Ethereum Layer 2 network Scroll completes emergency upgrade to fix proof verification vulnerability

Scroll completed an emergency mainnet upgrade on November 10, registering a patched proof verification contract for batch version 10 after a bug bounty report filed November 3 flagged a flaw that could let old valid proofs be reused with new public inputs, potentially finalizing arbitrary state and withdrawal roots. Exploitation required permissioned prover access or forced batch mode after seven consecutive days without finalization, and Scroll said no mainnet exploitation occurred. The team said all 748 finalizations processed while the affected verifier was live used valid proofs, forced mode was never triggered, and earlier verifier versions were unaffected. The fix matters because proof verification underpins the validity of every state and withdrawal root on the Scroll zkEVM rollup, so a silent verifier flaw is a bridge-safety risk rather than a liveness issue. Watch for the governance forum's post-mortem and any sign of a broader audit of verifier contract upgrade procedures across Scroll's batch pipeline.