Scroll Patches Bundle Proof Verifier Flaw on Ethereum Mainnet

Cointime update: Scroll received a bug bounty report on Nov. 3 flagging a vulnerability in the bundle proof verifier deployed on Ethereum mainnet, and registered a patched verifier for batch version 10 on Nov. 10. The flaw could have let old valid proofs be accepted for new public inputs, enabling finalization of arbitrary state and withdrawal roots. Scroll said the bug was never exploited on mainnet, with all 748 finalizations during the exposure window using normal proofs.