Scroll patches Ethereum mainnet proof validator vulnerability, confirms no exploitation

icon MarsBit
Share
This is the logo of the coin.
ETH
$1,946.22-4.86%
This is the logo of the coin.
PUBLIC
$0.00384-3.27%
AI summary iconSummary
Scroll addressed a vulnerability in its Ethereum mainnet proof validator, as reported by MarsBit. The flaw was disclosed on November 3 and pertained to the Bundle proof validator deployed on Ethereum. An updated version was registered for Batch Version 10 on November 10. Scroll confirmed no exploitation occurred. The issue could have allowed attackers to reuse old proofs for new inputs, potentially altering state and withdrawal roots. Access to the prover role or forced batch mode would have been required, but neither was active. All 748 finalizations during the window used standard proofs. This update is part of broader Ethereum news developments.

Huo Xing Cai Jing reports that Scroll announced it received a bug bounty report on November 3, identifying a vulnerability in the Bundle proof verifier deployed on the Ethereum mainnet. Scroll registered the patched verifier for Batch Version 10 on November 10. Scroll confirmed that the vulnerability was not exploited on the mainnet. The flaw could have allowed old valid proofs to be reused with new public inputs, potentially enabling attackers to finalize arbitrary state roots and withdrawal roots. Exploiting this vulnerability required either access to a permissioned prover role or activation of the forced batch mode after seven consecutive days without finalization. Scroll stated that the forced mode was never activated, and all 748 finalizations during the vulnerability window were completed using normal proofs; previous versions of the verifier were unaffected.

Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.