Scroll Patches Withdrawal-Forging Bug With No Independent Sign-Off

Scroll has patched a withdrawal-forging bug in its zkEVM rollup contracts — and this time, no independent security council reviewed the fix before it shipped.

The Ethereum layer-2 protocol disclosed the vulnerability in a post-mortem on its governance forum. The flaw sat in how Scroll's contract called OpenVM's Halo2 verifier. The contract built that call by hand and used the first four bytes of a user's proof as the function label. OpenVM's verifier has a function called verify, labeled 0x24270d54. If a proof began with those exact four bytes, the call routed to verify instead of the normal path.

That mattered because verify pulled its values from attacker-controlled locations. An attacker could repurpose an old, legitimate proof and present it as validation for a new input. The result would be a fake state root and a fake withdrawal root locked on Ethereum mainnet. Older contract versions were immune. Their verifiers had no function selector, so every call took the normal path.

The fixed contract now routes every call through a single set entry point. The contract, not the proof, sets the key details.

Was anyone exploited?

Scroll says no. Two practical barriers stood in the way. An attack against the flawed contract required either the permissioned prover role or what Scroll calls "enforced batch mode." That mode only opens after seven days pass with no finalization. It never opened.

Scroll also went back and checked the record. The team re-audited all 748 finalizations made while the flawed contract was live. It then replayed 233 past finalizations on a copy of Ethereum mainnet. Every replay produced the same roots as the originals.

The bug itself came from an outside researcher. Scroll thanked the ethical hacker ZHOUCHUNGONG, who reported the flaw on Nov. 3 — one week before Scroll published the fix.

What does the governance change mean here?

The context is uncomfortable. Outsiders used to oversee Scroll's emergency patches. In May 2025, Scroll shipped a fix to its FRI verifier, and in February 2026 it swapped a verifier. Both went through the Scroll Security Council — 12 members, with 9 votes required before any action.

That council no longer exists. Scroll removed it on June 1, 2026, replacing it with a 3-of-4 admin multisig run by the Scroll team itself. Scroll lost its Stage 1 decentralization rating and now sits at Stage 0. The multisig can upgrade core contracts, including the bridge, with no delay.

Scroll first proposed scrapping the council in April, arguing it cost more than it was worth. Forum members pushed back. Some asked why Scroll didn't keep a smaller council. Others asked a sharper question: who approves the network's actions now? The latest patch answers that plainly — the team signs off on its own fixes.

Where does Scroll go from here?

The protocol's trajectory is stark. Scroll's total value locked fell from roughly $600 million in 2024 to about $24.3 million by April this year. It now sits near $6.6 million. The SCR token trades around $0.018, down nearly 99% from its 2024 high.

A proposal posted to the Scroll DAO forum on Nov. 4 outlines a radical pivot. If approved, it would turn the chain into a private, invite-only network built around AI. The SCR token would migrate back to Ethereum mainnet, where holders could use it to vote and stake.

What does this change for users? Right now, a 3-of-4 team multisig can move the bridge instantly, and the DAO faces a vote that could redefine the network entirely. Scroll has not set a date for that vote, and the decision will shape whether the protocol remains a public rollup at all.