Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

scroll-tech/scroll

              develop @ 788fdf0
            

Fixes

CVEs

CRITICAL

Peak severity

90.9%

Coverage

Highlights

Access Control: 4 prior fixes. Scrutinize any change in this area.

L1ScrollMessenger.sol: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Access Control: Inconsistent sender resolution and missing address checks in cross-chain message relay can allow spoofing or malicious calls to critical contracts.

Verification Bypass: State proof verification was replaced with block finalization check; any regression could allow forged proofs.

Cryptographic Vulnerability: Using load_or_create_* for ZKP parameters/seed can generate untrusted values, undermining proof integrity.