- Scroll rushed out an emergency fix for a verifier bug that could have let an attacker finalize a counterfeit withdrawal root on Ethereum.
- The team says the bug was never exploited across 748 finalizations.
- It was the first such upgrade approved solely by Scroll’s 3-of-4 team multisig rather than its former independent Security Council.
Scroll has fixed a serious bug that could have let an attacker take money from its bridge.
Scroll says no one used the bug. The incident also marks the first emergency fix the company has shipped since it removed its independent Security Council.
What was the bug found in a Scroll contract?
Scroll has released an emergency fix for a bug that was found in a contract called ZkEvmVerifierPostFeynman. The contract checks the proofs that let Scroll post new states to Ethereum (ETH).
Scroll’s post-mortem on its governance forum says the contract built its call to OpenVM’s Halo2 verifier by hand and used the first four bytes of a user’s proof as the label for the call. OpenVM’s verifier has a function called verify with the label 0x24270d54. So, if a proof began with those four bytes, the call went to verify instead of the normal path.
That function took its values from places the attacker could control. An attacker could use this to pass off an old, real proof as proof for a new input. The result would be a fake state root and a fake withdraw root locked in on Ethereum.
Older versions were safe because their verifiers had no function selector, so every call went down the normal path.
The fixed contract now sends every call through one set entry point. This way, the contract sets the key details instead of the proof.
Scroll thanked the ethical hacker ZHOUCHUNGONG, who reported the bug on Nov. 3, one week before it published the fix.
Scroll says no one got a chance to exploit the flaw. An attack using the flawed contract would have needed either the permissioned prover role or “enforced batch mode.” That mode only opens after seven days pass with no finalization and that did not happen.
Scroll rechecked all 748 finalizations made while the flawed contract was still live, and it also replayed 233 past finalizations on a copy of Ethereum mainnet, and they all ended with the same roots.
How did Scroll previously fix bugs?
In the past, outsiders helped oversee Scroll’s emergency fixes. For instance, in May 2025, Scroll pushed a fix to its FRI verifier and a verifier swap in February 2026 that were both approved by the Scroll Security Council. The council had 12 members, and 9 of them had to agree before any action.
The council was removed on June 1, 2026. A 3-of-4 admin multisig run by the Scroll team replaced it. Scroll lost its Stage 1 decentralization rating and is now listed at Stage 0. Notably, the multisig can upgrade core contracts, including the bridge, with no delay.
Scroll first proposed that the council be removed in April, saying that it cost more than it was worth. Some people on the forum disagreed and asked why Scroll did not just keep a smaller council. They also asked who would approve the network’s actions going forward.
A proposal was posted to the Scroll DAO forum on Nov. 4, 2026, that would make the chain a private, invite-only network built around AI if it ever gets approved. The proposal also states that the SCR token would also move back to Ethereum mainnet, where holders would use it to vote and stake.
Notably, by April this year, Scroll’s total value locked (TVL) had shrunk from around $600 million in 2024 to roughly $24.3 million. TVL is down to about $6.6 million as of this report.
The SCR token has also slid to about $0.018, recording a nearly 99% decline from its 2024 high.
If you're reading this, you’re already ahead. Stay there with our newsletter.
FAQs
What was the Scroll verifier bug?
The ZkEvmVerifierPostFeynman contract passed the first four bytes of a user-supplied proof into OpenVM's Halo2 verifier, and a proof starting with selector `0x24270d54` could reach a typed function that read caller-controlled public values, letting an old proof finalize an arbitrary state root and withdraw root.
Was the bug ever exploited on Scroll?
No. Scroll says exploitation needed the permissioned prover role or enforced batch mode, neither of which occurred, and all 748 finalizations made while the vulnerable verifier was live used regular proofs with no malicious prefix.
Why did Scroll lose its Stage 1 rating?
L2BEAT downgraded Scroll to Stage 0 after it removed its independent 9-of-12 Security Council on 1 June 2026 and replaced it with a 3-of-4 multisig run by the Scroll team, which can upgrade core contracts including the bridge with no delay.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
