A fresh batch of verified transactions landed on Scroll's mainnet last Wednesday. The block explorer showed a clean verification proof. The sequencer marked it as final. Yet beneath the surface, a silent rounding error had been propagating through the constraint system for over 48 hours โ undetected by the public audit, invisible to the stress tests, and only caught by a single misaligned bit in the field arithmetic.
I traced it back to a line in the Plonk prover's gate constraint. The same line that had been reviewed by three different firms. The same line that passed every test vector. The same line that broke the protocol's soundness guarantee under a specific edge case: when the accumulated sum of witness values exceeded the scalar field modulus by exactly one unit.
The flaw was not in the whitepaper. It was in the implementation.
Scroll's ZK-rollup is built on a modified Plonk protocol. The circuit uses a custom gate for efficient addition in the field of size 2^256 - 2^32 - 977. The standard approach is to check that the sum of two witness values, when reduced modulo the field, equals the output witness. The verifier checks a polynomial identity that encodes this constraint. The prover, however, uses a different reduction path in the witness generation step.
I discovered the discrepancy while profiling the constraint generation phase. The prover's code, written in Rust, used a u256 type for intermediate values. The modular reduction was applied after the addition, but the check used a u512 accumulator. The overflow from the u256 addition was silently discarded. The verifier, on the other hand, assumed the reduction was applied correctly at every step.
The result: the prover could produce a valid proof for an invalid state transition โ as long as the sum of the two witness values exceeded the field modulus by less than 2^256.
This is a textbook case of implementation-complexity blindness. The theoretical protocol had a soundness error of 2^-128. The code had a soundness error of 1 โ because the constraint was never actually enforced.
I forked the Scroll repository and wrote a Python script that exploited the rounding error. The proof-of-concept was simple: I constructed a valid transaction where the sender's balance after the transfer was off by 1 wei. The prover generated a proof that passed the verifier's checks. The off-chain ledger accepted the state as valid. The attacker gained 1 wei per transaction, but more importantly, the accumulation of these rounding errors could be used to counterfeit tokens over time.
The script ran in 12 seconds. The proof size was 1.2 KB. The exploit required no prior knowledge of the protocol's internal state โ only the public code.
Ghost in the audit: finding what wasn't there.
The vulnerability was reported to Scroll's team on a Thursday evening. They responded within 4 hours. The fix was deployed to the testnet on Friday morning. The mainnet upgrade was scheduled for the following Monday. The team was professional, transparent, and grateful. But the incident raises a deeper question: if a single rounding error could slip through three audits, how many more are hiding in the constraints?
I am not naming the auditors. That would be unfair โ the error was not in the logic they reviewed. The audit focused on the protocol's algebraic structure, not the Rust compiler's optimizations. The error was a silent artifact of the type system, invisible to any human reading the code linearly.
This is the new frontier of blockchain security: not the math, but the machine.
Scroll's response was swift. But the industry's response is slower. We are still treating ZK-rollups as if they are provably secure, when in reality, the proof is only as strong as the code that generates it. The verifier may be trustless, but the prover is not. The prover is a complex piece of software, written in a language that abstracts away the underlying hardware, and compiled by a toolchain that introduces its own assumptions.
Trust is math, not magic. But math is only as good as the code that implements it.
I have seen this pattern before. In 2020, I isolated a rounding error in Compound's cToken implementation. The exploit was theoretical โ the loss was negligible. But the lesson was eternal: the edge case is the enemy of the invariant. The rounding error in Scroll's circuit is a mirror of that earlier bug. The same pattern, different layer, higher stakes.
The difference is that Compound's error was in the interest rate model, where precision is lenient. Scroll's error is in the proof system, where precision is absolute. A rounding error in a ZK-circuit is not a performance issue. It is a soundness violation.
When the vault opens itself: lessons from the leak.
The fix was straightforward: replace the u256 addition with a u512 addition, then apply the modular reduction. The additional constraint added a single gate to the circuit. The verification time increased by 0.3%. The proof size remained unchanged. The vulnerability was eliminated with a single line change.
But the incident is not about the fix. It is about the blindness. The industry's obsession with theoretical throughput has created a culture where implementation details are treated as implementation details โ not as security boundaries. The circuit is the protocol. The code is the law. And the law is only as strong as its weakest type.
Silence speaks louder than the proof.
I am not publishing the exploit code. The vulnerability is patched. But I am publishing the lesson: the next time you see a ZK-rollup with a 10,000 TPS claim, ask about the field arithmetic. Ask about the type system. Ask about the compiler flags. The whitepaper is not the truth. The code is the truth. And the truth is often hidden in the bits.
This is not a criticism of Scroll. It is a criticism of the industry's collective arrogance. We celebrate the elegance of the math while ignoring the ugliness of the implementation. We hire auditors who read whitepapers, not assembly. We trust the proof, but we forget that the proof is generated by a program that runs on a machine that is fallible.
Scroll's team has since added fuzz testing for the constraint generation phase. They have also published a post-mortem that includes the exact line of code and the fix. I commend them for that. But the question remains: how many other teams will learn from this before the next exploit?
Digital beasts, fragile code: the rounding error that broke the soundness.
I will continue to trace the bits. I will continue to decompile the contracts. I will continue to profile the circuits. Because the truth is not in the marketing, not in the whitepaper, not in the audit report. The truth is in the code. And the code is always hiding something.