Skip to content
EventLive

Scroll fixes vulnerability that could forge withdrawal proofs

1 reports1 sourcesupdated 2 hours ago

Start here

AI digest

AI-assisted source synthesis · not an independent investigation.

On November 12, 2026, Scroll fixed a vulnerability in the ZkEvmVerifierPostFeynman contract. The vulnerability could have enabled an attacker to forge state roots and withdrawal roots, and thereby withdraw funds from the bridge contract. Scroll said the vulnerability was not exploited. The team reviewed the 748 finalizations that occurred while the vulnerability existed and replayed 233 historical finalizations on an Ethereum mainnet replica; all results matched the original roots. This was Scroll’s first emergency fix since disbanding its independent Security Council, and reporting noted that the fix was not approved by an independent security committee.

AI-written from reports · updated 1 hour ago

LatestNov 12 01:30
Scroll fixed the vulnerability, said it was not exploited, and reported that the review and replay results matched the original roots.

Timeline

Follow the reporting to see the different sides of the story.

Nov 12
  1. Cryptopolitan
    Scroll fixes vulnerability that could enable forged withdrawal proofs, without approval from an independent security committee

    Scroll fixed a vulnerability in the ZkEvmVerifierPostFeynman contract that could have allowed an attacker to forge state roots and withdrawal roots and extract funds from the bridge contract; Scroll said the vulnerability was not exploited. The team reviewed 748 finalizations from the period when the vulnerability was present and replayed 233 historical finalizations on an Ethereum mainnet replica; all results matched the original roots. This was Scroll’s first emergency fix since it disbanded its independent Security Council.

Heat over time

Not enough consecutive observations yet to draw a trend.