-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0347 ============================================================ Advisory-ID: 0xCERT-2026-0347 Severity: High Published: 2026-11-11T13:48:23.000Z Updated: 2026-11-13T20:44:58.388Z Chains: Ethereum URL: https://www.0xcert.com/advisory/0xCERT-2026-0347 Title: Scroll proof verifier flaw could let a stale proof finalize arbitrary state and withdraw roots; fixed, not exploited Summary - ------- Scroll's ZkEvmVerifierPostFeynman on Ethereum mainnet let a proof prefixed with selector 0x24270d54 reach a typed OpenVM verifier function, so an old valid proof could be accepted for new public inputs. Scroll registered a fixed verifier on 10 Nov 2026 and says it was not exploited. No user action is required. Details - ------- Summary On 3 November 2026 Scroll received a bug bounty report about its bundle proof verifier on Ethereum mainnet, ZkEvmVerifierPostFeynman (0x7966FE0De13e3B81533470640Ac489223476B254). The contract built the OpenVM 2.0 Halo2 verifier call by hand, so its first 4 bytes came from the caller-supplied proof. A proof starting with 0x24270d54 reached the typed verify(bytes,bytes,bytes32,bytes32) function instead of the Halo2 fallback, which then read public values from caller-controlled offsets. On 10 November 2026 Scroll registered a fixed verifier for batch version 10. Affected - - Scroll mainnet bundle proof verifier ZkEvmVerifierPostFeynman 0x7966FE0De13e3B81533470640Ac489223476B254 (batch version 10) - - Earlier verifier versions are not affected, per Scroll: their Halo2 verifiers have no function selector - - Fixed in the new verifier 0xb15417122fB6E853d84e498517268d33d7301e74, registered in MultipleVersionRollupVerifier (tx 0x40b00411a189c46157f16b60041887687398d13394387962b899d7b548e599b0); code change scroll-tech/scroll-contracts#181 (merge commit 8264260) Impact An old, valid proof could be accepted for a new public input, which would allow finalizing an arbitrary state root and withdraw root on ScrollChain. Exploitation required either the permissioned prover role or enforced batch mode, which opens only after 7 days without finalization. Scroll states that enforced mode never opened and that all 748 finalizations while the vulnerable verifier was active used regular proofs with no malicious selector prefix. No exploitation is reported. Recommended actions - - Scroll users: no action is required per Scroll. - - Teams integrating OpenVM 2.0 or similar Halo2 verifiers: do not forward caller-supplied bytes as the call selector; call the verifier through its typed entry point, as Scroll's fix does. - - Bridge and L2 monitoring teams: confirm latestVerifier(10) on MultipleVersionRollupVerifier (0x4CEA3E866e7c57fD75CB0CA3E9F5f1151D4Ead3F) returns the new verifier. Source & attribution This 0xCERT advisory summarises Scroll's report "Report: Scroll Mainnet Emergency Upgrade on 2026-11-10" (https://forum.scroll.io/t/report-scroll-mainnet-emergency-upgrade-on-2026-11-10/1586). Scroll credits the whitehat ZHOUCHUNGONG with reporting the issue. Details may change; refer to the original source for the authoritative record. References - ---------- - - https://forum.scroll.io/t/report-scroll-mainnet-emergency-upgrade-on-2026-11-10/1586 - - https://github.com/scroll-tech/scroll-contracts/pull/181 - - https://etherscan.io/tx/0x40b00411a189c46157f16b60041887687398d13394387962b899d7b548e599b0 - - https://etherscan.io/address/0xb15417122fb6e853d84e498517268d33d7301e74 Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0Fgmr3qVYJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmcBPGmeRBNmR5ATnCB6BX9F/x+i8fs/C+b2PjmY fXp2DRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAT9QEA1JuFx3+lTPhOqhYb +vJ8WyBAbCAZOm6TrBxeGGtZCtUA/RyIUBeHadBujRs+zI2se5WKY0eaqyXh TdCmFdlyeOQF =SRLC -----END PGP SIGNATURE-----