What does the proof verifier determine? In a governance-forum report covered by PANews on November 11, 2026, Scroll said a vulnerability in its Ethereum mainnet bundle proof-verification contract could allow an old, valid proof to be used with new public inputs. Scroll said this could potentially finalize arbitrary state roots and withdrawal roots. The report does not say that this occurred.
Scroll said it received the bug-bounty report on November 3 and registered a fixed verifier contract for batch version 10 on November 10. Exploitation would require either the permissioned prover role or forced-batch mode, which becomes available after seven days without finalization.
According to Scroll, the vulnerability was not exploited on mainnet: all 748 finalizations while the affected verifier was active used normal proofs, forced-batch mode was never activated, and verifier contracts for earlier versions were unaffected. Those are Scroll’s reported findings, not an independent analysis of the on-chain records.