Scroll vá lỗi xác thực bằng chứng trên mạng chính Ethereum, xác nhận không có khai thác nào

The Huoxing Finance report states that Scroll posted a message indicating it received a vulnerability bounty report on November 3, highlighting a vulnerability in the Bundle proof verifier deployed on the Ethereum mainnet, and registered the patched verifier for Batch Version 10 on November 10. Scroll confirmed that the vulnerability was not exploited on the mainnet. The vulnerability could have allowed old valid proofs to be used with new public inputs, enabling attackers to ultimately finalize arbitrary state roots and withdrawal roots. Exploiting this vulnerability required either access to a permissioned prover role or the forced batch mode activated after seven consecutive days without finalization. Scroll stated that the forced mode was never enabled, and all 748 finalizations during the vulnerability period were completed using normal proofs, with previous versions of the verifier unaffected.