifier deployed on the Ethereum mainnet, and on November 10, it registered a fixed verifier for Batch Version 10. Scroll confirmed that the vulnerability was not exploited on the mainnet.
It is reported that the vulnerability could have allowed old valid proofs to be used for new public inputs, thereby enabling an attacker to ultimately finalize arbitrary state roots and withdrawal roots. Exploiting the vulnerability would require obtaining the permissioned prover role, or the forced batch mode that is enabled after 7 consecutive days without finalization.
Scroll stated that forced mode was never enabled, all 748 finalizations during the period the vulnerability existed were completed using normal proofs, and earlier versions of the verifier were not affected.
