Scroll fixes vulnerability that could enable forged withdrawal proofs, without approval from an independent security committee

AI-assisted source summary · not independently verified. Content standards

Scroll fixed a vulnerability in the ZkEvmVerifierPostFeynman contract that could have allowed an attacker to forge state roots and withdrawal roots and extract funds from the bridge contract; Scroll said the vulnerability was not exploited. The team reviewed 748 finalizations from the period when the vulnerability was present and replayed 233 historical finalizations on an Ethereum mainnet replica; all results matched the original roots. This was Scroll’s first emergency fix since it disbanded its independent Security Council.