TechFlow reported on November 11, 2026 (22:05, UTC+8) that Scroll’s governance forum had disclosed a completed mainnet emergency upgrade. According to that disclosure, Scroll finished the upgrade on November 10 and registered a fixed proof-verification contract for batch version 10.
Scroll said it received a bug-bounty report on November 3. After review, the project reported that it had not found the vulnerability being used on mainnet.
As described, the flaw could let an old valid proof be applied to new public inputs, which could allow an arbitrary state root and withdrawal root to be finalized. Exploitation would require permissioned prover privileges, or seven consecutive days without finalization followed by forced batch mode being opened.
Scroll said that all 748 finalizations while the affected verification contract was running used normal proofs, that forced mode was never turned on, and that earlier versions of the verification contract were not affected.
The report describes a deployed change on Scroll, an Ethereum layer-2 network: registration of a patched proof-verification contract for batch version 10. It does not describe an Ethereum Improvement Proposal, an ERC, or a change to Ethereum’s own consensus rules. The account of the bug, the review, and the 748 finalizations is attributed to Scroll and its governance-forum disclosure.
Original report: TechFlow, November 11, 2026
