Originally reported by PANews on November 11, 2026, at 22:01 (UTC+8). Scroll said it had registered a patched proof-verification contract for batch version 10 on Ethereum mainnet on November 10, after receiving a bug-bounty report on November 3.
According to Scroll’s governance-forum report, the vulnerability could allow an older valid proof to be used with new public inputs. That could potentially let an attacker finalize arbitrary state roots and withdrawal roots. Exploitation would require either the permissioned prover role or forced batch-processing mode, which becomes available after seven days without finalization.
Scroll said its review found no mainnet exploitation. All 748 finalizations while the affected verifier was active used normal proofs, it said; forced mode was never activated, and verifier contracts for earlier versions were unaffected.
