Maksym Vatsyk me-retweet
On Feb 17 2025 I reported a critical vulnerability to @Scroll_ZKP. $100m+ in TVL was at risk for more than 2 months.
Anyone could force Scroll L2 into an indefinite re-org, halting the chain so that no user transactions would be included in blocks and the chain would not move forward. All funds on L2 would be frozen.
@Scroll_ZKP downplayed the report. There was no meaningful communication about the issue—only continuous ghosting and silence. The @immunefi team mediated, yet did not correctly classify the vulnerability, which clearly falls under "Primacy of Impact." When I requested a re-evaluation, I received no response.
As a result, I am disclosing this to the public to highlight Scroll's lack of security proficiency, their unfair resolution process, and their treatment of white-hats.
You can find the link to the full report and complete timeline below.
@redhairshanks86 @0xBalloonLover @Wublockchain @coindesk @cointelegraph @TheBlock__ @aave @EtherFi @ambient_finance @l2beat
Full impact of the issue:
- The Scroll chain can be halted deliberately at zero cost to the attacker.
- Withdrawals remain blocked for the duration of the attack (potentially indefinitely, as it is free to sustain).
- Halted block production prevents critical time-dependent DeFi actions (e.g., topping up positions to avoid liquidation, oracle price updates), putting user funds at risk.
- The sequencer stops collecting transaction fees because no L2 user transactions can be included in blocks.
- Anyone on the internet can trigger the attack, and Scroll has no preventative measures.
---
Timeline
- **Feb 17 2025** – Issue submitted on Immunefi.
- **Feb 18 2025** – Scroll claims the issue was known from a Trail of Bits audit 14 months earlier and says it will be fixed in the Euclid upgrade (still 2+ months away). Scroll closes the report.
- **Feb 18 2025** – I request Immunefi triage, providing code commits that show Scroll attempted—but failed—to fix the issue. I emphasize that, while the attack vector is similar, the impact and exploitation mechanism are different.
- **Feb 24 2025** – Immunefi reopens the report for discussion with Scroll.
- **Feb 27 2025** – Immunefi asks Scroll for an update.
- **Mar 03 2025** – I contact Scroll to stress that the issue is public and exploitable on the live protocol.
- **Mar 03 2025** – I DM @yezhang1998 on Twitter about the Immunefi report.
- **Mar 04 2025** – Scroll says the issue is out of scope, labeling it "Throttling or suppression of operations without loss of user funds," and notes a similar report from Nov 06 2024.
- **Mar 04 2025** – I request Immunefi mediation to confirm the submission's uniqueness and ensure a fair bounty.
- **Mar 13 2025** – I ask Immunefi for an update.
- **Mar 17 2025** – Immunefi classifies the issue as **High severity** ("causing network processing nodes to handle transactions from the mempool beyond set parameters"). They confirm the bug is unique, acknowledge Scroll's attempted fix was ineffective, and suggest a goodwill bounty because Euclid will deprecate the vulnerable functionality (in ~1.5 months).
- **Mar 17 2025** – I reiterate that an attacker could freeze $100m+ on L2 and highlight Scroll's "Primacy of Impact" policy, which requires considering broader consequences.
- **Mar 19 2025** – Scroll acknowledges receipt and promises to follow up shortly.
- **Mar 27 2025** – I ask Scroll for an update.
- **Apr 03 2025** – I ask Scroll for an update.
- **Apr 03 2025** – Immunefi also asks Scroll for an update.
- **Apr 09 2025** – Immunefi contacts Scroll directly.
- **Apr 09 2025** – Scroll offers a payment of only **$1000**, stating the mechanism will be deprecated in the Euclid upgrade (3-4 weeks away).
- **Apr 09 2025** – I reject the bounty, explaining the protocol is still vulnerable and detailing potential losses had the vulnerability been exploited on Feb 17 2025.
- **Apr 15 2025** – I ask Immunefi to confirm "Primacy of Impact" applies and that the network remains vulnerable.
- **Apr 22 2025** – Scroll responds with a single "." and closes the report.
- **Apr 22 2025** – I ask Immunefi to explain Scroll's response and provide an update.
- **Apr 29 2025** – I notify both Scroll and Immunefi that I will publicly disclose the vulnerability on Apr 30 2025 unless the report is treated and rewarded fairly.
Here is the full audit report with a complete explanation of the issue, PoC scripts, a local network setup guide, and a PoC video. A full triage history (screenshots) is included at the end of the blog post—please review it!
notion.so/shabarkin/Crit…
English
